Summary: DFT Academy is a Kenyan e-learning company. This Policy explains what personal data we collect from learners and corporate clients, why we collect it, and the rights you have under Kenya's Data Protection Act, 2019.
We collect only what is necessary to register learners, deliver courses, issue certificates, and process payment. We do not sell personal data, and it is used for marketing only where separate opt-in consent has been given.
The full policy follows below. Provisions relating to data subject rights (access, correction, deletion, or lodging a complaint with the ODPC) are set out in Section 15.
DFT Academy is an e-learning platform operated by DFT Consulting LLP, trading as DFT Group ("DFT Academy", "we", "us", or "our"), with its office at Manga House, 1st Floor, Kiambere Road, Nairobi, Kenya. This Policy explains how we collect, use, disclose, retain, and protect the personal data of learners, corporate clients, and website visitors, in compliance with the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and other applicable Kenyan law.
By registering for an account, enrolling in a course, or otherwise using the DFT Academy platform (the "Platform"), you confirm that you have read and understood this Policy. Where this Policy uses "you", we mean the individual learner using the Platform, unless the context makes clear we are referring to a Corporate Client.
Data Controller: DFT Consulting LLP (DFT Group).
ODPC registration: Registered with the Office of the Data Protection Commissioner, Kenya (registration number available on request).
Data Protection contact: info@dftconsult.com | +254 796 803 658 | Manga House, 1st Floor, Kiambere Road, Nairobi, Kenya.
This Policy applies to personal data we collect through:
Information you give us directly
Information we collect automatically
We only use personal data for the purposes below. We do not use it for anything you would not reasonably expect from an online learning platform:
Under the Data Protection Act, 2019, every use of your personal data needs a lawful basis. Depending on the activity, we rely on:
Where you are enrolled by an employer or regulated institution (a "Corporate Client"), the Corporate Client acts as an independent data controller for its own employee records, and DFT Academy acts as a data processor for the limited purpose of delivering training and reporting completion status back to the Corporate Client. Your course progress, quiz scores, and completion certificates may be visible to your employer's designated training administrator. If you have questions about how your employer uses this data, please contact your employer's data protection officer or HR department.
Course fees are processed through third-party payment providers, including M-Pesa and PayPal. When you make a payment, your payment details are collected and processed directly by the payment provider under its own privacy policy and security standards. DFT Academy receives confirmation of payment and a transaction reference, but does not store your full card or bank account details.
The Platform uses cookies and similar technologies to maintain platform functionality and, where permitted, to understand how learners use courses in order to improve them.
| Category | What it does | Can you turn it off? |
|---|---|---|
| Strictly necessary | Keeps you logged in, secures your session, remembers items in your cart during checkout. | No, this is required for the Platform to function. |
| Functional | Remembers your preferences, such as language or display settings. | Yes, via cookie preferences. |
| Analytics / performance | Helps us understand how learners move through courses, so we can find and fix problems. | Yes, via cookie preferences. |
| Marketing | Used only if you have opted in to marketing communications, to measure how promotional content performs. | Yes, via cookie preferences. |
You can manage your cookie preferences at any time through the cookie banner shown on your first visit, or through your browser settings. Disabling strictly necessary cookies may stop the Platform from working correctly.
We will only send you marketing or promotional communications (such as new course announcements) if you have separately opted in, whether at registration or at a later point. You can withdraw this consent at any time by clicking "unsubscribe" in any marketing email, or by contacting us using the details in Section 18. Withdrawing marketing consent does not affect transactional communications related to your enrolled courses.
Personal data is retained only for as long as necessary for the purposes set out in this Policy:
| Data type | Retention period |
|---|---|
| Active account data | For as long as your account remains active, plus 24 months after your last login, unless you ask us to delete it sooner. |
| Certification and completion records | 7 years, to support audit, regulatory, and professional certification requirements. |
| Payment and tax records | 7 years, as required under Kenyan tax law (KRA requirements). |
At the end of the applicable retention period, personal data is securely deleted or anonymised.
We may share personal data with:
Our Platform infrastructure is hosted in Kenya, and we do not currently transfer personal data outside Kenya. If this changes in future, for example through a change of hosting or service provider, we will update this Policy in advance and put appropriate safeguards in place, consistent with Section 48 of the Data Protection Act, 2019, before any such transfer takes place.
We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encrypted transmission (HTTPS/TLS), and restricted administrator access to the learning management system. No system is completely secure, and we cannot guarantee absolute security.
Under the Data Protection Act, 2019, you have the right to:
To exercise any of these rights, contact us using the details in Section 18. We will respond within the timeframes required under the Act.
The Platform is intended for working professionals and is not directed at children. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected such data, we will take steps to delete it.
We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on the Platform with a revised "Last updated" date, and where changes are material, we will notify registered users by email.
If you have questions, concerns, or requests regarding this Policy or your personal data, please contact:
DFT Academy
Email: info@dftconsult.com
Phone: +254 796 803 658
Postal address: Manga House, 1st Floor, Kiambere Road, Nairobi, Kenya
You may also contact the Office of the Data Protection Commissioner, Kenya, at www.odpc.go.ke.