MEFA INSTITUTE OF DESIGN

Privacy, Data & Legal Policy

Effective Date: 10 April 2026

Version 1.0

1. Introduction

MEFA Institute of Design (hereinafter referred to as “MEFA”, “we”, “us”, or “our”) is committed to protecting the privacy, dignity, and personal data of all individuals who interact with our institution — including prospective students, enrolled students, alumni, staff, partners, and website visitors.

This Privacy, Data & Legal Policy explains how we collect, use, store, and protect your personal information in compliance with the Kenya Data Protection Act, 2019 (DPA) and all applicable Kenyan laws.

By using our website (mefainstitute.co.ke), submitting an application form, or engaging with our services, you agree to the terms of this Policy.

2. Who We Are (Data Controller)

MEFA Institute of Design is the data controller responsible for your personal data.

Institution: MEFA Institute of Design (MID)
Location: Nairobi, Kenya
Website: mefainstitute.co.ke
Email: info@mefainstitute.co.ke
Phone: 0741-777-848 / 0735-633-102

If you have any questions or concerns about how your data is handled, please contact us at the details above.

3. What Personal Data We Collect

We may collect the following categories of personal data:

3.1 Application & Enrolment Data

Full name, date of birth, gender
National ID or passport number
Contact details (phone number, email address, physical address)
Academic qualifications and certificates
Next-of-kin and emergency contact information
Passport-size photographs

3.2 Website & Technical Data

IP address and browser type
Pages visited and time spent on site
Device type and operating system
Referral source (how you found our website)

3.3 Communications Data

Enquiries submitted via contact or application forms
Email correspondence with our team
WhatsApp community participation (voluntary)

4. How We Use Your Personal Data

We use your personal data for the following lawful purposes:

Processing and evaluating your application for enrolment
Communicating with you about your admission status, fees, timetables, and course information
Registering you with our TVET accreditation and examination bodies
Issuing certificates and academic transcripts upon completion
Sending institution updates, news, and promotional materials (with your consent)
Improving our website and digital services
Complying with legal and regulatory obligations
Maintaining student records as required by TVET Authority of Kenya

5. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your data on the following lawful grounds:

Consent — where you have explicitly agreed (e.g., newsletter sign-up, WhatsApp community)
Contractual necessity — where processing is required to fulfil your enrolment or training agreement
Legal obligation — where we are required by law to process data (e.g., TVET Authority reporting)
Legitimate interests — for improving our services and maintaining institutional records

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share your data only in the following circumstances:

With TVET Authority of Kenya and accredited examination bodies for registration and certification purposes
With third-party service providers who assist us in operating our website and systems (e.g., Vercel for our application form platform), bound by confidentiality agreements
With Google Workspace for email, document management, and communication services
With law enforcement or regulatory bodies where required by Kenyan law
With your explicit consent, for any other purpose not listed above

All third-party partners are required to handle your data in accordance with applicable data protection laws.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes set out in this Policy, or as required by Kenyan law. Specifically:

Student academic records: Retained permanently for certification and verification purposes
Application data (unsuccessful): Deleted within 12 months of the final decision
Website analytics data: Retained for up to 24 months
Email and communication records: Retained for up to 3 years

When data is no longer required, it is securely deleted or anonymised.

8. Your Data Protection Rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

Right to be informed — to know how your data is collected and used
Right of access — to request a copy of the personal data we hold about you
Right to rectification — to request correction of inaccurate or incomplete data
Right to erasure — to request deletion of your data where it is no longer necessary
Right to restriction — to request that we limit how we use your data in certain circumstances
Right to data portability — to receive your data in a structured, commonly used format
Right to object — to object to processing based on legitimate interests or for direct marketing
Right to withdraw consent — at any time where processing is based on consent

To exercise any of these rights, please contact us at info@mefainstitute.co.ke. We will respond within 21 days as required by law.

9. Cookies & Website Tracking

Our website uses cookies and similar technologies to enhance user experience and analyse website traffic. Cookies are small text files stored on your device.

9.1 Types of Cookies We Use

Essential cookies — required for the website to function properly
Analytics cookies — to understand how visitors use our site (e.g., Google Analytics)
Preference cookies — to remember your settings and preferences

You may disable cookies in your browser settings. Note that disabling essential cookies may affect the functionality of our website.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

Secure hosting of our website and application systems
Use of Google Workspace with enterprise-grade security for email and data storage
Access controls limiting data access to authorised staff only
Regular review of our data handling practices

However, no method of data transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security and encourage you to contact us immediately if you suspect any unauthorised use of your information.

11. Minors & Parental Consent

MEFA Institute admits students who may be under the age of 18. Where an applicant is a minor, we require written consent from a parent or legal guardian for the collection and processing of their personal data.

Parents or guardians may contact us at any time to review, update, or request deletion of a minor’s data.

12. Third-Party Links

Our website may contain links to external websites, including social media platforms (Facebook, Instagram, X/Twitter) and WhatsApp communities. We are not responsible for the privacy practices or content of those external sites.

We encourage you to read the privacy policies of any third-party websites you visit.

13. Changes to This Policy

We reserve the right to update this Policy at any time. When we do, we will revise the effective date at the top of this document and, where appropriate, notify you by email or a prominent notice on our website.

We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

14. Complaints & Regulatory Authority

If you believe we have not handled your personal data in accordance with this Policy or the Kenya Data Protection Act, 2019, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner (ODPC)

Website: www.odpc.go.ke

Email: info@odpc.go.ke

We would, however, appreciate the opportunity to address your concerns before you approach the ODPC, and invite you to contact us first.

15. Contact Us

For any questions, requests, or concerns related to this Policy, please contact:

MEFA Institute of Design

Nairobi, Kenya

Email: info@mefainstitute.co.ke

Phone: 0741-777-848 / 0735-633-102

Website: mefainstitute.co.ke

This policy is governed by the laws of the Republic of Kenya.