Privacy & Data Notice

Last updated: 06 September 2026

AttachTrack Kenya is used by KCA University to manage and verify industrial attachment placements. This notice explains what personal data the system collects, why, and how it is used — in plain language, consistent with the Kenya Data Protection Act, 2019.

What we collect

• Account information: your name, email, phone number, registration number, department, and role (student, industry supervisor, university supervisor, or coordinator).
• Location data: your device's GPS coordinates, captured only at the moment you take a specific action — checking in, submitting or reviewing a logbook entry, approving a check-in, confirming your presence for a final assessment, or completing a final assessment. We do not track your location continuously or in the background.
• Timestamps: the server-recorded date and time of each action above.
• Activity content: the daily log entries, remarks, and assessment scores you or your supervisors submit.

Why we collect it

The purpose is to give the University verifiable evidence of where and when supervision and assessment activities actually took place — protecting both students and supervisors from disputed or fabricated records, and giving the University's attachment coordinators real visibility into placements across the country.

Who can see it

• Your own location data is visible to you, your assigned industry supervisor, your assigned university supervisor, and the attachment coordinator.
• It is not shared with any third party outside the University's attachment programme, and is not sold or used for advertising.
• Reverse-geocoding (converting coordinates to a readable address) is performed using OpenStreetMap's public Nominatim service; only the coordinates you generate are sent to it, and no account information is included in that request.

How long we keep it

Data is retained for the duration of your attachment programme and for a reasonable period afterward for academic record-keeping and dispute resolution, consistent with the University's records retention practice.

Your rights

Under the Data Protection Act, 2019, you may request access to, correction of, or deletion of your personal data, subject to the University's academic record-keeping obligations. To make a request, contact your attachment coordinator or the University's data protection point of contact.

Manual location entry

If GPS is unavailable (for example, indoors or on a device without location services), the system allows a manually typed location as a fallback. Manual entries are clearly and permanently marked as such everywhere they appear, so the origin of every location record stays transparent.