Privacy Policy

1. Introduction and Scope

Alumnipad (“we”, “us”, “our”, or “the Company”) operates the website alumnipad.com and the Alumnipad platform accessible at app.alumnipad.com (collectively, the “Service”). Alumnipad is a software-as-a-service (SaaS) platform that helps educational institutions and associations manage alumni communities through contact management, membership, events, fundraising, mentorship programmes, and multi-tenant administration.

This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data when you visit our website, use our platform, communicate with us, or otherwise interact with our Service. It applies to all users, including institutional administrators, alumni end-users, website visitors, and prospective customers.

We are committed to protecting your privacy and processing your personal data in accordance with applicable data protection laws, including but not limited to the EU General Data Protection Regulation (GDPR), UK GDPR, the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), Brazil’s Lei Geral de Proteção de Dados (LGPD), South Africa’s Protection of Personal Information Act (POPIA), and other applicable national and regional privacy legislation.

By accessing or using our Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not access or use the Service.

2. Data Controller Information

Alumnipad acts as a data controller for personal data collected directly through our website and marketing activities, and as a data processor on behalf of our institutional clients (who are controllers of their alumni data).

Company Name: Alumnipad
Address: Nairobi, Kenya
Email: [email protected]
Website: alumnipad.com

3. Information We Collect

3.1 Information You Provide Directly

• Account Information: Name, email address, phone number, institution name, job title, and password when you register or request a demo.
• Communication Data: Messages, feedback, and support requests you send us.
• Payment Information: Billing details processed through secure third-party providers (Stripe, M-Pesa). We do not store full card numbers.

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, session duration, and interaction patterns.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Cookies: Session and preference cookies as described in our Cookies section below.

3.3 Information from Institutional Clients

When institutions use Alumnipad, they may upload alumni data including names, contact information, graduation details, and engagement history. This data is processed on behalf of the institution under a Data Processing Agreement.

4. How We Collect Information

• Directly from you: When you fill out forms, request demos, subscribe to newsletters, or use our platform.
• Automatically: Through cookies, analytics tools, and server logs when you interact with our Service.
• From third parties: Social media login providers, institutional clients who upload alumni data, and payment processors.

5. Legal Bases for Processing

We process personal data on the following legal bases under GDPR and equivalent laws:

• Consent: Where you have provided explicit consent (e.g., marketing emails, cookies).
• Contract: Where processing is necessary to perform our obligations under a service agreement.
• Legitimate Interests: For analytics, fraud prevention, product improvement, and direct marketing to existing customers.
• Legal Obligation: Where required by law, regulation, or legal process.

6. How We Use Your Information

• To provide, maintain, and improve our Service
• To process transactions and send related information
• To send administrative communications (service updates, security alerts)
• To send marketing communications (with your consent)
• To personalise your experience and provide relevant content
• To monitor usage patterns and improve platform performance
• To detect, investigate, and prevent fraud or unauthorised access
• To comply with legal obligations and enforce our terms

7. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

• Service Providers: Cloud hosting (AWS/Railway), payment processors (Stripe, M-Pesa), email delivery (SendGrid), analytics (Google Analytics), and WhatsApp Business API (Meta).
• Institutional Clients: Alumni data is shared with the institution that uploaded it, as per the Data Processing Agreement.
• Legal Requirements: When required by law, subpoena, or to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for EU/UK transfers and equivalent mechanisms for other jurisdictions.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Account data is retained for the duration of the service agreement plus 30 days. Marketing data is retained until you unsubscribe. Alumni data uploaded by institutions is retained as directed by the institution and deleted upon contract termination (within 90 days).

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”).
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Withdraw previously given consent at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law).

11. Cookies and Tracking Technologies

We use cookies to improve your experience. Types of cookies we use:

• Essential Cookies: Required for the Service to function (session management, security).
• Analytics Cookies: Help us understand how users interact with our Service (Google Analytics).
• Preference Cookies: Remember your settings and preferences.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Service functionality.

12. Security Measures

We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Role-based access controls
• Multi-factor authentication for administrative access
• Automated vulnerability scanning

13. Children’s Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

14. Third-Party Links and Services

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

15. Data Processing Agreements

Institutional clients who upload alumni data are required to enter into a Data Processing Agreement (DPA) that defines the scope, nature, and purpose of processing, as well as the rights and obligations of each party. DPAs include Standard Contractual Clauses where required.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the “Last Updated” date. Continued use of the Service after changes constitutes acceptance of the revised policy.

17. Jurisdiction-Specific Disclosures

EU/UK (GDPR): You have the right to lodge a complaint with your local data protection authority. Our lawful bases for processing are described in Section 5.

California (CCPA/CPRA): California residents have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

Kenya (Data Protection Act 2019): We comply with the Kenya Data Protection Act and are registered with the Office of the Data Protection Commissioner.