Privacy Policy & Disclaimer

Effective date: 9 November 2026

Grandiose Tech respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit grandioseedu.com, create an account, buy or attend a course, contact us, participate in a learning community or otherwise use our services.

Grandiose Tech, Office S16, Seniors Park, Naivasha Road, Nairobi, Kenya, is the data controller for the processing described in this Policy unless another organisation is expressly identified as controller. We process personal data in accordance with the Constitution of Kenya, the Data Protection Act, 2019 and applicable regulations.

1. Personal data we collect

Depending on how you interact with us, we may collect:

Identity and contact data: name, email address, telephone number, country, postal or business address and account identifiers;
Account and security data: username, encrypted password, login records and security events;
Course and learning data: enrolments, attendance, progress, assessment results, assignments, certificates, instructor feedback and support history;
Transaction data: course purchased, amount, currency, payment status, invoice details, M-Pesa or payment reference and refund history. Payment providers handle full card or mobile-money credentials;
Technical and usage data: IP address, browser, device, operating system, pages viewed, referring page, approximate location derived from IP, cookie identifiers and platform activity;
Communications: emails, forms, calls, messages, survey responses, complaints and preferences;
Media and community data: profile image, class recordings, chat or forum contributions where the relevant feature is used and notice or consent has been provided; and
Optional marketing data: interests, campaign interactions and consent or opt-out records.

Please do not send sensitive personal data unless it is necessary and requested through an appropriate secure channel.

2. How we collect data

We collect data directly from you, automatically through the website and learning platform, and from authorised third parties such as an employer purchasing training, an instructor, a payment provider, an education partner or a social-login provider you choose to use. If another person enrols you, they must have authority to provide your data and we will give you relevant privacy information.

3. Purposes and lawful bases

We use personal data only for specified, lawful purposes, including:

creating and securing accounts, confirming identity and preventing fraud;
processing enrolments, payments, refunds, attendance, assessments and certificates;
delivering classes, learner support, notices and course communities;
responding to questions, complaints and data-rights requests;
improving course content, accessibility, reliability and website performance;
maintaining business, tax, accounting and academic records;
protecting learners, instructors, systems and legal rights;
complying with lawful requests, regulatory duties and Kenyan law; and
sending marketing where you have consented or where otherwise permitted, with an opt-out in every appropriate message.

Our lawful bases may include performance of a contract, steps requested before entering a contract, compliance with a legal obligation, your consent and our legitimate interests in operating, securing and improving our services. Where we rely on legitimate interests, we assess whether those interests are overridden by your rights and reasonable expectations. You may withdraw consent at any time without affecting processing already carried out lawfully.

4. Cookies and analytics

We use necessary cookies for security, sign-in, shopping-cart and platform functions. With consent where required, we may use preference, analytics and marketing cookies to understand use and improve communications. You can manage non-essential cookies through our cookie controls or browser settings. Blocking necessary cookies may prevent parts of the site from working. Cookie duration varies by purpose and provider.

5. When we share personal data

We may share only the data reasonably necessary with:

instructors, authorised staff and education partners involved in delivering your selected course;
payment gateways, banks, M-Pesa and fraud-prevention providers;
hosting, learning-platform, video-conference, email, messaging, customer-support, analytics and security providers acting under contract;
an employer or sponsor that purchases your training, limited to appropriate enrolment, attendance, progress and completion information disclosed before enrolment;
professional advisers, auditors and insurers subject to confidentiality; and
courts, regulators, law-enforcement or other persons where required by law or necessary to establish, exercise or defend legal claims.

We do not sell personal data. We require processors to use data only on documented instructions, protect it and delete or return it when their services end, subject to lawful retention.

6. International transfers

Some service providers may host or access data outside Kenya. We make such transfers only where permitted by the Data Protection Act, 2019, including through appropriate contractual and security safeguards, a jurisdiction with commensurate protection, necessity for a contract or another lawful basis. Sensitive personal data transferred outside Kenya is handled with the consent and safeguards required by law.

7. Retention

We retain personal data only for as long as necessary for the purpose collected and applicable legal, accounting, dispute and security requirements. Typical periods are:

account and course records: while the account is active and normally up to seven years after the last course or transaction where needed for certification, complaints or legal records;
payment, invoice and tax records: for the period required by Kenyan tax and accounting law, generally at least five years;
support and complaint records: normally up to three years after closure, longer where a dispute continues;
marketing records: until you opt out, plus a minimal suppression record so we respect the opt-out; and
technical logs and cookies: for shorter periods appropriate to security and analytics.

We securely delete, anonymise or restrict data when it is no longer required.

8. Security

We use reasonable administrative, technical and physical safeguards designed to protect personal data, including access controls, authentication, encryption where appropriate, backups, monitoring and staff confidentiality. No system is completely secure. If a personal-data breach creates a risk requiring notification, we will notify the Office of the Data Protection Commissioner and affected individuals within the time and manner required by law.

9. Your rights

Subject to the Data Protection Act, 2019 and lawful limitations, you may:

be informed about the use of your personal data;
request access to personal data we hold about you;
request correction of inaccurate or misleading data;
object to or request restriction of particular processing;
request deletion where there is no lawful reason to retain the data;
request data portability where applicable;
withdraw consent and opt out of direct marketing; and
challenge a decision based solely on automated processing that significantly affects you.

To exercise a right, email privacy@grandioseedu.com or legal@grandioseedu.com. Describe your request and provide information reasonably necessary to verify identity. We will respond within the period required by law and will explain any lawful refusal or fee.

10. Children

Our paid professional courses are generally intended for adults. A learner under 18 may enrol only with verifiable consent and involvement of a parent or lawful guardian. We do not knowingly use a child’s data for behavioural advertising. A parent or guardian may contact us to exercise the child’s rights.

11. Marketing and communications

We send service messages needed for an account, order, class, security matter or support request. Marketing is optional. You can unsubscribe using the link in an email, replying STOP where available, changing preferences or contacting us. An opt-out does not stop essential service messages.

12. Third-party websites

Our site may link to independent websites or platforms. Their privacy practices are controlled by their operators. Review their notices before providing personal data.

13. Complaints

Please contact us first so we can investigate. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

14. Policy updates

We may update this Policy when our services or legal obligations change. We will post the revised date and give appropriate notice of material changes. Changes apply prospectively unless the law requires otherwise.

15. Contact us

Grandiose Tech – Privacy Contact
Office S16, Seniors Park
Naivasha Road, Nairobi, Kenya
Email: privacy@grandioseedu.com
Alternative: legal@grandioseedu.com
General support: support@grandioseedu.com