PRIVACY POLICY

GoShule respects your privacy and is committed to protecting your personal information. This privacy policy (“Policy”) applies to your use of www.goshule.com and all subdomains thereof, including migration.goshule.com. This Policy sets out how we collect, store, guard, share and use any personal data that we may collect from you when you use or otherwise interact with the Platform or the services offered through our Sites. The Policy and our treatment of your personal data complies with the Data Protection Act of Kenya, 2019 (as otherwise amended or varied from time to time). Please review this Policy carefully to understand our practices.

Terms

For ease of reference, the terms below as used in the Policy have the following meaning: Account means the account you create when registering as a user on the site to enable you access some of the Services. Personal data means information relating to you and which can identify you as an individual (whether on its own or taken with other information). It does not include aggregated or anonymized data, which is information that can no longer identify you. Site means, as applicable, GoShule. Services means such services made available, accessed, published or otherwise offered through the Site. Review Content means any review, rating, comment, or feedback you submit about a school through the Site.

Children's Privacy

Our Services are intended for use by individuals aged 13 and older. If you are under 13, you may only use the Site with the consent and supervision of a parent or guardian, consistent with our Terms of Service. We do not knowingly collect personal data directly from children under 13 through account registration, and if we become aware that a child under 13 has registered an account without appropriate parental consent, we will take steps to delete that account. Separately, because our Services involve parents, guardians, and other users sharing reviews about their own or other children's experiences at a school, Review Content may sometimes reference a child (for example, a parent's description of their child's experience). We ask all users submitting Review Content to avoid including a child's full name, photograph, or other identifying details beyond what is reasonably necessary to describe the experience. Parents and guardians may contact us at info@goshule.com to request removal or redaction of identifying details about their child from published Review Content.

Data Controller

Bowin Brands Limited, operating in partnership with GoShule Ventures Limited, is the data controller responsible for your personal data (referred to as “we”, “us” or “our” in this Policy). If you have any questions about this Policy please send an email to info@goshule.com.

Data Collected

Depending on the Services you are obtaining or accessing, we may collect, store, use and transfer the following different types of information: Identity information such as your first name, last name, username or similar identifier. Where you register or sign in using a third-party provider (such as Google), we collect the basic profile information shared by that provider, such as your name and email address, subject to that provider's own terms and privacy practices. Contact information such as your billing address, delivery address, email address and telephone numbers, the name of your business, and/or location. Financial and payment information such as mobile money details (for example, M-Pesa phone number and transaction references) or payment card details, where you make a payment or purchase a subscription through the Site. Account information relating to the use of the site including profile data such as your username, password, orders, interests, preferences, survey responses and/or feedback. Review Content and related information, including the text of any review you submit, your rating selections, your disclosed relationship to the school (parent, teacher/staff, school administrator, or other), and your display preference (named or anonymous). Where you choose to display a review anonymously, we retain your actual account identity internally for moderation, fraud-prevention, and legal purposes, even though it is not shown publicly. Automatic information about your device including technical data (internet protocol (IP) address, login data, time zone setting, browser type and version, location, browser plug-in types and versions, operating system and platform, and/or other technology on the devices you use to access the site. Note that this automatic information and device information is used to screen for potential risks and fraud, to improve and optimize the Site, to ease access to the site, and to carry out upgrades, data analysis, and improve the quality of services. You can set your browser to refuse all or some browser cookies, but this will make parts of the site inaccessible or inhibit functionality. Marketing and communications data such as your preferences in receiving marketing from us and our third parties and your communication preferences. Please note that this is not an exhaustive list. We may collect and use statistical or demographic information for any purpose. This data is anonymous and it is not personal information as this data will not directly or indirectly reveal your identity. However, if we combine or connect statistical/demographic information with your personal data, we treat the resulting information as personal data and it will be used in accordance with this privacy policy.

What If I Don't Want to Provide Any Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services, or to publish your review, or to grant contribution-based access to Review Content on the Site). In this case, we may have to decline or cancel a product or service you have with us, but we will notify you if this is the case at the time.

How Data Is Collected

We collect personal information that you provide to us directly, for example through the site, on the phone,email or through any other communication channel or method; that we obtain from other sources, including third-party signin providers as described above; and using cookies, logs, web beacons, tags, pixels and other internet technologies (used to record information about how you browse the Site), for example the technical data described above.

Accuracy of the Data

It is important that the personal data we hold is accurate and current to enable us to deliver the Services. As such, please keep us informed if your personal data or any other information changes in the course of your use of the Site. You guarantee and declare that you are the owner of the information you submit on the Site or share with us, or that you have the necessary rights to do so. You also guarantee and declare that it is exact, true and verified, and the use of the information is not contrary to this Policy or applicable laws and will not damage a third party's reputation. You accept full and complete liability for any information that is contrary to this Policy or any applicable laws.

Use of the Collected Data

How we use your personal data depends on the Services you are accessing. We will use your personal data: To provide you with the Services, in particular:

• To publish approved Review Content and display associated ratings, recommendation counts, and category rating breakdowns.
• To determine and administer contribution-based access to Review Content on the Site, including tracking whether you have an approved review and the applicable access period.
• To process payments for any paid features or subscriptions, where offered.
• To run targeted marketing campaigns (goshule.com).
• To contact you about the Services, events and promotions (where you have agreed to us doing so).
• To screen for fraud, fake accounts, or misuse, including detecting duplicate or fraudulent Review Content.
• To comply with our legal obligations.
• To perform a task in the consideration of the greater public interest.
• Where necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where the personal data is required for statistical or research purposes. Note: we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Disclosure of Information

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as required by law or as necessary to fulfill a requested service. Non-personal information may be shared with trusted third-party service providers to assist us in website analytics and improvement efforts.

Web Analytics

Our website uses Google Analytics, a web analytics service provided by Google, Inc. (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Such use includes the “Universal Analytics” mode of operation. This makes it possible, if a user is logged into a Google service, to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus to analyse the user's activities across such devices. Google Analytics uses cookies. The non-personal information generated by such cookies about your use of our website is usually transferred to a Google server and stored there. However, the corresponding IP addresses are anonymised beforehand using IP anonymisation. The anonymised IP address transmitted by your browser under Google Analytics will not be merged with other Google data. Google will use this information on our behalf for the purposes of evaluating your use of our website, compiling reports on website activity and providing other services relating to website activity and internet use. If you wish to prevent the collection of data regarding your activity on our website by Google Analytics, you can use the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout/. You can also prevent the storage of cookies by adjusting your browser software accordingly.

Cookie Notice

The Site displays a cookie notice on your first visit, allowing you to accept or manage non-essential cookies. Essential cookies required for the Site to function (such as keeping you logged in) are used regardless of this preference, consistent with applicable law.

Security

If you are a registered user of the Site, you are entirely responsible for maintaining the confidentiality of your password and login name, or, where you sign in via a third-party provider, for maintaining the security of that provider account. Furthermore, you are entirely responsible for any and all activities that occur under your account. You must immediately notify us of any unauthorized use of your login name or any other breach of security known to you. The security and integrity of your personal data is important to us and we have in place appropriate security measures and take all due care to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Unfortunately, we cannot guarantee its absolute security since there is no method of transmission over the internet or method of electronic storage that is fully secure. We disclaim all liability to you to the greatest extent possible under the law should such a breach of security occur.

Sharing Your Personal Data

Except as specified in this Policy, we will not disclose your personal data to third parties without your consent. Depending on the Services, we may share your personal data with: External third parties such as service providers (for example, our web hosting and communications tools, mobile payment processors such as Safaricom M-Pesa, MailChimp), the Kenya Revenue Authority where required by law, and Google Analytics. Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets to. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Policy. Depending on the Services you are accessing, we may share certain personal information with third parties to help us use your personal information. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Transfer of Data

Your personal information may be transferred outside Kenya either for ease of delivery of Services, storage or other necessary form of processing as described in this Policy. When such transfer is necessary and for your benefit, we ensure an appropriate and similar degree of protection is afforded to it by requiring implementation of relevant safeguards by the recipient of the personal data as required by the law in Kenya. Your sensitive personal data will also be transferred outside of Kenya for the same reasons as described above in this section. By accepting this Policy, you are providing us with your express consent to transfer your personal data as laid out above. We will ensure an appropriate degree of protection is afforded to the transfer of sensitive personal data outside of Kenya by requiring implementation of relevant safeguards. Please contact us if you would like further information on this.

Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Your personal data may be retained for a longer period where there has been a complaint or there is a prospect of litigation with respect to your use of the Site. Where your access to Review Content is based on having an approved review (see our Terms of Service), we retain the data necessary to administer that access, including your review approval date and the associated access period, for as long as your account remains active and for a reasonable period afterward for recordkeeping purposes.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You will receive marketing communications from us if you have requested information from us or signed up on the website,purchased goods or services from us and you have not opted out of receiving the said marketing communications. You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, product/service experience or other transactions.

Your Legal Rights

In accordance with the applicable laws of Kenya, you may have the right to:

• Be informed of the use to which your personal data is being put.
• Access your personal data.
• Object to the processing of your personal data.
• Request restriction of the processing of your personal data.
• Request correction of false or misleading personal data.
• Request the transfer of your personal data.
• Request erasure of your personal data. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe your personal data has been processed in a manner that violates the Data Protection Act, 2019. We encourage you to contact us first at info@goshule.com so we can attempt to resolve your concern directly. You can exercise any of these rights by contacting us at info@goshule.com.

Changes to the Privacy Policy

We regularly review and update this Policy in order to reflect changes to our practices, for operational, legal or regulatory reasons, and for any other purpose. Any revisions to this Policy will be uploaded to the Site and such upload will be deemed to be sufficient communication to you. Where you are a registered user, we may elect, at our own discretion, to notify you of any revision through a notice on your account.

Changes to Personal Information

Creating and using a profile on GoShule requires you to share with us your personal information (e.g. email address and mobile phone number). Because we respect your privacy and are committed to protecting your personal information, we will provide you with options to modify any of the personal information that you provided us when setting up your profile.

Data Deletion Request (Right to Be Forgotten)

As a data subject, you can request deletion of your personal data from our system or withdraw consent to the processing of your personal information. Should you wish to completely delete your profile, send an email to info@goshule.com with a clear subject line, from the email address associated with the profile you wish to be deleted, and at least a brief reason for your request. Please note that deleting your account will result in the loss of any contribution-based access to Review Content described in our Terms of Service. Published Review Content you have submitted may be retained on the Site in accordance with the license described in our Terms of Service, even after account deletion, though we will remove your name and identifying account information from public display upon request.

Contact Us

If you have any questions or concerns about our Privacy Policy or the handling of your personal information, please contact us at info@goshule.com. By using our website, you consent to the terms outlined in this Privacy Policy. Thank you for trusting GoShule with your personal information.