Effective Date: January 1, 2026  |  Last Updated: May 6, 2026

Ognimohub Academy ("we," "our," or "us") is committed to protecting your privacy and safeguarding your personal data. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you access our website, mobile applications, or any other digital service we offer (collectively, the "Platform"). By using our Platform, you agree to the practices described in this Policy.

1.  Scope and Applicability

This Privacy Policy applies to:

• All visitors and users of the Ognimohub Academy website and mobile applications

• Registered learners, instructors, and corporate clients

• Individuals who subscribe to our newsletters, marketing communications, or promotional materials

• Applicants and prospective users who interact with our services

This Policy does not apply to third-party websites or services linked from our Platform. We encourage you to review the privacy policies of any third-party services you access through our Platform.

2.  Information We Collect

We collect personal information in the following categories:

2.1  Information You Provide Directly

• Account Registration: Full name, email address, phone number, country of residence, username, and password

• Profile Information: Professional background, educational history, profile photo, and biographical details

• Payment Information: Billing name, billing address, and payment card details (processed securely via PCI-DSS-compliant third-party payment processors — we do not store full card numbers)

• Course Interactions: Submissions, assessments, quiz responses, forum posts, and messages to instructors

• Communications: Information shared when you contact our support team or respond to surveys

• Certificate Requests: Identity verification details required to issue verified certificates

2.2  Information Collected Automatically

• Device and Technical Data: IP address, browser type and version, operating system, device identifiers, and screen resolution

• Usage and Log Data: Pages visited, features used, time spent on content, clickstream data, and error logs

• Location Data: General geographic location inferred from your IP address

• Cookies and Tracking Technologies: Session cookies, persistent cookies, web beacons, and similar technologies (see Section 7 for details)

2.3  Information from Third Parties

• Social Login Providers: If you register via Google, Facebook, or similar OAuth providers, we receive your name, email, and profile picture as permitted by your privacy settings on those platforms

• Payment Processors: Transaction status and limited billing confirmation data from payment service providers

• Analytics Providers: Aggregated behavioral data to improve Platform performance and user experience

3.  How We Use Your Information

We process your personal data for the following lawful purposes:

3.1  Service Delivery and Account Management

• Create, maintain, and manage your learner account

• Process enrolments, payments, and course access

• Issue and verify digital certificates of completion

• Facilitate communication between learners and instructors

3.2  Improvement and Personalization

• Analyse usage patterns to improve course content, features, and platform functionality

• Personalise learning recommendations and content delivery

• Conduct research and analytics for internal business purposes

3.3  Marketing and Communications

• Send transactional emails such as enrolment confirmations, receipts, and course updates

• Send marketing communications where you have provided consent or where permitted by applicable law

• Notify you of new courses, promotions, and platform updates

3.4  Legal and Compliance

• Comply with applicable laws, regulations, and legal obligations

• Enforce our Terms of Service and other agreements

• Detect, investigate, and prevent fraud, abuse, and security incidents

• Respond to lawful requests from regulatory or government authorities

4. Legal Bases for Processing (GDPR and Applicable Frameworks)

Where applicable law requires a legal basis for processing personal data, we rely on the following:

• Contractual Necessity: Processing required to provide the services you have requested, including account management and course delivery

• Legitimate Interests: Processing for purposes such as fraud prevention, platform security, and improving our services, where your interests do not override ours

• Consent: Processing based on your freely given, specific, and informed consent, including for marketing communications and the use of non-essential cookies

• Legal Obligation: Processing required to comply with applicable law, including tax, financial reporting, and data retention obligations

You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5.  Disclosure and Sharing of Personal Data

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your information in the following circumstances:

5.1  Service Providers and Data Processors

We engage trusted third-party vendors to operate the Platform on our behalf, including cloud hosting providers, payment processors, email delivery services, and analytics platforms. These vendors process data only on our instructions and are bound by appropriate data processing agreements.

5.2  Instructors and Educators

Where necessary for course delivery, instructors may access learner progress, submissions, and participation data related to their own courses. Instructors are contractually bound to treat such data confidentially.

5.3  Corporate and Institutional Clients

If your enrolment is sponsored by an employer or institution, we may share your enrolment status, progress reports, and certificate data with that organisation as specified in the applicable enterprise agreement.

5.4  Legal and Regulatory Disclosures

We may disclose personal data when required by law, court order, or a legitimate request from a competent public authority, or where disclosure is necessary to protect the rights, property, or safety of Ognimohub Academy, our users, or the public.

5.5  Business Transfers

In the event of a merger, acquisition, asset sale, or corporate reorganisation, personal data may be transferred to the relevant successor entity. We will provide notice before your personal data becomes subject to a materially different privacy policy.

6.  International Data Transfers

Ognimohub Academy operates globally and may transfer your personal data to countries outside your country of residence. Where such transfers occur, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities

• Transfers to countries recognised as providing an adequate level of data protection

• Other legally recognised transfer mechanisms as applicable

By using our Platform, you acknowledge that your data may be transferred to and processed in countries other than your own.

7.  Cookies and Tracking Technologies

7.1  Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These cannot be disabled.

• Performance and Analytics Cookies: Help us understand how users interact with the Platform to improve functionality and user experience.

• Functional Cookies: Remember your preferences such as language settings and login state.

• Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness. Used only with your consent.

7.2  Managing Cookies

You can manage your cookie preferences at any time via our Cookie Preference Centre accessible in the footer of our website. You may also configure your browser to block or delete cookies; however, some Platform features may not function correctly if cookies are disabled.

8.  Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law. Our general retention schedules are:

• Account Data: Retained for the duration of your account and for up to five (5) years following account closure for legal and audit purposes

• Transaction and Payment Records: Retained for seven (7) years in compliance with financial reporting obligations

• Certificate and Completion Records: Retained indefinitely to support certificate verification requests

• Marketing Preferences: Retained until you withdraw consent or unsubscribe

• Support Communications: Retained for three (3) years following resolution of the relevant matter

Upon expiry of the applicable retention period, data is securely deleted or anonymised.

9.  Your Rights and Choices

Subject to applicable law, you have the following rights with respect to your personal data:

• Right of Access: Request a copy of the personal data we hold about you

• Right to Rectification: Request correction of inaccurate or incomplete data

• Right to Erasure: Request deletion of your personal data where there is no lawful basis for continued processing

• Right to Restriction: Request that we limit our processing of your data in certain circumstances

• Right to Data Portability: Receive your personal data in a structured, machine-readable format

• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes

• Right to Withdraw Consent: Withdraw previously given consent at any time, without affecting prior lawful processing

• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority

To exercise any of these rights, please contact us at privacy@ognimohub.co.ke. We will respond within thirty (30) days of receiving your verified request. We may need to verify your identity before processing your request.

10.  Data Security

We implement technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Transport Layer Security (TLS) encryption for data in transit

• Encryption of sensitive data at rest

• Role-based access controls and least-privilege access principles

• Regular security assessments and penetration testing

• Employee training on data protection and information security

While we take data security seriously, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but commit to notifying affected users and relevant authorities in the event of a data breach as required by applicable law.

11.  Children's Privacy

Our Platform is intended for users aged 16 years and older. We do not knowingly collect personal data from children under the age of 16. If you believe a child under 16 has provided us with personal data without parental consent, please contact us immediately at privacy@ognimohub.co.ke and we will take prompt steps to delete such information.

In jurisdictions where a higher age threshold applies (e.g., under 13 in the United States under COPPA), we apply the higher threshold.

12.  Third-Party Links and Services

Our Platform may contain links to third-party websites, tools, or social media platforms. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing any personal data. Our Privacy Policy applies solely to data collected through our own Platform.

13.  Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document

• Notify registered users via email or an in-platform notification at least fourteen (14) days before material changes take effect

• Where required by law, seek your consent for material changes

Your continued use of the Platform after the effective date of an updated Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

14.  Contact Information and Data Controller

Ognimohub Academy is the data controller responsible for your personal data processed under this Policy.

For questions, concerns, or to exercise your rights, please contact us:

Ognimohub Academy — Data Privacy Office

Email:  support@ognimohub.co.ke

Website: www.ognimohub.co.ke

If you are located in the European Economic Area and are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority in your country of residence.

This Privacy Policy was prepared in accordance with applicable global data protection frameworks including the General Data Protection Regulation (GDPR), the Kenya Data Protection Act (2019), and other applicable privacy laws.