Privacy Policy

Last updated 2 October 2026 · Workfolio is published by Form and Function Works Ltd, Kenya. How personal data is handled by the vendor and by the software. Print

1. Who this covers

This policy explains (a) the personal data Form and Function Works Ltd (“we”) collects and uses itself, and (b) how the Workfolio software handles the personal data an institution enters into it. For an institution's records the institution is the data controller; we are at most a processor (see the Data Processing Agreement) where we host its online portal or backups. We comply with the Data Protection Act, 2019 of Kenya and its regulations.

2. Data we collect ourselves

Institution registration: institution name, type, registration numbers, county/town, postal address, KRA PIN, website, approximate trainee count; the contact person's name, position, email and phone; hosting preference; your message; the IP address of the request. Used to issue the institution code, verify the institution (KYC), set up its portal, license and support it, and to contact it about the service.
Web files requests and license keys: the institution code, the requesting email, download times and IP addresses — used to issue and account for licenses and to detect misuse.
Hosted portals and online backups: where we host an institution's online portal or receive its backups, the institution's full database and uploaded files pass through and are stored on our servers for that institution's use only (section 5).
Support: what you send us when you ask for help (messages, screenshots, log files).
Website: standard server logs (IP address, pages requested, browser, time) kept for security and troubleshooting for up to 90 days. We do not use advertising trackers or analytics cookies.

3. Data the software handles for an institution

An institution's Workfolio holds the records the institution enters: applicants, trainees and their guardians (identity, contacts, photos, admission, fees, results, evidence of competence, discipline and welfare cases, health records where the clinic module is used), staff (identity, contacts, pay, leave, documents), suppliers and others. The software is designed so these records live on the institution's own server; an online portal and online backups are copies for the institution's use. The institution decides who has an account, what each role may see, and how long records are kept; the software's activity log records who changed what. The institution is responsible for informing its own users and complying with the Act as controller.

4. Legal basis and purposes

We process registration, licensing and support data to perform our contract with the institution and for our legitimate interest in running and protecting the service. Portal and backup data is processed on the institution's documented instructions under the DPA. We do not sell personal data and do not use it for advertising.

5. Hosted portals and backups — how we keep them

Each institution's portal is a separate copy with its own database and files; no institution can see another's.
Access to our servers is limited to staff who need it to run the service, under confidentiality obligations. Transfers between the institution's server and the portal are over HTTPS and authenticated with the institution's key.
Backups received from an institution are stored outside web reach and only the newest sixty are kept per institution; a portal's database is replaced by the institution's server at every sync.
Data is hosted on servers we or our hosting provider operate; where a provider is outside Kenya we ensure the safeguards the Act requires for transfers.
When a license ends, the institution may export its records; we delete a hosted portal and its backups within 90 days of termination unless the institution asks for them sooner or the law requires otherwise.

6. Sub-processors

Web hosting (the data centre operating our servers), email delivery (for codes, links and notifications) and SMS gateways where an institution enables SMS. A current list is available on request.

7. Cookies

The software and the website use one strictly necessary session cookie to keep you signed in, and may store your display preferences (such as dark mode, an open menu section or a draft) in your own browser. No third-party or tracking cookies are set. The banner on first visit says so; blocking the session cookie prevents signing in.

8. Retention

Registration and licensing records: for as long as the institution is a customer and seven years after, for accounting and legal purposes. Support correspondence: three years. Server logs: ninety days. Hosted data: see section 5.

9. Your rights

Under the Data Protection Act you may ask to access, correct, delete or restrict personal data we hold about you, object to processing, or ask for a copy in a portable form, and you may complain to the Office of the Data Protection Commissioner. For records held in an institution's Workfolio, contact that institution — it is the controller; we will assist it as its processor. Contact us through the Workfolio website.

10. Security

Passwords are stored as one-way hashes; sessions use secure, HTTP-only cookies; sign-in is rate-limited; every change is logged; uploads are restricted to documents and images; the institution's server and its portal authenticate each other with a secret key. No system is perfectly secure: report any concern to us at once.

11. Children

Trainees under eighteen may be recorded by an institution as part of its lawful educational function; the institution obtains any consent the Act requires from a parent or guardian. We do not knowingly collect children's data directly.

12. Changes

We may update this policy; the date at the top shows the current version. Material changes are notified to registered institutions by email.

Questions: contact Form and Function Works Ltd through the Workfolio website.