Privacy Policy — Zoestra Studio

1 About Zoestra Studio

Zoestra Studio is a holiday programme based in Kenya for children and teenagers who are willing to engage in fun activities during the holidays. It is not an online school. Registration and full access to our platform are available exclusively to Kenyan citizens. The programme provides creative exploration through hands-on activities, mentorship, and community engagement within the Republic of Kenya.

2 What Information We Collect

When you register on Zoestra Studio or use our platform, we collect only the information necessary to provide you with our services. We do not collect sensitive personal information such as national identification (ID) numbers, passport numbers, tax identification numbers, or any other government-issued identifiers.

The information we collect is limited to the following:

Names — Learner name and guardian name, as provided during registration.
Contact information — Email addresses (learner and guardian) and phone numbers.
Demographic data — Age and gender of the learner, plus programme preferences.
Programme-related data — Selected programme, attendance records, session participation, and portfolio submissions.
Technical data — IP address, browser type, device information, and operating system details, collected automatically when you access the platform.

3 Why We Collect Your IP Address

Your IP address (Internet Protocol address) is a unique identifier assigned to your device when you connect to the internet. We collect this information for the following security and operational reasons:

Security and fraud prevention: We use IP addresses to detect and prevent unauthorised access, malicious activity, automated bots, scraping attempts, and other forms of abuse that could compromise the safety of our platform and its users.
Rate limiting: IP addresses help us enforce fair usage limits across our services, such as login attempt restrictions, to protect accounts from brute-force attacks.
Session management: IP tracking allows us to associate active sessions with the correct user accounts and detect suspicious login patterns from unusual locations.
Geographic validation: Knowing the approximate location of a connection helps us ensure that only Kenyan-based users are accessing and registering on the platform, consistent with our programme's scope and governing law.

4 How We Process and Protect Your Data

We take the security and integrity of your personal data seriously. All data collected through our platform is processed and protected as follows:

Encryption: All data transmitted between your browser and our servers is encrypted using industry-standard TLS (Transport Layer Security) protocols, ensuring that your personal information cannot be intercepted during transmission.
Secure storage: Data at rest is stored on secured servers with access controls, firewalls, and regular security audits. Sensitive data such as passwords are hashed using strong cryptographic algorithms before storage.
Data minimisation: We only collect the data we genuinely need to operate our programme. We do not hoard or stockpile personal information for vague future purposes.
Access controls: Personal data is accessible only to authorised Zoestra Studio personnel who require it for legitimate operational purposes. All access is logged and monitored.
No selling of data: We do not sell, rent, trade, or license your personal data to third parties. Your information is yours — we simply use it to serve you.

5 Consent-Based Collection

We collect your personal data only with your full consent and awareness. Here is what this means in practice:

All data collected from you is provided voluntarily when you fill out the registration form, create an account, or interact with our platform. You are never required to provide more information than what the form explicitly asks for.
Technical data such as your IP address and browser type are collected automatically when you visit the site, but only if you have accepted our cookie consent banner. If you decline, we do not perform IP geolocation, browser fingerprinting, or any form of automatic tracking beyond what is strictly necessary to deliver the web page to your browser.
We do not collect any data behind your back. You are informed at every step through this Privacy Policy, our cookie consent banner, and the consent checkbox on our registration form.
By checking the consent checkbox and submitting the registration form, you confirm that you have read and understood this Privacy Policy and agree to the collection and processing of your data as described herein.

6 Cookies and Tracking

Our platform uses a minimal number of cookies to function properly:

Essential session cookie: A session cookie is required for the platform's core functionality, including login, navigation, and CSRF protection. This cookie does not track your activity across other websites.
Cookie consent cookie: A small cookie that stores your preference (accepted or declined) regarding data collection. This ensures we respect your choice on every visit.
No third-party tracking: We do not use Google Analytics, Facebook Pixel, advertising trackers, or any third-party analytics or marketing cookies. All cookies served by Zoestra Studio are first-party and functional in nature.

If you decline cookies via our consent banner, only the essential session cookie and your consent preference cookie are stored. No IP geolocation, device fingerprinting, or behavioural tracking will take place.

7 Data Retention and Your Rights

We retain your personal data for as long as your account is active or as needed to provide our services. If you wish to access, correct, or delete your personal data, you may contact us through the admission form on our website. We will process your request in accordance with applicable Kenyan data protection laws, subject to any legal obligations that require us to retain certain information.

8 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Any updates will be posted on this page with a revised date. Continued use of the platform after changes indicates acceptance of the updated policy.

9 Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please reach out to us through the Admission / Contact section on our website. For privacy-specific inquiries, you may also call us at +254 705 353 571.