Privacy Policy

LuxDevHQ Services Limited—also referred to as LuxDevHQ, Lux, we, us or our—respects privacy and is committed to protecting personal information. This policy describes how we collect, use, store, share, protect and otherwise process information about prospective students, applicants, enrolled students, alumni, website and campus visitors, workshop and event participants, mentors, instructors, career-support participants, and others who interact with Lux.

It applies when you visit our websites; enquire about, apply for or enrol in a program; attend physical or online classes, workshops or events; participate in internships, mentorship, career support or project work; make payments; communicate with us; access our premises; or use learning and collaboration systems.

This policy is informed by the Kenya Data Protection Act, 2019 and applicable Data Protection Regulations.

LuxDevHQ Services Limited is a technology education and professional-development organisation. Our activities may include instructor-led technical education, data and AI programs, software engineering education, practical projects, workshops, mentorship, career support, internships, professional development and community activities.

We are located at D18A Garden Court, Garden Estate, Nairobi, Kenya. You can contact us at info@luxdevhq.com or 0796448232.

Depending on your interaction with Lux, we may collect the following categories. We do not necessarily collect every item from every person.

3.1 Identity information

• Full name and profile photograph
• Date of birth or nationality where necessary
• Identification information where legitimately required
• Student or internal identification information

3.2 Contact information

• Email address, telephone number and WhatsApp number
• Address where necessary
• Emergency contact information where appropriate

3.3 Application and enrolment information

• Selected program and learning mode
• Educational and professional background
• Technical experience and career goals
• Application answers
• Cohort or intake and enrolment status
• Deferment information and relevant learning preferences

3.4 Learning and academic information

• Class attendance, assignments and assessments
• Practical exercises, technical articles and examinations
• Projects and portfolio submissions
• GitHub repositories submitted for assessment
• Instructor feedback and progress records
• Certification and course-completion records
• Internship, mentorship and job-shadowing participation

We may process payment amounts and dates, transaction or reference numbers, invoices, receipts, payment and tuition-instalment status, and limited payment-method information. Transactions may involve banks, mobile-money providers, payment gateways and authorised payment service providers. This policy does not assume that Lux stores full debit or credit card details.

Certain financial records may need to be retained for accounting, audit, taxation, compliance, fraud prevention and dispute resolution.

Lux may communicate through email, phone, SMS, WhatsApp, Zoho Cliq, video conferencing, learning platforms and other platforms used to deliver our programs. Messages may concern classes, timetables, program information, assignments, projects, payment reminders, account notices, student support, events, workshops, technical or security notices and administration.

Service and administrative communications are different from optional marketing. We may still send information needed to deliver a service or manage your relationship with Lux even if you opt out of marketing.

Where permitted, we may communicate about upcoming intakes, new programs, short courses, workshops, events, scholarships, opportunities, community activities, offers or promotions. You can opt out of direct marketing by using an unsubscribe method provided in a message or contacting us.

Opting out of marketing does not prevent necessary service or administrative messages. Sensitive biometric information is not used for direct marketing.

Lux uses a fingerprint-based door access system for authorised users of its physical premises. Fingerprint information may be processed to verify who is authorised to enter, control campus access, prevent unauthorised entry, protect students, staff and visitors, protect equipment and property, and maintain physical security.

Purpose limitation and minimisation

Biometric information collected for access control is not intended for advertising, marketing, marketing profiling or unrelated commercial activities. Lux aims to process only the biometric information reasonably necessary for secure access control. This policy does not make assumptions about whether a particular device stores a fingerprint image, a template or another representation.

Access and safeguards

Access should be restricted to authorised persons and, where necessary, authorised service providers. Lux treats biometric information with heightened safeguards appropriate to its sensitive nature, without claiming any particular device, encryption method or security certification.

Retention and deletion

Biometric access credentials should not be kept longer than reasonably necessary for access control. When someone permanently stops requiring access, their credential should be removed under Lux's applicable retention and deletion procedures unless continued retention is legally required. Lux does not state a fixed period where one has not been formally approved.

Transparency, consent and access concerns

Individuals should be informed about biometric processing. Where it relies on consent, appropriate, specific consent should be obtained; acknowledging this policy does not by itself constitute consent to every form of sensitive-data processing. Anyone with questions or concerns about biometric access may contact Lux to discuss an appropriate access arrangement where required or applicable. This does not promise that any particular alternative technology is currently available.

Where CCTV is used at Lux premises, it may support physical security, student, staff and visitor safety, theft prevention, equipment protection, incident investigation and access or security management. Any footage should be accessed only for appropriate purposes and retained no longer than reasonably necessary, subject to applicable requirements. This policy does not confirm that CCTV is currently operational or set a specific retention period.

Certain classes, workshops, presentations, events, job-shadowing sessions or online sessions may be photographed or recorded. A recording may capture an image, voice, display name, presentation, screen share, question or comment.

Educational or administrative recording—for example, making a lesson available to a cohort—is distinct from public promotional use. General enrolment does not automatically give Lux unlimited rights to use a person's face or testimonial in advertising. We will consider appropriate permission or another lawful authority before identifiable promotional use.

For career-support activities, Lux may process a CV or resume, portfolio, GitHub or LinkedIn profile, qualifications, technical skills, professional interests, interview information, employment preferences and other career information you voluntarily provide.

Where relevant, we may facilitate purpose-specific introductions to employers, recruiters, hiring partners, mentors or industry partners. We do not treat career information as automatically public and share only information appropriate to the opportunity and circumstances.

Website interactions may produce an IP address, browser and device type, operating system, referring page, pages viewed, dates and times, session information, approximate location inferred from technical information, and interaction or analytics information.

We may use this information to operate and improve the website, understand service usage and user experience, monitor performance and security, and prevent fraud, abuse or misuse.

Our website may use cookies and similar technologies that are necessary for operation, remember preferences and support analytics. Browser settings can help control cookies, although blocking necessary technology may affect site functions. See our Cookie Policy for current details and controls.

The current website integrates Google Analytics and Vercel Analytics to help us understand site use and performance. These services may process technical and interaction information according to their own terms and privacy practices. We will update this notice if our analytics practices materially change.

We may use personal information for the following purposes:

• Answering enquiries and administering applications
• Enrolment and delivery of courses
• Class, learning and assessment management
• Issuing certificates and providing support
• Communications, payments and account administration
• Internships, career support and events
• Security and premises access
• Preventing fraud, misuse and unauthorised access
• Legal compliance and dispute resolution
• Service improvement and authorised marketing

Different activities may rely on different lawful grounds under applicable law. The relevant ground depends on the purpose and circumstances.

Contractual necessity

Processing needed to take steps at your request or provide a program or service under an agreement.

Consent

Processing for which a person has specifically and freely agreed to a particular purpose. Consent may be withdrawn, subject to applicable law.

Legal obligation

Processing or retention required under applicable law.

Legitimate interests

Processing reasonably necessary for legitimate educational, operational, administrative, security or business purposes, after taking individuals' rights and interests into account.

Merely using our site or acknowledging this notice does not mean that you consent to every activity described here.

Lux does not sell personal information.

We may share limited information, where necessary and appropriate, with payment, banking or mobile-money providers; infrastructure and cloud providers; communications, learning and video-conferencing platforms; IT, security and access-control providers; professional advisers, auditors or insurers where applicable; career or employer partners where appropriate; and regulators, courts or government authorities where required by law.

Sharing should be limited to a defined purpose and subject to appropriate legal, confidentiality or service-provider arrangements where required.

Some technology providers may store or process information outside Kenya. Lux intends to handle international transfers in accordance with applicable Kenyan privacy requirements and to consider appropriate protections for the information and transfer involved. We do not claim a specific transfer mechanism where it has not been verified.

We aim to keep personal information only as long as reasonably necessary. Retention decisions may depend on the purpose, the student or customer relationship, legal obligations, accounting, taxation, audit, security, disputes and applicable limitation periods.

After the relevant period, information may be deleted, securely disposed of, anonymised or otherwise processed according to applicable requirements. Sensitive biometric access credentials receive particular attention and should be removed when access permanently ends, unless continued retention is legally required.

Lux applies reasonable technical and organisational measures appropriate to the nature and sensitivity of the information processed. Depending on the relevant system and risk, these may include access controls, account authentication, role restrictions, secure systems, appropriate backup controls, staff awareness, confidentiality measures, security monitoring, vendor controls, incident-response procedures and additional protection for sensitive information.

No electronic system can guarantee absolute security; however, Lux applies reasonable safeguards appropriate to the nature and sensitivity of the information processed.

Subject to applicable Kenyan law and any lawful limitations, you may have the following rights:

• Be informed about processing
• Access your information
• Request correction
• Object to certain processing
• Request deletion where applicable
• Request restriction where applicable
• Withdraw consent where processing relies on it
• Raise a privacy complaint

We may need to verify your identity before acting on certain requests. To exercise a right, email info@luxdevhq.com. This contact can be replaced with a dedicated privacy address if Lux appoints one.

Where Lux offers a service or event involving a person below the applicable age threshold, we will consider additional safeguards and appropriate parent or guardian involvement where legally required. This statement does not imply that every Lux course accepts children. Processing sensitive or biometric information about a minor requires particular care and consideration of applicable legal requirements.

Lux maintains processes intended to identify, investigate, contain and remediate personal-data incidents. Where applicable law requires it, we will notify relevant regulators and affected individuals. The appropriate response depends on the nature, scope and risk of the incident; this policy does not promise an unverified response time.

Lux pages and learning resources may link to third-party websites or platforms. Those services have independent privacy practices, and we encourage you to review their notices before providing personal information.

We may update this policy to reflect changes in our services, technology, operations, law, regulatory requirements or privacy practices. The current effective and last-updated dates appear at the top of this page. Continued website use is not treated as automatic consent to every revised processing purpose; we will seek consent separately where the law requires it.

Please contact Lux first if you have a concern about how we handle personal information so we can consider and respond to it. You may also raise a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya (opens in a new tab), the relevant Kenyan data-protection regulator.