Data Privacy Statement
Introduction
Taita Taveta University is committed to protecting the privacy, confidentiality, and security of the personal information entrusted to it by students, staff, applicants, alumni, partners, suppliers, visitors, and other stakeholders.
The University provides access to information and services through digital and physical platforms in a manner that respects your privacy and complies with the Constitution of Kenya, the Data Protection Act, 2019, and other applicable laws and regulations.
This Data Privacy Statement explains how Taita Taveta University collects, uses, stores, shares, and protects personal information when you interact with the University.
Scope of This Privacy Statement
This Privacy Statement applies to information collected through:
- Websites operated by or on behalf of Taita Taveta University;
- University management information systems, portals, applications, and other digital platforms accessed through computers or mobile devices;
- Online admission, registration, payment, learning, accommodation, research, employment, and student-support systems;
- Official University social media pages;
- Email messages, SMS notifications, telephone calls, and other official communication channels;
- Physical forms, offices, events, surveys, and other offline points of collection; and
- Services provided to the University by authorised third-party service providers.
Collectively, these platforms and channels are referred to as the "Services."
Personal Information
Personal information is any information that identifies an individual or can reasonably be used to identify an individual.
Depending on your interaction with the University, personal information may include:
- Full name;
- National identification number, passport number, or birth certificate number;
- Date of birth, age, gender, nationality, or citizenship;
- Postal, residential, and email addresses;
- Telephone number;
- Student admission number, registration number, or staff number;
- Academic qualifications, examination results, and educational records;
- Employment and professional information;
- Financial, payment, sponsorship, bursary, or banking information;
- Photographs, videos, biometric information, or identification documents;
- Health, disability, emergency-contact, or accommodation information where necessary;
- Internet Protocol address, browser information, device details, and system-usage records; and
- Any other information voluntarily submitted through University forms, portals, applications, enquiries, or official communication channels.
Collection of Personal Information
Taita Taveta University may collect personal information in several ways, including:
- When you apply for admission, employment, accommodation, scholarships, research opportunities, or other University services;
- When you register as a student or staff member;
- When you access University websites, systems, networks, portals, or applications;
- When you complete forms, surveys, assessments, or evaluation documents;
- When you attend University events, meetings, classes, examinations, or training programmes;
- When you communicate with the University through email, telephone, social media, or other channels;
- From government agencies, educational institutions, examination bodies, sponsors, partners, and other authorised organisations;
- From publicly available sources where the collection is lawful; and
- Through authorised third parties acting on behalf of the University.
The University will collect only information that is relevant and reasonably necessary for the stated purpose.
Use of Personal Information
Taita Taveta University may use personal information for legitimate academic, administrative, operational, contractual, and legal purposes, including:
- Processing applications for admission, registration, employment, accommodation, scholarships, or other services;
- Managing student and staff records;
- Delivering teaching, learning, research, examination, certification, and student-support services;
- Verifying identities, academic qualifications, documents, and eligibility;
- Processing fees, payments, refunds, bursaries, scholarships, and other financial transactions;
- Communicating important academic, administrative, security, and operational information;
- Managing graduation, alumni relations, internships, attachments, and career-development activities;
- Providing access to University systems, facilities, networks, libraries, laboratories, and digital resources;
- Supporting health, safety, security, emergency response, and institutional risk management;
- Conducting institutional research, planning, quality assurance, monitoring, evaluation, and statistical analysis;
- Managing employment, payroll, staff development, performance, and human-resource processes;
- Responding to enquiries, complaints, requests, and support cases;
- Preventing, detecting, investigating, and responding to fraud, misconduct, cybersecurity incidents, or other unlawful activities;
- Meeting regulatory, reporting, audit, accreditation, and legal requirements; and
- Improving University services, systems, programmes, and user experiences.
Personal information will be processed based on consent, contractual necessity, legal obligation, public interest, the University's legitimate interests, or another lawful basis recognised under applicable law.
Disclosure of Personal Information
The University may share personal information with authorised third parties where it is necessary, lawful, and appropriate.
Such third parties may include:
- Government ministries, departments, agencies, regulators, and law-enforcement authorities;
- The Kenya Universities and Colleges Central Placement Service and other education-sector agencies;
- Examination, accreditation, professional, and quality-assurance bodies;
- Financial institutions, payment-service providers, sponsors, insurers, and scholarship providers;
- Healthcare, emergency, security, and student-support service providers;
- Research collaborators, partner universities, internship providers, and employers;
- Information technology, cloud-hosting, software, communication, and infrastructure service providers;
- Auditors, legal advisers, consultants, and other professional service providers; and
- Any other party authorised by law or by the individual concerned.
Third-party service providers processing personal information on behalf of the University are expected to maintain appropriate confidentiality, security, and data-protection safeguards and to use the information only for authorised purposes.
The University does not sell personal information.
Information Disclosed by Users
Some University services may allow users to post or share information through discussion forums, blogs, profile pages, chat platforms, social media pages, or other collaborative services.
Information voluntarily posted in publicly accessible areas may become available to other users or members of the public. Users should avoid publishing sensitive personal information through public platforms.
Taita Taveta University may not be able to control how publicly disclosed information is copied, shared, or used by other persons.
Other Uses and Disclosures
The University may use or disclose personal information where necessary:
- To comply with applicable laws, court orders, regulatory requirements, or lawful government requests;
- To cooperate with public authorities, regulators, and law-enforcement agencies;
- To protect the rights, property, safety, systems, and operations of the University;
- To protect students, staff, visitors, and members of the public;
- To detect, prevent, investigate, or address fraud, misconduct, security threats, or unlawful activities;
- To establish, exercise, or defend legal claims; or
- In response to an emergency involving the health or safety of an individual or the public.
Where practicable, only the minimum information necessary for the relevant purpose will be disclosed.
Cookies and Other Technical Information
When you access University websites, portals, systems, or applications, the University and its authorised service providers may automatically collect technical information such as:
- Internet Protocol address;
- Browser type and version;
- Device type and operating system;
- Date and time of access;
- Pages or services accessed;
- Login and system-activity records;
- Referring website or platform;
- Cookies and similar technologies; and
- Network, performance, security, and diagnostic information.
This information may be used to operate University systems, improve services, analyse usage, maintain security, prevent unauthorised access, and resolve technical problems.
Users may manage cookies through their browser settings. Disabling some cookies may affect the functionality of certain University services.
Data Security
Taita Taveta University applies reasonable administrative, organisational, physical, and technical safeguards to protect personal information against:
- Unauthorised access;
- Accidental loss or destruction;
- Unlawful disclosure;
- Alteration or misuse;
- Cybersecurity threats; and
- Other forms of unlawful or unauthorised processing.
These measures may include access controls, authentication, encryption, system monitoring, staff awareness, secure backups, confidentiality obligations, and incident-response procedures.
However, no electronic transmission, online platform, or storage system can be guaranteed to be completely secure. Users are responsible for protecting their passwords, account credentials, devices, and other access information.
Data Retention
The University retains personal information only for as long as it is reasonably required to:
- Fulfil the purpose for which it was collected;
- Provide academic, administrative, research, or employment services;
- Maintain official institutional records;
- Meet legal, contractual, regulatory, accreditation, audit, or reporting requirements;
- Resolve disputes or complaints; and
- Establish, exercise, or defend legal claims.
When personal information is no longer required, the University may securely delete, destroy, anonymise, or archive it in accordance with approved records-management and retention requirements.
Your Data-Protection Rights
Subject to applicable law and any lawful limitations, an individual may have the right to:
- Be informed about how their personal information is collected and used;
- Request access to personal information held by the University;
- Request correction of inaccurate or incomplete personal information;
- Object to certain forms of processing;
- Request restriction of processing in appropriate circumstances;
- Request deletion of personal information where legally permitted;
- Withdraw consent where processing is based on consent;
- Request the transfer of personal information where applicable; and
- Submit a complaint concerning the handling of personal information.
The University may require proof of identity before processing a data-access or privacy-related request.
Some requests may be declined or limited where the University is required to retain or process the information under applicable academic, employment, regulatory, public-interest, or legal obligations.
Children's and Minors' Information
Where the University collects personal information relating to children or persons below the legally recognised age of consent, the information will be handled with appropriate safeguards.
Where required, consent may be obtained from a parent, guardian, or another legally authorised person.
Links to External Websites
University websites and systems may contain links to websites, applications, or services operated by third parties.
Taita Taveta University is not responsible for the privacy practices, security, or content of external platforms. Users are encouraged to review the privacy statements of third-party services before submitting personal information.
Changes to This Privacy Statement
Taita Taveta University may update this Privacy Statement periodically to reflect changes in its services, technologies, legal requirements, or data-processing practices.
The revised statement will be published on the University website together with the date on which it was last updated.
Staff and Student Privacy Statements
Additional information applicable to particular groups may be provided through:
- Staff Privacy Statement;
- Student Privacy Statement;
- Applicant Privacy Statement;
- Alumni Privacy Statement;
- Research Participant Privacy Statement; and
- Website and Cookie Notice.
These statements should be read together with this general Data Privacy Statement.
Contacting Us
Taita Taveta University is responsible for the collection, use, storage, protection, and lawful disclosure of personal information processed through its Services.
Questions, concerns, requests, or complaints relating to personal information and data protection may be submitted through:
The Data Protection Office
Taita Taveta University
P.O. Box 635–80300
Voi, Kenya
Email: dpo@ttu.ac.ke
Telephone: +254 721 113 302 / +254 774 222 064
Individuals may also submit unresolved data-protection complaints to the Office of the Data Protection Commissioner in accordance with the Data Protection Act, 2019.
Last updated: 24 July 2026
