Cookie Policy & Legal Notice

Who We Are

Hoshiar Education Consultants Ltd is a registered education consultancy based in Nairobi, Kenya. We assist Kenyan students in identifying, applying to and enrolling in universities and colleges abroad, primarily in the United Kingdom, Canada, Australia, the United States, Malaysia and other destinations.

This Cookie and Legal Policy applies to our website at hoshiar.co.ke and all associated subdomains. By using our website or submitting an application through our online portal, you agree to the practices described in this document.

We are committed to protecting your personal information in accordance with the Kenya Data Protection Act, 2019 and applicable international standards including the General Data Protection Regulation (GDPR) where relevant.

Cookie Policy

A cookie is a small text file placed on your device when you visit a website. Cookies help websites function correctly, remember your preferences and protect against fraudulent activity.

Cookies We Use

Cookie	Provider	Purpose	Duration
Firebase Auth Session	Google Firebase	Keeps staff members securely logged into the staff portal. This cookie is only set for authenticated staff and is never placed on public visitor devices.	Session
__utmz, _ga (reCAPTCHA)	Google reCAPTCHA v3	Analyses visitor behaviour to distinguish human users from automated bots. Protects the application form from spam and fraudulent submissions. No personal data is shared with third parties for advertising purposes.	Up to 6 months
hoshiar_cookie_consent	Hoshiar (first party)	Stores your cookie consent preference so we do not show the consent banner on every visit.	1 year

Managing Cookies

You may withdraw your consent at any time by clearing your browser cookies or adjusting your browser settings. Most modern browsers allow you to block or delete cookies through the Settings or Preferences menu. Please note that disabling cookies may affect the functionality of certain parts of this website, particularly the application form.

Data We Collect

We collect personal information in the following circumstances.

When You Submit an Application

• Full name, date of birth and gender
• Email address and phone number
• Next of kin name and contact details
• Nationality and country of residence
• Academic qualifications and grades
• Preferred university destination and intake period
• Supporting documents such as transcripts, certificates and identification

When You Contact Us

• Name and email address provided in the contact form
• The content of your message or enquiry

Automatically Collected Data

• Browser type, device type and operating system
• IP address and approximate geographic location
• Pages visited and time spent on the website
• reCAPTCHA interaction score generated by Google

How We Use Your Information

We use the personal information we collect strictly for the following purposes.

• Processing and managing your university application through our nine-stage pipeline
• Communicating with you about your application status, required documents and next steps
• Verifying the authenticity of documents you submit
• Sharing your application details with the relevant universities or colleges on your behalf, with your knowledge
• Complying with our legal and regulatory obligations
• Protecting our platform against spam, fraud and abuse through reCAPTCHA
• Improving the quality and functionality of our services

We will never use your personal information for unsolicited marketing, sell it to third parties or share it with any party not involved in your application process without your explicit consent.

Your Rights Under the Kenya Data Protection Act, 2019

As a data subject under Kenyan law, you have the following rights regarding your personal information held by Hoshiar Education Consultants Ltd.

• Right to Access. You may request a copy of the personal data we hold about you at any time.
• Right to Rectification. You may request that inaccurate or incomplete data be corrected.
• Right to Erasure. You may request that we delete your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention obligations.
• Right to Restrict Processing. You may request that we limit how we process your data in certain circumstances.
• Right to Object. You may object to processing of your personal data where we rely on legitimate interests as our legal basis.
• Right to Data Portability. You may request your data in a structured, commonly used and machine-readable format.
• Right to Withdraw Consent. Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 7 of this document. We will respond to all verified requests within 21 days as required by the Kenya Data Protection Act, 2019.

Third Party Services

Our website relies on the following trusted third party services to operate securely and effectively.

Google Firebase

We use Google Firebase, a platform developed by Google LLC, to store application data, authenticate staff members and send system notifications. Firebase is hosted on Google Cloud infrastructure and complies with international data protection standards. Data processed by Firebase is stored in secure data centres. For more information, visit firebase.google.com/support/privacy.

Google reCAPTCHA v3

We use Google reCAPTCHA v3 on our application form to protect against automated bot submissions. reCAPTCHA analyses user behaviour and assigns a score without requiring any action from the user. Google may use the information collected by reCAPTCHA to improve its fraud detection services. For more information, visit policies.google.com/privacy.

Cloudinary

Supporting documents and images uploaded through our platform are stored securely using Cloudinary, a cloud media management service. Files are transmitted over encrypted connections and stored in secure infrastructure. For more information, visit cloudinary.com/privacy.

Vercel

Our website is hosted on Vercel, a cloud platform for static sites and web applications. Vercel may process request logs including IP addresses for performance and security purposes. For more information, visit vercel.com/legal/privacy-policy.

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected.

• Application data is retained for a minimum of three years from the date of submission to support any queries, appeals or follow-up processes related to your application.
• Communication records are retained for two years from the date of last contact.
• Staff account data is retained for the duration of employment and deleted within 30 days of account deactivation.
• Cookie consent records are retained for one year.

After the applicable retention period, personal data is securely deleted or anonymised in accordance with best practice data destruction procedures.

Security Measures

Hoshiar Education Consultants Ltd takes the security of your personal information seriously. We implement the following technical and organisational measures to protect your data.

• All data transmitted between your browser and our servers is encrypted using HTTPS with TLS encryption.
• Access to application data is restricted to authorised staff members through a role-based access control system with three levels of permission.
• Staff accounts are protected by strong password requirements and one-time password authentication during onboarding.
• Firestore Security Rules enforce strict read and write controls at the database level, preventing unauthorised access to sensitive collections.
• Document uploads are stored in secure cloud infrastructure with access restricted to authorised staff only.

While we take every reasonable precaution to protect your information, no method of electronic transmission or storage is 100% secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify affected individuals and the relevant authority within the timeframe required by law.

Changes to This Policy

We may update this Cookie Policy and Legal Notice from time to time to reflect changes in our practices, technology or legal requirements. When we make significant changes, we will update the effective date shown at the top of this page and, where appropriate, notify users through the website or by email.

We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of our website after any changes constitutes your acceptance of the updated policy.