School Services and Data Sharing Agreement

Parties and Definitions

This Agreement is between Stimulating Smart Brains Kenya Limited, trading as Smart Brains Kenya (“SBK”, “Company”, “we”, “us”), and the School named in the applicable order form or partnership agreement (“School”, “you”).

• “Child” / “Student” means a learner under 18 enrolled by the School to receive the Services.
• “Parent” means the Child's parent or legal guardian.
• “Platform” means SBK's online coding and robotics learning platform at application.smartbrainskenya.com and associated services.
• “Services” means the coding and robotics education, curriculum, tutor-led classes, and reporting SBK provides under this Agreement.
• “Parent Terms” means SBK's Parent/Guardian Terms & Consent Notice, as updated from time to time.

Scope of Services

SBK provides coding and robotics education to the School's enrolled Students, delivered through the Platform and, where applicable, in-person or virtual tutor-led classes at the School's premises. Services include structured modules, curriculum materials, a class scheduling system, and progress reporting to the School's authorised representatives.

The courses, modules, and any per-School customisation are set out in the applicable order form or partnership agreement.

Fees and Payment

Where SBK and the School have a signed partnership agreement, order form, or commercial proposal already in place, that document governs the fees, invoicing frequency, payment terms, and accepted payment methods for the Services, and is incorporated into this Agreement by reference. This Agreement does not vary or restate those commercial terms; it sits alongside that existing agreement as the data-protection and service-delivery terms for the partnership.

Where no such agreement exists yet, fees for the Services are as set out in the order form or commercial proposal agreed between SBK and the School at onboarding, which then governs on the same basis.

SBK will give the School at least 14 days' advance written notice of any fee changes before they take effect on renewal, unless the existing partnership agreement specifies a different notice period.

Enrolment and Parental Consent

Where the School enrols a Student with SBK, the School confirms that it has the necessary authority and basis under Kenyan law (including the Basic Education Act 2013 and any applicable school enrolment agreement with the Parent) to share the Student's and Parent's information with SBK for the purpose of providing the Services.

Separately, and in addition to the School's own basis for enrolling the Student, SBK obtains its own record of parental consent directly from the Parent through the Parent Terms — either when the Parent creates or confirms an account on the Platform, or through an in-platform consent confirmation prompted at enrolment. The School's role in enrolment does not replace this direct consent record; it works alongside it.

The School agrees to retain evidence of the arrangement under which it enrolled each Student (for example, its own enrolment or admission agreement with the Parent) and to make it available to SBK within a reasonable time if requested to support a data subject request, an ODPC inquiry, or an audit under Clause 9.

Curriculum, Modules, and Third-Party Course Tools

SBK provides access to its curriculum, modules, and related materials (“Curriculum”) in video, audio, written, graphic, or other formats. The Curriculum is subject to change at any time.

SBK's Android App Development course uses curriculum built in-house. Our Robotics Projects course and school competitions use a small number of third-party tools, selected to minimise the personal data collected from Students:

• Tinkercad (Autodesk) — robotics simulations. Only the Student's first name is entered, and designs are saved under SBK's own institutional Autodesk account rather than an individual Student account.
• mBlock — used to write and upload robotics code to physical kits. No login required; no Student data collected.
• Quizizz — used for competition quizzes. Students enter their name and school name directly into Quizizz. SBK does not sell this data; its collection there is also subject to Quizizz's own terms.

SBK grants the School a limited, non-exclusive, non-transferable licence to facilitate its Students' access to the Curriculum for the purposes of this Agreement.

Data Protection Roles and Responsibilities

6.1 Roles

SBK and the School each process personal data relating to Students and Parents for their own related but distinct purposes — the School to run its own enrolment, safeguarding, and academic records, and SBK to operate the Platform and deliver the Services — and act as independent controllers of that data under the Kenya Data Protection Act 2019, cooperating on the shared processing operation described in this Agreement. SBK acts as a processor only where it holds data strictly at the School's instruction and for the School's own purposes outside the Services.

6.2 School Obligations

• Provide only the Student and Parent information reasonably necessary for SBK to deliver the Services;
• Maintain its own lawful basis and evidence for enrolling each Student, as described in Clause 4;
• Notify SBK promptly if a Parent withdraws consent, disputes enrolment, or raises a data protection concern that affects SBK's processing;
• Restrict access to reporting data received from SBK to staff who need it for their role;
• Notify SBK without undue delay if the School becomes aware of a security incident involving Student or Parent data shared with or received from SBK.

6.3 SBK Obligations

• Process Student and Parent data only for the purposes of providing and improving the Services, as described in the Privacy Policy;
• Maintain the technical, organisational, and physical safeguards described in the Privacy Policy;
• Notify the School without undue delay of any security incident affecting that School's Students, in line with SBK's breach response process;
• Provide the School reporting access described in Clause 7;
• Support the School in responding to a Parent's data subject request where the request concerns data SBK holds.

Reporting Access

The School's authorised representatives may access reporting on their enrolled Students' progress and attendance at the student, class, or school level, for the purpose of managing their students' education. This access is limited to the School's own enrolled Students.

Class Recordings and Child Safety

SBK may record live class sessions for quality assurance and child safeguarding purposes, as described in the Parent Terms and Privacy Policy. The School agrees to support SBK's safeguarding process, including cooperating with any investigation into a reported concern about a Tutor or Student, and escalating concerns raised by its own staff to SBK promptly.

SBK operates a zero-tolerance policy toward abuse, harassment, or inappropriate conduct. Tutors are subject to vetting appropriate to a child-facing role before engagement (see the Instructor Engagement Agreement).

Audit and Records

Either party may, on reasonable written notice, request information reasonably necessary to confirm the other party's compliance with this Agreement's data protection obligations. On termination of the partnership, SBK will, at the School's request, provide the School a copy of, or confirm deletion of, the Student data SBK holds for that School's Students, in accordance with SBK's retention schedule and applicable law.

Intellectual Property

SBK owns all intellectual property rights in the Platform, Services, and Curriculum, and all content SBK creates or provides, including video recordings of tutor-led sessions, text, graphics, logos, and software. Content licensed from third parties (Clause 5) remains the property of those third parties. Nothing in this Agreement transfers SBK's intellectual property rights to the School.

Any original code, projects, or apps a Student creates on the Platform remain the property of the Student (and their Parent), as set out in the Parent Terms.

Term and Termination

This Agreement runs for the term set out in the applicable order form or partnership agreement, or until terminated by either party on written notice for the other party's material, uncured breach, or as otherwise agreed.

Clauses relating to intellectual property, liability, data protection, and dispute resolution survive termination.

Liability

SBK will provide the Services with reasonable skill and care. To the maximum extent permitted by Kenyan law, SBK's total aggregate liability to the School under this Agreement will not exceed the total fees paid by the School to SBK in the three months preceding the event giving rise to the claim. Nothing in this Agreement limits or excludes any liability that cannot be excluded under Kenyan law, including for fraud, or for death or personal injury caused by a party's negligence, or for a party's breach of its data protection obligations under Clause 6 causing loss to a data subject.

Governing Law and Dispute Resolution

This Agreement is governed by the laws of Kenya.

Disputes will first be addressed through good-faith negotiation between the parties' authorised representatives. If unresolved within 30 days, either party may refer the matter to arbitration under the Arbitration Act (Cap. 49, Laws of Kenya), seated in Nairobi, in English. Either party may seek urgent injunctive relief from a Kenyan court at any time.