Last updated: 5 October 2026
This Privacy Notice explains how Sahara Emergency Training Ltd, trading as Sahara EMS College, collects, uses, shares and protects your personal data when you visit saharaems.com, contact us, or apply for and attend one of our courses. We process personal data in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
1. Who we are
The data controller is Sahara Emergency Training Ltd (company number PVT-KAUZQX22), a private limited company registered in Kenya, trading as Sahara EMS College. Registered office: SIFA House, Kisumu–Kakamega Highway, Kisumu. Postal address: P.O. Box 3535-20100, Nakuru, Kenya.
Campuses: Pioneer Plaza, 2nd Floor, Mburu Gichua Road, Nakuru · SIFA House, 2nd Floor, Right Wing, Mission Road, Kisumu.
Data protection contact
Fabian Berg, Head of IT · info@saharaems.co.ke (subject: “Data protection”) · +254 700 669 565
2. Personal data we collect
- Enquiries: name, phone or WhatsApp number, email address and the content of your message when you use our contact form, call, email or message us.
- Applications: name, contact details, the course you apply for and any information you share with us. At the interview: copies of your KCSE result slip or certificate, national ID or passport, passport photographs and, where applicable, an EMR or other medical-related certificate and sponsorship documents.
- Applicants under 18: a birth certificate and the name and contact details of a parent or guardian.
- Course participation: attendance, assessment results, certificates and provider cards, and the records required by our regulators and accrediting bodies.
- Simulation recordings: audio and video recordings of simulation scenarios in selected courses, used for the debriefing.
- Photographs: photographs of students, staff and events, published on our website and social media only with consent.
- Website use: technical data such as IP address, browser type and time of access, processed by our hosting provider to deliver the website securely.
3. Why we use your data and on what legal basis
- To answer your enquiry — your consent, or steps taken at your request before entering into a contract.
- To assess your application and admit you — steps before entering into a contract, and the performance of that contract.
- To deliver training, assess you and issue certificates — the performance of our contract with you, and compliance with our legal obligations under the TVET Act, 2013 and the requirements of our accrediting bodies.
- To record simulation scenarios for the debriefing — your consent.
- To publish photographs — your consent; for children, the consent of a parent or guardian.
- To keep records for tax, audit and regulatory purposes — compliance with legal obligations.
- To operate and secure our website — our legitimate interest in a secure, functioning website.
If you do not provide the information we need for an application or enrolment, we cannot process your application or issue a certificate.
4. Children
We process personal data of persons under 18 only with the consent of a parent or guardian and in a way that protects and advances the best interests of the child. We verify age through the documents presented at the interview, and a parent or guardian signs the consent form at enrolment.
5. Sensitive personal data
Some documents, such as birth certificates, contain family details, which the Data Protection Act treats as sensitive personal data. We collect such data only where it is necessary for admission, keep it securely and do not use it for any other purpose.
6. Who we share data with
- Accrediting and certifying bodies, to register you and issue your certificate or provider card: the American Heart Association and NAEMT through our training centre partner Emergency Care Trainers Ltd (ECT) and, for the AEMT programme, KCEMT.
- Hospitals and ambulance services that host clinical and field placements during the AEMT clinical attachment.
- Sponsors, who receive progress reports on sponsored students — only with the student's consent.
- Service providers acting on our instructions: Webflow, Inc. (website hosting and form processing), Google (map display after your consent, and web fonts) and Meta Platforms (WhatsApp, if you contact us there).
- Public authorities, where we are required to do so by law.
We do not sell personal data.
7. Transfers outside Kenya
Some of the providers above process data outside Kenya, in particular in the United States. We transfer personal data abroad only where this is necessary and appropriate safeguards are in place, such as contractual data protection commitments, in line with sections 48 to 50 of the Data Protection Act. Sensitive personal data is transferred abroad only with your explicit consent.
8. How long we keep your data
- Enquiries: 12 months after our last contact.
- Unsuccessful applications: 12 months after the intake.
- Student and certification records: for as long as our regulators and accrediting bodies require, so that certificates can be verified.
- Simulation recordings: deleted after the debriefing, at the latest 7 days after the course.
- Photographs: until consent is withdrawn.
After these periods we delete, anonymise or pseudonymise the data.
9. How we protect your data
We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access limited to staff who need the data, and secure storage of paper files at our campuses. Personal data breaches are reported to the Data Commissioner within 72 hours, as required by law.
10. Your rights
Under the Data Protection Act you have the right to:
- be informed of the use of your personal data;
- access your personal data;
- object to the processing of all or part of your personal data;
- have false or misleading data corrected or deleted, and request erasure of data we are no longer entitled to keep;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing carried out before.
To exercise your rights, contact our data protection contact above. We respond to access requests within seven days. Parents and guardians can exercise these rights on behalf of a child. If you are not satisfied with our response, you can lodge a complaint with the Office of the Data Protection Commissioner at www.odpc.go.ke.
11. Cookies
Information about cookies and similar technologies is set out in our Cookie Policy.
12. Changes to this notice
We update this notice when our processing changes. The current version is always available on this page.
