Privacy Policy

HRHub (at hrhub.ke) is provided by Digital Systems Consultancy, based in Nairobi, Kenya ("we", "us"). In this policy:

• a customer or employer is an organisation that has an HRHub account;
• a user is anyone who signs in — administrators, HR and payroll staff, approvers, and employees using the self-service portal;
• an employee is a person whose records an employer keeps in HRHub, whether or not they ever sign in.

Who decides how your data is used depends on the kind of data:

Employee and payroll records — your employer is in charge

When an employer puts information about its employees into HRHub, the employer is the data controller: it decides what to collect and why, and it is responsible for having a lawful basis to do so. We act as the employer's data processor: we store and process that information only to provide the service, on the employer's instructions and under our Terms of Service. We do not use employee data for our own purposes, and we do not sell it.

Account, billing, website and support data — we are in charge

We are the data controller for the information we need to run our own business: user accounts and sign-in, subscriptions and invoices, messages you send us, product feedback, how the service is used, and visits to this website.

Data employers keep about employees (we process it for them)

• Identity: name, date of birth, gender, marital status, photo, national ID number, passport number.
• Contact details: phone number, email address, address, and an emergency contact.
• Statutory numbers: KRA PIN, NSSF and SHIF numbers, and the details needed for PAYE, Housing Levy and NITA.
• Payment details: bank account and branch, and M-Pesa or other mobile-money numbers for pay.
• Employment and pay: job title, grade, department, contract terms, salary, allowances, deductions, pensions, loans and advances, payslips, P9 tax cards and statutory reports.
• Time away and performance: leave requests and balances, overtime, appraisals and related notes.
• Documents the employer or employee uploads, such as contracts, certificates and letters.
• Health-related information where needed, such as a disability exemption certificate.

Data we collect as controller

• Account data: name, email, phone number, organisation and role, password (stored only as a secure hash), two-factor authentication settings, and sign-in and session records.
• Billing data: the organisation's billing contact, invoices, payment records and, for M-Pesa, the paying phone number. Card details are entered on Stripe's page and not stored by us.
• Support and feedback: what you send us by email, phone or the in-app feedback form.
• Usage data: when signed-in users open pages and use features in the app (with the date, time, user and organisation), and technical logs such as IP address, browser type and errors, kept to run, secure and improve the service. We collect this ourselves; we do not use third-party analytics or advertising trackers.
• Notification preferences: whether you have turned on email, WhatsApp, Telegram or browser push notifications, and the phone number or chat link used for them.

The Act treats some information as sensitive personal data. In HRHubthis can include an employee's health status (for example a disability certificate used to claim the tax exemption for persons with disabilities), sex, marital status and family details such as an emergency contact and their relationship to the employee.

Employers should only record sensitive data where they need it, for example to meet employment, tax or social-security obligations, and must meet the extra conditions the Act sets for it. Inside HRHub, who can see employee records and documents, such as disability certificates, is controlled by the roles and permissions the employer sets.

For employee data, the purposes and lawful basis are the employer's — usually performing the employment contract and complying with tax, social-security and employment law. We process it only to provide HRHub to that employer.

For data we control, we rely on these lawful bases under section 30 of the Act:

We do not use personal data for advertising, we do not sell it, and we do not make decisions about people based solely on automated processing. Payroll figures are calculated automatically, but the employer reviews and approves each payroll run.

We share personal data only with service providers (sub-processors) that help us run HRHub, under contracts that require them to protect it and use it only for that service:

We may also disclose personal data:

• to the employer's own users, according to the roles and permissions the employer sets — for example, an employee sees their own payslips, and HR sees the team's;
• to an AI assistant you connect: HRHublets a user link their own AI assistant (such as Claude Desktop) with a personal access token. The assistant can then read the data that user is allowed to see, and that data goes to the assistant's provider under the user's or employer's own agreement with that provider. HRHub does not send your data to AI providers on its own;
• when the law requires it, for example to the Kenya Revenue Authority or a court order;
• to a buyer or successor if our business is sold or reorganised, under the same protections as this policy.

HRHubprepares statutory reports (such as PAYE, NSSF, SHIF and Housing Levy returns) for the employer to file. We do not send them to KRA, NSSF or SHA on the employer's behalf unless the employer asks us to and we say so.

Personal data is processed outside Kenya, in South Africa and the European Union. Our application servers and file storage (uploaded documents and generated files) run on Google Cloud in South Africa, and our database, which holds account, billing, employee and payroll records, is hosted by Neon in Frankfurt, Germany. Some other sub-processors in the table above also process data in other countries, mainly the United States.

We transfer data abroad only as sections 48 to 50 of the Act and the Regulations allow, by:

• choosing established providers that are bound by contract to protect the data, use it only on our instructions, and apply security measures at least as strong as those in this policy;
• encrypting data in transit and using each provider's access controls;
• transferring only what each provider needs to do its job.

Where the Act requires a data subject's consent to transfer sensitive personal data out of Kenya, the employer, as controller, is responsible for obtaining it for its employees. You can ask us for more detail about the safeguards for a particular transfer.

• Account datais kept while the customer's subscription is active, and for a reasonable period afterwards to handle questions, disputes and re-activation, then deleted.
• Payroll and tax records: Kenyan law requires employers to keep these — the Tax Procedures Act, for example, requires records to be kept for at least five years. While the customer is subscribed, the employer controls how long its records stay in HRHub.
• When a customer leaves, it can export its data first. We then delete or return the employer's data according to its instructions and our Terms of Service, unless the law requires us to keep something. Copies in backups are removed as those backups expire.
• Billing records are kept as long as tax and accounting law requires.
• Usage data, logs and support messages are kept only as long as needed for the purposes above.

Measures we use to protect personal data include:

• encryption of data in transit (HTTPS/TLS) between your browser, our servers and our providers;
• tenant isolation: each customer's data is kept in its own separate database schema, so one organisation cannot see another's records;
• role-based access control inside each organisation, so users see only what their role allows;
• two-factor authentication for sign-in, securely hashed passwords, session controls and limits on repeated attempts;
• secrets and integration keys (such as WhatsApp and email credentials) stored encrypted, and access to production systems limited to the staff who need it;
• regular backups and monitoring of our systems.

No system is perfectly secure. Please keep your password private, use two-factor authentication, and tell us straight away if you suspect your account has been misused.

Under section 26 and related sections of the Act, you have the right to:

• be informed of how your personal data is used;
• access your personal data;
• object to all or part of its processing;
• have false or misleading data corrected;
• have false, misleading or unlawfully held data deleted;
• receive your data in a portable format, where the Act provides for it;
• withdraw consent you have given, at any time, without affecting earlier processing.

If you are an employee, please contact your employer first: it controls your records and can correct, export or delete them. You can see and update some details yourself in the self-service portal. If you contact us about employer-held data, we will pass your request to your employer and help it respond.

For account, billing or website data, contact us using the details below. We will respond within the time the Act and Regulations allow, and we may need to confirm your identity first. Exercising your rights is free unless a request is clearly unfounded or excessive.

If personal data is lost, accessed or disclosed without authority:

• for employee data we process for an employer, we will notify that employer without undue delay (and, where reasonably practicable, within 48 hours of becoming aware of it) and give it the information it needs to meet its own duties;
• for data we control, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a breach, as section 43 of the Act requires, and tell affected people when there is a real risk of harm to them.

We only use essential cookies: a session cookie that keeps you signed in, and short-lived cookies used while you complete sign-in and two-factor authentication. Without them you cannot sign in, so they are not optional. We use no advertising cookies and no third-party analytics cookies.

Your browser's local storage remembers display preferences, such as light or dark mode and how lists are shown. These stay on your device.

If you pay by card, Stripe's checkout page may set its own cookies, for example to prevent fraud; see Stripe's privacy policy.

HRHubis a business service and is not meant for children. We do not knowingly collect personal data from children for our own purposes. If an employer records data about an employee or family member under 18, the employer is responsible for meeting the Act's requirements for children's data, including any parent or guardian consent.

We may update this policy when our service or the law changes. We will change the "Last updated" date above and, for significant changes, notify customers by email or in the app before the change takes effect.

For questions about this policy or to exercise your rights, contact us:

If you are not satisfied with how we handle your personal data, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke). We would appreciate the chance to resolve your concern first.