Privacy Policy
Your privacy matters to us. Learn how we collect, use, and protect your personal information in compliance with the Kenya Data Protection Act, 2019.
Introduction
Kenya Data Protection Act, 2019 Compliant
Achievo Limited ("we", "our", "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use our services, or interact with us.
We are registered as a data controller under the Kenya Data Protection Act, 2019 (KDPA) and are committed to complying with all applicable data protection laws and regulations.
Information We Collect
We collect several types of information to provide and improve our services to you:
Personal Information You Provide
- Name, email address, phone number, and physical address
- Job title, company name, and industry sector
- Resume or CV when applying for employment
- Payment and billing information
- Communications and correspondence with us
Information Collected Automatically
- IP address, browser type, and operating system
- Pages visited, time spent, and navigation patterns
- Device information and screen resolution
- Referring website and exit pages
Information from Third Parties
- Publicly available information from social media platforms
- Information from our business partners and clients
- Credit reference agencies for credit checks
How We Use Your Information
We use your personal information for the following legitimate business purposes:
Service Delivery
- To provide, maintain, and improve our services
- To process payroll, HR services, and security solutions
- To manage client accounts and service delivery
Communication
- To respond to inquiries and provide customer support
- To send service updates, newsletters, and marketing communications
- To notify you about changes to our services
Legal Compliance
- To comply with legal obligations under Kenyan law
- To prevent fraud and ensure security
- To enforce our terms of service and other agreements
Legal Basis for Processing
Under the Kenya Data Protection Act, 2019, we process your personal data on the following legal bases:
Consent
- You have given clear consent for us to process your personal data for specific purposes.
Contract
- The processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
Legal Obligation
- The processing is necessary for us to comply with a legal obligation under Kenyan law.
Legitimate Interests
- The processing is necessary for our legitimate interests or those of a third party, provided your fundamental rights are not overridden.
Information Sharing & Disclosure
We may share your personal information with the following parties:
Service Providers
- Third-party vendors, consultants, and other service providers who perform services on our behalf, such as payment processors, IT service providers, and legal advisors.
Business Partners
- With your consent, we may share information with our business partners for marketing and promotional purposes.
Legal Requirements
- When required by law, regulation, legal process, or government request, or to protect the rights, property, or safety of Achievo Limited, our users, or others.
Corporate Transactions
- In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of the transaction.
Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:
Technical Measures
- Encryption of data in transit and at rest
- Secure data centers with access controls
- Regular security assessments and penetration testing
- Multi-factor authentication for system access
Organizational Measures
- Data protection policies and procedures
- Employee training on data protection
- Access controls based on need-to-know principle
- Incident response and breach notification procedures
Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting requirements.
Our retention periods are determined based on the following criteria:
Retention Criteria
- The amount, nature, and sensitivity of the personal data
- The potential risk of harm from unauthorized use or disclosure
- The purposes for which we process your personal data
- Legal, regulatory, and contractual obligations
Your Rights Under KDPA 2019
Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:
Right to Access
- You have the right to request access to the personal data we hold about you.
Right to Rectification
- You have the right to request correction of inaccurate or incomplete personal data.
Right to Erasure
- You have the right to request deletion of your personal data, subject to legal obligations.
Right to Restriction
- You have the right to request restriction of processing in certain circumstances.
Right to Object
- You have the right to object to processing based on legitimate interests or direct marketing.
Right to Data Portability
- You have the right to request transfer of your data to another service provider.
Right to Withdraw Consent
- You have the right to withdraw your consent at any time where processing is based on consent.
International Data Transfers
We may transfer your personal data to countries outside Kenya. When we do, we ensure appropriate safeguards are in place to protect your data, including:
Data Transfer Safeguards
- Standard contractual clauses approved by the Office of the Data Protection Commissioner (ODPC)
- Processing only in countries with adequate levels of data protection
- Ensuring compliance with KDPA requirements for international data transfers
Children's Privacy
Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected personal information from a child, please contact us immediately.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website with a new effective date.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:
Phone
+254 705 982 897Address
Bellways Business Park No.18, Syokimau, Kenya
Data Protection Officer
The Data Protection Officer is responsible for overseeing this Privacy Policy and ensuring compliance with the Kenya Data Protection Act, 2019.