Privacy and data protection

1. Scope of this policy

This policy covers data processed through our marketing website (christech.co.ke and related domains), the Chris Tech HRMS web application and mobile apps, and any support channels we operate (email, WhatsApp, phone). It applies whether you are a visitor browsing our website, a prospective customer requesting a demo, an administrator setting up a company account, or an employee whose data is entered into the platform by their employer.

Where a customer organization (“Customer”) uses Chris Tech HRMS to manage its own employees, that Customer is typically the data controller for its employees' records, and Chris Tech acts as a data processor on the Customer's behalf. Section 14 below explains this relationship in more detail.

2. Who we are

Chris Tech HRMS is operated by Chris Tech / Zetu Business Solutions, based in Nairobi, Kenya. For the purposes of applicable data protection law, including Kenya's Data Protection Act, 2019, we act as the data controller for account and billing information relating to our direct customers, and as a data processor for employee data that our customers enter into the platform.

3. Information we collect

We collect the following categories of information:

• Account and contact information: name, work email, phone number, job title, and company name when you register, request a demo, or contact support.
• Company and workforce data: information entered by Customers into the platform, including employee names, contact details, national ID or KRA PIN where required for payroll, job titles, department, compensation, attendance records, leave balances, performance reviews, and recruitment pipeline data.
• Payment information: billing details and transaction references from M-Pesa, Paystack, or other supported payment methods. We do not store full M-Pesa PINs or card numbers; these are handled directly by our payment processors.
• Usage and device data: log data such as IP address, browser type, device identifiers, pages visited, and timestamps, collected automatically when you use our website or platform.
• Support and communications data: the content of messages you send us via email, WhatsApp, contact forms, or in-app support, and records of how we responded.
• Cookies and similar technologies: as described in Section 9.

4. How we collect information

We collect information directly from you when you fill in a form, create an account, or contact us; from your employer or organization administrator when they set up your employee profile within the platform; automatically through your use of our website and application (via cookies, server logs, and analytics); and from third parties such as payment processors, who share confirmation of a completed transaction with us.

5. How we use information

We use the information we collect to:

• Provide, operate, and maintain the Chris Tech HRMS platform, including attendance, leave, payroll, recruitment, and performance features.
• Create and manage accounts, and authenticate users logging into the platform.
• Process payments and manage billing, including invoicing and subscription renewals.
• Respond to support requests, demo requests, and other communications.
• Send service-related notices, such as maintenance windows, security alerts, or changes to these terms.
• Monitor, secure, and improve the reliability and performance of our systems.
• Detect, investigate, and prevent fraud, abuse, or security incidents.
• Comply with legal obligations, such as tax and financial recordkeeping requirements.

We do not use employee data entered by our Customers for advertising, and we do not sell personal data to data brokers or third-party marketers.

6. Legal basis for processing

Where applicable law requires a lawful basis for processing, we rely on one or more of the following: performance of a contract (to provide the Service you have signed up for), legitimate interests (such as securing our systems and improving the Service), compliance with a legal obligation (such as tax recordkeeping), and, where required, your consent (for example, for optional analytics or marketing communications, which you may withdraw at any time).

7. Who we share data with

We do not sell personal data. We share data only in the following circumstances:

• Infrastructure and hosting providers: our application and data are hosted using third-party infrastructure providers (such as cloud hosting, database, and content-delivery services) that process data on our behalf under contractual confidentiality and security obligations.
• Payment processors: transaction data is shared with M-Pesa, Paystack, or other payment providers strictly to process payments.
• Professional advisors: lawyers, accountants, and auditors, where necessary and under confidentiality obligations.
• Legal and regulatory authorities: where required by law, court order, or to protect the rights, property, or safety of Chris Tech, our customers, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protection of your data under this policy or a comparable one.

8. Payments and M-Pesa data

When you pay via M-Pesa, Paystack, or another supported method, the payment provider processes your payment details directly. We receive and store only the information necessary to confirm and reconcile the transaction — such as amount, date, phone number used for the transaction, and a transaction reference — and use it to maintain accurate billing records and provide receipts. We do not have access to, and do not store, your M-Pesa PIN or full financial account credentials.

9. Cookies and similar technologies

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how our website and platform are used. For a full breakdown of cookie categories and how to manage them, see our Terms & Cookie Policy.

10. Data retention

We retain personal data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting requirements, resolve disputes, and enforce our agreements. Company and employee data entered into the platform is generally retained for the duration of the Customer's subscription, plus a limited grace period after termination during which the Customer may export their data. After that period, data is securely deleted or anonymized, except where longer retention is required by law (for example, statutory payroll or tax record requirements).

11. How we protect data

We apply technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit, role-based access controls, per-company data isolation in our multi-tenant database design, restricted administrative access, and ongoing monitoring for suspicious activity. No system is completely immune to risk, and we encourage customers to use strong, unique passwords and to enable any available account security features.

12. International data transfers

Some of our infrastructure and service providers may process or store data outside Kenya. Where this occurs, we take steps to ensure an adequate level of protection is maintained, consistent with the requirements of the Data Protection Act, 2019 and its regulations, including relying on providers with appropriate security and contractual safeguards.

13. Your rights under the Data Protection Act

Subject to applicable law, you have the right to: be informed of how your data is processed; access the personal data we hold about you; request correction of inaccurate or incomplete data; request deletion of your data, subject to our legal and contractual retention obligations; object to or restrict certain processing; request a copy of your data in a portable format; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or another relevant supervisory authority.

To exercise any of these rights, contact us using the details in Section 17. If your employer manages your data within Chris Tech HRMS as your employer's HR system of record, some requests (particularly deletion or correction of employment records) may need to be directed to or approved by your employer, since they control that data as described in Section 14.

14. Employer, HR, and employee data

When an organization (“Customer”) uses Chris Tech HRMS to manage its workforce, the Customer decides what employee data to enter and how it is used within their organization's account — this makes the Customer the data controller for that employee data under most data protection frameworks, including Kenya's. Chris Tech acts as a data processor, handling that data only according to the Customer's instructions and the terms of our agreement with them, and using appropriate security measures, including logical isolation of each Customer's data from other Customers.

If you are an employee whose data is held in Chris Tech HRMS by your employer, and you have questions about how your data is used, your first point of contact should generally be your employer's HR team. We remain available to assist employers with data requests they receive from their employees.

15. Children's privacy

Chris Tech HRMS is a business platform intended for use by employers, HR teams, and their working-age employees. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child's data has been provided to us without appropriate authorization, please contact us so we can investigate and, where appropriate, delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Service itself. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify Customers by email or through the platform. We encourage you to review this page periodically.

17. Contact us

If you have questions, requests, or concerns about this Privacy Policy or how your data is handled, contact us at support@christech.co.ke. We aim to respond to privacy-related inquiries promptly and in good faith.