Data processing agreement
This agreement sets out how we handle the personal data that your agency keeps in SmartRecruit, as section 42 of the Kenya Data Protection Act, 2019 ("the Act") requires between a data controller and a data processor. It applies automatically when you accept the terms of service. If your organisation needs a signed copy, email privacy@smartrecruit.co.ke.
1. Scope and roles
For personal data that you or your staff put into SmartRecruit, or that candidates send through your application form ("your data"), your agency is the data controller and The Leadership Bureau Limited is the data processor. Words such as "personal data", "sensitive personal data", "processing" and "data subject" have the meaning given in the Act.
2. Details of the processing
| Subject matter | Providing SmartRecruit, recruitment management software, to your agency. |
|---|---|
| Duration | While the agreement lasts, plus the export and deletion period in section 10. |
| Nature and purpose | Storing, organising, displaying, generating documents from, sharing at your direction (client portal, email), backing up and deleting your data, so that you can manage recruitment and placement. |
| Data subjects | Candidates and job applicants; their next of kin or references where you record them; contacts at client employers; your own staff who use SmartRecruit. |
| Types of personal data | Identity and contact details; date and place of birth, nationality and sex; passport and ID numbers and copies; photographs; education, skills, languages and work history; job preferences, salary and placement details; interview notes, offers and stage history; medical fitness results, good conduct certificates and visa documents; invoices and payments. |
| Sensitive personal data | Depending on what you choose to record: health status (medical results), marital status and family details, religion or belief, and information in police clearance certificates. You decide whether to collect these and must have a lawful basis under the Act to do so. |
3. Processing only on your instructions
We process your data only to provide SmartRecruit and only on your documented instructions. The terms of service, this agreement and the way you and your staff use the app are your instructions. We will not process your data for our own purposes, sell it, or use it to train AI models. If the law requires us to process your data in another way, we will tell you first unless the law forbids it. If we think an instruction breaks the Act, we will tell you.
4. Confidentiality of our people
Only staff and contractors who need it to run or support SmartRecruit can access your data, and each of them is bound by a duty of confidentiality. Access is kept to the minimum needed, for example to fix a fault or to help when you ask.
5. Security
We keep appropriate technical and organisational measures in place to protect your data, as section 41 of the Act requires. They are described in Annex 1. We may improve these measures over time, but will not reduce the overall level of protection.
6. Sub-processors
You authorise us to use the sub-processors listed in Annex 2. We will tell agency owners by email at least 30 days before adding or replacing a sub-processor that handles your data. If you object on reasonable data protection grounds and we cannot resolve it, you may end the agreement and receive a refund of any prepaid fees for the unused period. Each sub-processor is bound by a written contract with data protection obligations at least as protective as this agreement, and we remain responsible to you for their work.
7. Transfers outside Kenya
Your data is stored in the European Union (Frankfurt, Germany). Some sub-processors may handle limited data in other countries to deliver the service, as shown in Annex 2. We transfer personal data outside Kenya only in line with Part VI of the Act and the Data Protection (General) Regulations, 2021, on the basis of appropriate safeguards, including contracts that require protection equal to the Act. On request we will give you the information you need to show the Data Protection Commissioner that these safeguards are in place.
8. Helping you meet your duties
- Requests from data subjects. SmartRecruit lets you find, correct, export and delete a person's records yourself. If a candidate contacts us directly, we will pass the request to you without delay and will not answer it ourselves unless you ask us to.
- Impact assessments and the Commissioner. We will give reasonable help with data protection impact assessments and with any enquiry from the Office of the Data Protection Commissioner about SmartRecruit.
9. Personal data breaches
If we become aware of a breach affecting your data, we will tell your agency owner without delay, and in any case within 48 hours, so that you can meet your own duty to notify the Data Protection Commissioner within 72 hours. We will tell you what happened, what data and people are likely to be affected, what we have done to contain it and who you can contact, and we will keep you updated as we learn more.
10. Return and deletion
You can export your data at any time. When the agreement ends you have 30 days to export it. We then delete your data, including from backups, within 90 days, unless Kenyan law requires us to keep some of it, in which case we keep only that part, protect it and use it for nothing else.
11. Information and audits
On request, we will give you the information reasonably needed to show that we meet this agreement, such as a description of our security measures and our current sub-processors. If that is not enough, or the Data Protection Commissioner requires it, you may carry out an audit, at your cost, once a year, with 30 days' notice, during working hours and under a confidentiality agreement, in a way that does not expose other agencies' data.
12. Your responsibilities
You are responsible for having a lawful basis for the data you collect, for giving candidates the information the Act requires (including that their details may be shared with employers abroad), for any registration your business needs with the Office of the Data Protection Commissioner, for managing who in your team can access what, and for what you choose to share through CVs, emails and the client portal.
13. General
This agreement lasts as long as we process your data. The limits on liability in the terms of service apply to it. If it conflicts with the terms of service on how personal data is handled, this agreement wins. It is governed by the laws of Kenya.
Annex 1: Security measures
- Encryption. All connections use HTTPS (TLS). The database and stored files are encrypted at rest by our hosting provider.
- Separation between agencies. Every record belongs to one agency, and row-level security rules inside the database check membership on every request, so an agency can only ever read or change its own records.
- Access within your agency. Owner, admin, recruiter and viewer roles control who can change data; owners and admins can hide pages from individual staff.
- Documents. Passports, photos, CVs and other files are kept in private storage. They are shown only through signed links that expire within minutes.
- Sign-in. Passwords are stored only as salted hashes by our authentication provider. Sessions expire and can be ended by signing out.
- Client portal. Each employer gets a separate access code that the agency can change or switch off at any time. The portal shows only the candidates the agency sent to that employer. Candidates' contact details are never shown, and passport numbers only if the agency switches them on.
- Payments. Card and M-Pesa details are handled by Paystack and never reach our systems. Payment notifications are checked with a cryptographic signature.
- Secrets. Service keys and email passwords are kept in server-side secret storage and are never sent to browsers.
- Records of activity. Changes to candidates and their stages are logged with who made them and when.
- Backups and resilience. The database is backed up regularly by our hosting provider in the European Union.
- Our staff. Production access is limited to the few people who need it, protected by strong passwords and two-step sign-in where the provider supports it.
- Testing. Changes to the database rules are tested before release, including checks that one agency cannot reach another's data.
Annex 2: Sub-processors
Last updated 15 October 2026.
| Provider | What it does | Data it handles | Location |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage and server functions | All of your data | European Union (Frankfurt, Germany) |
| Netlify, Inc. | Delivers the website and app pages | IP addresses and technical request data; no candidate records are stored | Global network; company in the United States |
| Paystack | Payments for SmartRecruit plans | Billing contact email, amounts and payment details; never candidate data | Kenya and Nigeria |
| Resend, Inc. | Delivers emails you send from SmartRecruit when you have not connected your own mailbox | Email addresses, message content and attachments you choose to send | United States |
If you connect your own mailbox (for example Zoho or Google), emails go through that provider under your own agreement with it.