Privacy policy
This policy explains how SmartRecruit handles personal data, in line with the Kenya Data Protection Act, 2019 and its regulations. We have kept it in plain language. If anything is unclear, write to privacy@smartrecruit.co.ke.
1. Who we are
SmartRecruit is provided by The Leadership Bureau Limited, registered in Kenya under number PVT-BEUXPKPX, with its registered office at Ndemi Gardens Apartment, 6th Floor, Off Ngong Road, Nairobi West, Nairobi County, P.O. Box 100-00100 G.P.O. Nairobi, Kenya. Postal address: Avenue House Plaza, Kenyatta Avenue, Mezzanine Floor, Office 10, Nairobi, Kenya. For anything about personal data, contact privacy@smartrecruit.co.ke.
2. Two kinds of data
- Data about our customers: the agencies that use SmartRecruit and the people who sign in for them. For this data we are the data controller, and this policy applies in full.
- Data that agencies keep in SmartRecruit: their candidates, applicants, client contacts and so on. For this data the agency is the data controller and we are its data processor. We only handle it on the agency's instructions, under our data processing agreement. Section 5 explains what this means for candidates.
3. What we collect about our customers
| What | Examples | Where it comes from |
|---|---|---|
| Sign-in details | Name, email address, password (stored only in scrambled, hashed form), role in the agency | You, or the colleague who invited you |
| Agency details | Agency name, country, logo, address, licence number, bank details shown on invoices | The agency's owner or admins |
| Billing | Plan, amounts, dates, payment reference, Paystack customer and subscription codes | You and Paystack. We never receive full card numbers or M-Pesa PINs. |
| Usage and security records | When you signed in, what was changed and by whom, IP address and browser in server logs | Our systems, automatically |
| Messages | Emails to support, billing or sales | You |
4. Why we use it
| Purpose | Lawful basis under the Act |
|---|---|
| Running your account, signing you in, providing the features and support | Performing our contract with your agency |
| Taking payments, sending receipts and reminders, keeping accounting records | Contract, and legal obligation (tax and accounting law) |
| Keeping the service secure, preventing fraud and misuse, fixing faults | Our legitimate interest in a safe, working service |
| Telling you about important changes to the service or these terms | Contract and legitimate interest |
| Occasional product news | Your consent, which you can withdraw at any time with the link in each email |
We do not sell personal data and we do not use it for advertising.
5. Candidates and applicants
If you applied for a job through an agency's SmartRecruit form, or an agency keeps your details in SmartRecruit, that agency decides what is collected and how it is used. It is responsible for telling you about this and for answering your requests. Please contact the agency first.
If you cannot reach the agency, write to privacy@smartrecruit.co.ke and we will pass your request on and help the agency respond. We do not look at, use or share candidate data for our own purposes. Our staff only access it when the agency asks for help, when it is needed to fix a fault, or when the law requires it.
6. Who we share it with
We use a small number of trusted service providers ("sub-processors") to run SmartRecruit. Each one only gets the data it needs to do its job, under a written contract that requires it to protect the data.
- Supabase: database, sign-in, file storage and server functions, hosted in the European Union (Frankfurt, Germany).
- Netlify: delivers the website and app pages to your browser.
- Paystack: takes payments. It receives billing details only, never candidate data.
- Resend: delivers emails that an agency chooses to send from SmartRecruit, when the agency has not connected its own mailbox.
The full list, with what each provider does and where, is on our sub-processors list. We may also disclose data when the law requires it, for example under a court order, and to a buyer if SmartRecruit is ever sold, who must then keep to this policy.
7. Data stored outside Kenya
SmartRecruit's database and files are hosted in the European Union, which has data protection laws at least as strong as Kenya's. Some providers listed above may also handle limited data in other countries, such as the United States, to deliver web pages and emails. We only transfer personal data abroad as the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 allow, with appropriate safeguards in place, including written contracts that require the same level of protection. Ask us at privacy@smartrecruit.co.ke if you would like details of these safeguards.
8. How long we keep it
- Account and agency data: while the agency uses SmartRecruit. After an agency closes, it has 30 days to export its data, and we then delete it within 90 days, including from backups.
- Billing records: 7 years, because tax law requires it.
- Server and security logs: usually no more than 90 days.
- Support emails: up to 2 years after the conversation ends.
9. Security
Data is encrypted while it travels over the internet and while it is stored. Each agency's records are kept apart by rules inside the database itself, so one agency can never see another's. Documents such as passports are stored privately and are only shown through links that expire after a few minutes. Passwords are stored only in hashed form. Only a small number of our staff can reach production systems, and only when they need to. No system is perfectly secure; if a breach puts your data at risk, we will tell the affected agencies without delay and notify the Data Protection Commissioner as the law requires.
10. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your personal data is used;
- see the personal data we hold about you;
- object to some or all of its use;
- have false or misleading data corrected;
- have data deleted when we no longer have a lawful reason to keep it;
- receive your data in a common, machine-readable format, or have it moved to another provider.
To use these rights, email privacy@smartrecruit.co.ke. We may ask you to confirm who you are, and we will reply within the time the law allows. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
11. Cookies and tracking
This website does not use advertising or analytics cookies. The SmartRecruit app stores a sign-in token and a few display preferences in your browser so that you stay signed in. These are needed for the app to work and are not used to track you.
12. Changes and contact
If we change this policy in a way that matters, we will tell agency owners by email before it applies. The date at the top always shows the current version. Questions: privacy@smartrecruit.co.ke, or write to The Leadership Bureau Limited, Avenue House Plaza, Kenyatta Avenue, Mezzanine Floor, Office 10, Nairobi, Kenya.