Privacy Policy
Piposoft · Last updated: 12 October 2026
1. Who we are and what this policy covers
Piposoft (“Piposoft”, “we”, “us”) is a recruitment, training and background verification business based in Nairobi, Kenya. This policy explains how we collect, use, share, store and protect personal data when you visit piposoft.co.ke, apply for a job, hire us, attend a training session, or are contacted by us. We handle personal data in line with the Data Protection Act, 2019 of Kenya (the “Act”) and the regulations made under it.
For most of the data described below, Piposoft is the data controller, meaning we decide why and how it is used. When we run a background check or recruitment process on behalf of a client, we may act as that client’s data processor for part of the work. In that case we follow the client’s documented instructions, and the client’s own privacy notice also applies.
Contact for anything in this policy: connect@piposoft.co.ke
2. The personal data we collect
We collect only what we need for the purpose in question.
Candidates and job applicants
- Identity and contact details: name, email, phone number, location, and national ID or passport number where needed for a background check
- CV and career information: work history, education, skills, referees, salary expectations, notice period
- Interview notes, assessment results and our screening notes
- Your photograph if you include it in your CV
Background check subjects (only with your consent)
- Employment and education verification records
- Reference responses from your named referees
- Criminal record and compliance checks, and credit or financial references where the role requires them
Some of this may be sensitive personal data under the Act. We process it only with your explicit consent or where the law allows, and only for the check you have agreed to.
Client contacts and prospects
- Name, job title, company, work email, phone number, and records of our communication with you
- For prospects, business contact details from public sources and professional databases, used to contact you about our services
Website visitors
- Technical data such as IP address, browser type, device, pages visited and time spent, collected through cookies and analytics tools
- Anything you type into our contact forms
Training participants
- Name, contact details, employer, and attendance or feedback records
3. How we use your data, and our lawful basis
The Act requires us to have a lawful basis for every use of personal data. This table sets out ours.
| Purpose | Lawful basis |
|---|---|
| Matching candidates to roles, screening and sharing profiles with clients | Your consent, and steps taken at your request before entering a contract |
| Background checks and reference checks | Your explicit consent |
| Keeping your CV for future roles | Your consent |
| Responding to enquiries and delivering services to clients | Performance of a contract, or steps before a contract |
| Running training workshops | Performance of a contract |
| Sending newsletters, job alerts and marketing emails | Your consent, which you can withdraw at any time |
| Contacting business prospects about our services | Our legitimate interests, with a clear way to opt out |
| Website security, analytics and improvement | Our legitimate interests, and your consent for non-essential cookies |
| Meeting legal, tax and regulatory duties | Legal obligation |
We do not make hiring decisions about you using only automated processing. A person reviews every shortlist.
4. Where we get your data
Most data comes directly from you. We also receive it from referees you name, from past employers and institutions as part of checks you authorise, from professional networks and public profiles you have made visible, and from clients who refer candidates to us. When we collect your data from a source other than you, we tell you who we are and why we hold it, at the latest in our first contact with you.
5. Who we share your data with
We do not sell personal data.
We share it only as needed:
- Clients: with your consent, we share your profile and screening notes with the specific client for the specific role you applied for or agreed to be considered for. We do not send your CV to clients for roles you have not agreed to.
- Service providers (data processors): companies that help us run the business under written terms that require them to protect your data and use it only on our instructions. These include our recruitment and email platforms (Zoho Recruit, Zoho Mail, Zoho Campaigns), prospecting tools (Apollo), Google Workspace and Google forms or scripts used for reference surveys, our website host, and [REPLACE: any others, such as payment or scheduling tools].
- Verification partners: institutions, employers and agencies that confirm your records, but only for checks you have authorised.
- Our team: staff and contractors, including our part-time recruiter, who have access only to the data they need and are bound by confidentiality.
- Authorities: where required by law, court order or a lawful request from a regulator or law enforcement.
6. Transfers outside Kenya
Some of our service providers store or process data on servers outside Kenya. Where this happens, we transfer personal data only where the Act allows it: to a country or provider with adequate data protection safeguards, under a contract or binding terms that protect your data to the standard the Act requires, or with your consent. If you want details of the safeguards for a particular transfer, contact us.
7. How long we keep your data
We keep personal data only as long as we need it for the purpose it was collected, and then delete or anonymise it.
- Candidate profiles and CVs: up to 48 months after our last contact with you, unless you ask us to delete sooner or renew your consent for longer
- Background check records: only for as long as needed to complete the check and meet the client’s and our legal record-keeping needs
- Client and contract records: for the period required by tax and company law
- Marketing contacts: until you unsubscribe or ask us to stop
- Website analytics data: in line with the retention settings of the analytics tool
8. Your rights under the Data Protection Act
You have the right to:
- be informed how your personal data is used
- access the personal data we hold about you, and get a copy
- object to processing of your personal data, including for direct marketing
- ask us to correct data that is inaccurate or out of date
- ask us to delete data that is no longer needed, was collected unlawfully, or that you withdraw consent for
- receive your data in a structured, commonly used format and have it moved to another provider, where applicable
- withdraw your consent at any time, without affecting processing already done on the basis of that consent
- not be subject to a decision based solely on automated processing that significantly affects you
To use any of these rights, email connect@piposoft.co.ke with the subject line “Data request”. We may ask you to confirm your identity first. We respond within the time limits set by the Act and its regulations, and we do not charge a fee unless a request is manifestly unfounded or excessive, in which case we will explain.
If you are unhappy with our response, you have the right to complain to the Office of the Data Protection Commissioner at www.odpc.go.ke. We would appreciate the chance to put things right first.
9. Cookies and analytics
Our website uses cookies. Essential cookies keep the site working and secure. Analytics and similar cookies help us understand how visitors use the site, and we use them only with your consent where the law requires it. You can accept or decline non-essential cookies through our cookie banner [REPLACE: confirm your cookie consent tool is installed], and you can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site working.
10. Email marketing and outreach
We send newsletters and job alerts only to people who have asked for them. Every marketing email includes an unsubscribe link, and you can also write to us to opt out. If we contact you as a business prospect, we tell you who we are, where we found your details, and how to opt out, and we stop as soon as you ask. We will still send essential service messages, such as updates about an application or a contract.
11. Keeping your data secure
We use organisational and technical measures suited to the sensitivity of the data. These include access limited to people who need it, strong passwords and two-step verification on our core systems, encrypted connections on our website, confidentiality terms with staff and contractors, and written agreements with our service providers. No system is completely secure, so please also protect your own accounts and devices.
12. If something goes wrong
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, and tell the affected individuals as soon as reasonably practicable, with what happened, the likely effect on you, and the steps we are taking and you can take.
13. Children
Our services are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
14. Links to other sites
Our website links to other sites, such as LinkedIn and Facebook, and to job or booking tools. We do not control them and are not responsible for their privacy practices. Please read their policies.
15. Changes to this policy
We may update this policy when our services or the law change. We will post the new version on this page with a new “last updated” date, and where a change affects how we use your data in a significant way, we will tell you directly and ask for fresh consent where the law requires it.
16. Contact us
Piposoft, Nairobi, Kenya Email: connect@piposoft.co.ke Subject line for data requests: “Data request”