Privacy Policy

Effective date: to be set at publication

This policy explains how ACCUREX collects, uses and protects personal data on this website. It is grounded in the Kenyan Data Protection Act, 2019 and the regulations and guidance issued by the Office of the Data Protection Commissioner (ODPC).

Who we are

ACCUREX Leadership and Management Consultants Ltd ("ACCUREX", "we", "us", "our") is a human-capital consultancy registered in Kenya. Our registered address is Citadel Building, 5th Floor, Muthithi Road, Westlands, Nairobi, Kenya.

We are registered with the Office of the Data Protection Commissioner of Kenya as a Data Controller in respect of information collected through this website and our commercial relationships, and as a Data Processor in respect of personal data we process on behalf of our clients during engagements such as HR Outsourcing, Payroll Outsourcing, Employer of Record, Casual Management, HR Audit and other advisory services. Our ODPC registration details are available on request.

Where we act as a Data Processor, the client we work for is the Data Controller. Our handling of that data is governed by the data-processing agreement with that client and the client's own employee privacy notice. This website privacy policy does not replace that client-specific notice. If you are an employee of one of our clients and want to know how your personal data is processed in connection with our services to your employer, please contact your employer first.

What this policy covers

This policy covers the personal data we collect, use and disclose when you visit accurex.co.ke or any ACCUREX-operated subdomain, submit a contact form, request a proposal, request an HR audit, book a consultation or make any other written enquiry on the site, subscribe to our newsletter or any content download, apply for a role listed on the site or submit a CV for consideration, or correspond with us by email, telephone or through third-party messaging channels used in business communications.

It does not cover the MylesPort International website (mylesport.co.ke), which operates its own privacy notice for international recruitment, processing we carry out as a Data Processor for our clients, which is governed by the processing agreement with that client, or third-party websites that we link to.

The personal data we collect

Information you give us

• Contact and proposal requests: name, job title, organisation, email, telephone, country and the enquiry or brief you share with us.
• Newsletter sign-up: name, email and your stated interests.
• CV submissions and recruitment applications: name, contact details, employment history, qualifications, references, nationality where relevant to the role, and any other information you include in your CV.
• Correspondence: the content of emails, call notes and any attachments you send us.
• Event or training registrations: name, employer, role, dietary and accessibility requirements where relevant.

Information collected automatically

When you visit the site we may collect, through cookies and server logs, your IP address, approximate location (country or city derived from IP), device and browser type, operating system, the pages you visit, the time you arrive and leave, the pages you come from and go to, and interaction data such as clicks, scrolling and form field completion up to the point of submission. The specific tools in use are set out in the Cookies and analytics section below.

Sensitive personal data

We do not routinely request sensitive personal data (racial or ethnic origin, religion, health, sexual orientation, trade-union membership, political opinion, biometric or genetic data) through the website. If a CV you submit for a role contains sensitive personal data, we hold it only to the extent necessary for the role you are applying for, and in line with the Employment Act, 2007 s.5 (non-discrimination).

The lawful bases we rely on

Under section 30 of the Data Protection Act, 2019 we process your personal data on one of the following bases, depending on the context.

• Your consent, where you have asked us to contact you, subscribe to a newsletter or share a CV.
• Performance of a contract, where processing is necessary to enter into or perform a contract with you or your organisation (for example, acting on a brief, delivering a service or invoicing).
• Compliance with a legal obligation, where we must process data to comply with a Kenyan statute (for example, tax law, employment law for ACCUREX staff or National Employment Authority obligations for recruitment).
• Legitimate interests pursued by ACCUREX, where processing is necessary for our legitimate business interests (for example, administering the website, responding to enquiries or preventing fraud) and your interests, rights and freedoms do not override those interests.
• Protection of vital interests, in exceptional cases where processing is necessary to protect the life or health of an individual.

Where processing is based on your consent, you may withdraw it at any time by contacting the Data Protection Officer. Withdrawal does not affect the lawfulness of processing before withdrawal.

How we use personal data

We use personal data to respond to enquiries, proposals, briefs and consultation requests, provide the services we have been engaged for and administer our contracts, match CVs and candidate information to roles we have been briefed to fill, issue invoices and keep accounting records and comply with tax and other statutory obligations, send transactional communications such as meeting confirmations and service updates, send marketing or newsletter communications you have consented to receive, improve the website by analysing which pages and services are of most interest, prevent and investigate fraud, misuse and security incidents, and comply with regulatory requirements, including requests from the ODPC and other authorities acting under law.

When we share personal data

We may share your personal data with companies in the ACCUREX group that help us deliver the service you have asked about, including MylesPort International for international recruitment, strictly for the purpose of your enquiry. We may share it with clients of ACCUREX where you have asked us to put you forward for a role or placement they are hiring for, with your consent. We may share it with service providers acting on our behalf, such as our payroll and HRIS platform (PiPO HRIS), our email provider, our cloud hosting provider and professional advisers in legal, accounting and audit roles. Each is bound by confidentiality and data-processing terms. We may share it with government bodies and regulators where required by Kenyan law or by a lawful request, including the Kenya Revenue Authority, the Ministry of Labour, the Office of the Data Protection Commissioner and courts of competent jurisdiction. We may share it with acquirers or successors in the event of a merger, acquisition or re-organisation, under appropriate confidentiality terms.

We do not sell personal data.

International transfers

ACCUREX operates in Kenya and across East Africa, with international clients in the Middle East, Europe and other regions. Personal data you provide may therefore be transferred to, or accessed from, countries outside Kenya. This happens where our international clients and partner platforms are the purpose of the enquiry you have made (for example, an application through MylesPort International for a role abroad), with your consent. It also happens where our service providers have infrastructure or support operations located outside Kenya, such as cloud hosting and email services.

Where personal data is transferred outside Kenya, we rely on one of the mechanisms permitted by Part VI of the Data Protection Act, 2019 and the regulations issued under it, including, as applicable, your consent, the necessity of the transfer for the performance of a contract, or appropriate safeguards such as contractual commitments mirroring Kenyan data-protection standards.

How long we keep personal data

We keep personal data only for as long as necessary for the purpose it was collected, and to meet legal, accounting and reporting obligations under Kenyan law. Our indicative retention periods are as follows.

• Contact-form and enquiry data: 24 months from the last substantive interaction.
• Newsletter and marketing data: for as long as you remain subscribed, plus a short archive period for suppression lists.
• CV and candidate data (unsuccessful): 24 months from the date of the application, unless you ask us to delete it earlier or extend it.
• CV and candidate data (placed): for the duration of the placement plus six years, consistent with the Employment Act's record-keeping period.
• Invoicing and accounting records: seven years, consistent with the Tax Procedures Act and the Companies Act.
• Website logs and cookie data: 12 months, in line with normal web-analytics retention.

After these periods, data is securely deleted or anonymised.

Your rights under the Data Protection Act, 2019

As a data subject, you have the following rights under the Act.

• Right to be informed of the use to which your personal data is to be put.
• Right of access to your personal data in our custody.
• Right to object to the processing of all or part of your personal data.
• Right to correction of false or misleading data.
• Right to deletion of false or misleading data about you.

In addition, where processing is based on your consent, you may withdraw that consent at any time, and you have the right to be told how any automated decisions about you are made and to request a human review, where applicable.

To exercise any of these rights, contact our Data Protection Officer using the details below. We will respond within the time limits set by the Act and the ODPC's guidance in force at the time.

Cookies and analytics

The site uses several categories of cookies. Strictly necessary cookies make the site function, including session and security cookies, and these cannot be disabled. Preference cookies remember your display and language preferences. Analytics cookies help us understand site traffic in aggregate. Marketing cookies may be used for retargeting and campaign measurement, where you consent. The full list of cookies in use is published on our cookie-settings page.

A cookie banner lets you accept or decline non-essential cookies on your first visit; you can change your preference at any time via the "Cookie settings" link in the footer. Browser controls allow you to delete cookies at any time; some site features may not work if essential cookies are blocked.

Children's data

The site is not directed to children under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact our Data Protection Officer and we will delete the data.

Security

We maintain organisational, physical and technical measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration or destruction. Measures include role-based access controls, encryption of data in transit, confidentiality agreements with staff and contractors, secure cloud hosting, and documented incident-response procedures.

No internet transmission or storage system is wholly secure. If you believe your account or personal data has been compromised, contact our Data Protection Officer immediately.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will notify the ODPC within 72 hours of becoming aware of the breach, and notify affected individuals where required by the Act.

Changes to this policy

We review this policy from time to time and will post any changes on this page. The effective date at the top of the policy will reflect the date of the latest version. Material changes will be flagged by a notice on the site or by email where you have given us one.

Contact us

Complaints

If you believe we have not handled your personal data in line with the Data Protection Act, 2019, please contact our Data Protection Officer first so we can try to resolve the matter.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

• Website: https://www.odpc.go.ke
• Email: info@odpc.go.ke
• Postal: Office of the Data Protection Commissioner, Britam Tower, 10th Floor, Upper Hill, Nairobi, Kenya