Legal
Data Processing Agreement
This agreement governs how AndikishaHR processes personal data on behalf of organisations using our platform, in compliance with the Kenya Data Protection Act 2019.
Last updated: October 2026
1. Definitions
"Controller" means the organisation (employer) that determines the purposes and means of processing employee personal data. "Processor" means AndikishaHR Limited, which processes personal data on behalf of the Controller. "Data Subject" means any identified or identifiable natural person whose personal data is processed — primarily employees of the Controller.
2. Subject matter and duration
AndikishaHR processes personal data on behalf of the Controller for the purpose of providing payroll, HR, and compliance services as described in the service agreement. Processing continues for the duration of the service agreement and ceases upon termination, subject to statutory retention requirements.
3. Nature and purpose of processing
Processing activities include: calculating statutory deductions (PAYE, NSSF, SHIF, Housing Levy), generating payslips, generating statutory return files for the Controller to file, maintaining employment records, and providing HR management tools. All processing is performed exclusively to deliver the contracted service.
4. Type of personal data processed
We process the following categories of data: employee names, national ID numbers, KRA PIN numbers, NSSF numbers, SHIF numbers, bank account details for salary disbursement, salary and compensation information, employment terms, leave records, and attendance data.
5. Processor obligations
AndikishaHR shall: process personal data only on documented instructions from the Controller; ensure that persons authorised to process personal data have committed to confidentiality; implement appropriate technical and organisational security measures; engage only the sub-processors listed in section 8, and give notice before adding or replacing one; assist the Controller in meeting data subject rights requests.
6. Controller obligations
The Controller shall: ensure it has a lawful basis for processing employee personal data; provide accurate and complete data to AndikishaHR; notify AndikishaHR of any corrections required; handle data subject requests from employees and direct technical requests to AndikishaHR as appropriate.
7. Security measures
AndikishaHR maintains: TLS encryption in transit; passwords stored only as salted hashes; encryption of stored integration credentials; every record tied to one Controller, with each request limited to the signed-in user's organisation; role-based access controls; logging of key changes with the acting user; and a 72-hour breach notification to Controllers.
8. Sub-processors
AndikishaHR uses the following sub-processors: Contabo GmbH (server hosting, European Union) and Resend (email delivery for system notifications). By entering this agreement the Controller authorises these sub-processors. The Controller will be notified of any addition or replacement with at least 30 days' notice.
9. Data subject rights
When AndikishaHR receives a request directly from a data subject (employee), it will promptly notify the Controller. The Controller remains responsible for responding to data subject rights requests. Erasure requests are subject to statutory retention requirements — KRA requires payroll records for 7 years.
10. Data transfers
Customer data is stored and processed on servers in the European Union. Personal data is therefore transferred outside Kenya. By entering this agreement the Controller instructs AndikishaHR to carry out this transfer for the purpose of providing the service. Data is encrypted in transit, and sub-processors process it only to provide hosting and email delivery. AndikishaHR will not move customer data to another region without giving the Controller at least 30 days' notice.
11. Termination
On termination of the service agreement, AndikishaHR will export all Controller data in a machine-readable format within 30 days and then securely delete all copies unless statutory retention obligations require otherwise. Deletion certificates are available on request.
12. Governing law
This Data Processing Agreement is governed by the laws of Kenya. Any disputes arising under this agreement shall be subject to the exclusive jurisdiction of the courts of Kenya.
Questions about this document? Contact us