Legal

Privacy Policy

AndikishaHR Limited is committed to protecting the personal data of our customers, their employees, and anyone who interacts with our platform.

Last updated: October 2026

1. Data we collect

We collect information you provide directly: company details, employee names, national ID numbers, KRA PIN numbers, salary information, and contact details. We also collect usage data to improve the platform — page views, feature interactions, and error logs. We do not sell any of this data to third parties.

2. How we use your data

Employee data is used exclusively to calculate payroll, statutory deductions, and generate reports for your organisation. We do not use payroll or HR data for advertising, profiling, or any purpose beyond delivering the AndikishaHR service to your organisation.

3. Data storage and residency

Customer data is stored and processed on servers in the European Union, operated by our hosting provider, Contabo. This means personal data leaves Kenya. Connections to the platform are encrypted with TLS, passwords are stored only as salted hashes, and saved integration credentials are encrypted. Every record belongs to one customer, and no customer can access another customer's data.

4. Third-party services

AndikishaHR generates statutory returns (PAYE/P10A, NSSF, SHIF, Housing Levy) in the formats required by the relevant authorities. You file them — we do not transmit data to KRA, NSSF, or SHIF on your behalf, and we do not collect or store your credentials for those portals. We use two infrastructure providers to run the service: Contabo (server hosting, European Union) and Resend (email delivery). Both process data only to provide those services to us.

5. Employee data rights

Employees of organisations using AndikishaHR can request access to their personal data, request corrections, and request deletion (subject to statutory retention requirements — KRA requires payroll records to be retained for 7 years). Requests should be directed to your employer's HR team, who manage data access through the platform.

6. Data retention

Active account data is retained for the duration of your subscription. On account closure, we retain statutory payroll records for 7 years as required by Kenyan law. Non-statutory data is deleted within 90 days of account closure. You can request a full export of your data at any time by contacting us.

7. Security incidents

In the event of a data breach that affects your organisation, we will notify you within 72 hours of discovery, as the Kenya Data Protection Act 2019 requires.

8. Contact

For privacy-related questions, contact us at privacy@andikishahr.com.

Questions about this document? Contact us