Privacy Policy

1. Introduction

WorkFlex operates a comprehensive mobile application designed for HR management, payroll processing, and employee attendance tracking. By using our App, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

We collect the following personal information:

• Account Information: Name, email address, phone number, employee number
• Employment Data: Position, department, company affiliation, employee role
• Financial Information: Bank account details, salary information, payroll data, tax information (KRA PIN, NSSF, NHIF numbers)
• Identification: National ID number
• Profile Data: Profile photos, user preferences

2.2 Location Information

2.3 Usage Information

• Attendance Records: Clock-in/out times, working hours, attendance history
• Leave Requests: Leave type, dates, reasons, approval status
• Document Uploads: Payslips, company documents, profile images
• Device Information: Device type, operating system version, app version

2.4 Automatically Collected Information

• Log data (IP address, access times, app features used)
• Device identifiers
• Network information

3. How We Use Your Information

3.1 Core Functions

• User authentication and account management
• Processing attendance and clock-in/out operations
• Calculating payroll and statutory deductions (PAYE, NSSF, NHIF)
• Generating and distributing payslips
• Managing leave requests and approvals
• Facilitating communication between employees and management

3.2 Business Operations

• Maintaining attendance records
• Processing salary payments
• Generating HR and financial reports
• Compliance with labor laws and tax regulations
• Verifying employee identity and work authorization

3.3 Service Improvement

• Analyzing app usage to improve features
• Troubleshooting technical issues
• Preventing fraud and unauthorized access
• Enhancing security measures

4. Data Sharing and Disclosure

4.1 Within Your Organization

Your employer/company has access to your employment data, attendance, and payroll information. Managers and HR personnel can view relevant employee information based on their role permissions.

4.2 Third-Party Services

We may share data with:

• Cloud Hosting Providers: Railway.app (for data storage and app hosting)
• Email Service Providers: For sending notifications and payslips
• Payment Processors: For salary disbursements (if applicable)

4.3 Legal Requirements

We may disclose information when required by:

• Legal obligations (court orders, subpoenas)
• Government authorities (tax authorities, labor inspectors)
• Protection of rights, property, or safety

4.4 We Do NOT

5. Data Security

5.1 Security Measures

• Encryption: Data transmitted over HTTPS/TLS
• Authentication: Secure login with password protection
• Access Control: Role-based permissions (CEO, HR, Manager, Employee)
• Server Security: Hosted on secure cloud infrastructure

5.2 User Responsibilities

• Keep your login credentials confidential
• Use strong passwords
• Report suspicious activity immediately
• Log out after use on shared devices

6. Data Retention

• Active Employment: We retain your data for the duration of your employment
• Post-Employment: Data retained for 7 years for tax and legal compliance (Kenya law)
• Attendance Records: Retained for audit purposes
• Payroll Records: Retained per statutory requirements

7. Your Rights

7.1 Access and Portability

• Request a copy of your personal data
• Export your information in a readable format

7.2 Correction

• Update inaccurate or incomplete information
• Modify your profile details

7.3 Deletion

• Request deletion of your account (subject to legal retention requirements)
• Note: Some data must be retained for compliance

7.4 Restriction

• Limit how we process your data
• Object to certain data processing activities

7.5 Withdrawal of Consent

• Disable location services (will affect clock-in functionality)
• Opt-out of non-essential notifications

8. Location Services

8.1 Purpose

Location data is collected ONLY when:

• You clock in or clock out
• The app needs to verify you're at the designated workplace

8.2 Control

• You can enable/disable location permissions in your device settings
• Disabling location will prevent clock-in/out functionality
• Location is NOT tracked continuously or in the background

8.3 Accuracy

We collect precise location (GPS) to ensure accurate attendance verification within your company's designated work area.

9. Children's Privacy

WorkFlex is not intended for users under 18 years of age. We do not knowingly collect information from minors.

10. International Data Transfers

Your data may be transferred to and stored on servers located outside Kenya. We ensure appropriate safeguards are in place to protect your information.

11. Changes to Privacy Policy

We may update this Privacy Policy periodically. Changes will be:

• Posted in the app
• Notified via email (for material changes)
• Effective immediately upon posting

12. Kenya Data Protection Act Compliance

This Privacy Policy complies with the Kenya Data Protection Act, 2019. We respect your rights under this legislation.

13. Contact Us

For privacy concerns, questions, or requests:

14. Consent

By using WorkFlex, you consent to:

• The collection and use of information as described in this Privacy Policy
• The processing of your personal data for the purposes stated
• The sharing of information as outlined above

15. Complaints

If you believe your privacy rights have been violated, you may:

1. Contact us directly using the information above
2. File a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya
   • Website: https://www.odpc.go.ke
   • Email: info@odpc.go.ke