Data processing terms

The customer is the data controller of the personal data of its employees, applicants and other people it puts into HRMSPay (“customer data”). Centric Limited is the data processor and processes customer data only on the customer’s documented instructions (DPA s.42).

The customer is responsible for having a lawful basis for customer data (DPA s.30), including sensitive personal data (DPA s.44 to s.46); for telling its people what DPA s.29 requires; for any data protection impact assessment its processing needs (DPA s.31); and for its own registration with the ODPC.

The customer’s instructions are the subscription agreement, these terms, and how the customer sets up and uses HRMSPay: its pay rules, workflows, integrations and retention choices. We will tell the customer if we believe an instruction breaks the law. Processing beyond the customer’s instructions would make us a controller for that processing (DPA s.42).

Only our staff who need access to provide or support the service can reach customer data, and they are bound by confidentiality. Support access to a customer’s organisation is given only for the task asked for and is recorded.

We maintain technical and organisational measures suited to the risk (DPA s.41), including:

• Each customer organisation’s data kept apart from every other.
• Encryption of sensitive fields such as bank account numbers and KRA PINs, and HTTPS for all traffic.
• Role-based access, with sensitive details hidden by default and every full view or download recorded.
• Separation of duties for payroll: the person who processes a run cannot approve it, and the approver cannot send the bank file.
• An audit log of changes that cannot be edited or deleted; password rules, expiry and account lockout.

The customer authorises us to use sub-processors for hosting, email delivery, file storage and similar services. Each is bound by a written contract with data protection duties at least as strict as these terms, and we remain responsible for them. We give customers notice before adding or replacing a sub-processor, and a customer may object on reasonable data protection grounds.

We transfer customer data outside Kenya only in line with DPA s.48 to s.50 and the Data Protection (General) Regulations, 2021, with appropriate safeguards and a record of each transfer. We do not transfer sensitive personal data outside Kenya without the safeguards and consent DPA s.49 requires.

• Requests from individuals: we pass on any request we receive about customer data and help the customer answer it. Employees can see their own payslips and details in My Workspace, and customers can export data from HRMSPay.
• Impact assessments: we give the customer the information it reasonably needs for a data protection impact assessment (DPA s.31) about its use of HRMSPay.
• Regulators: we cooperate with the ODPC on matters concerning customer data.

We tell the customer without delay, and where practicable within 48 hours, after becoming aware of a breach affecting customer data (DPA s.43). Our notice describes what happened, the data and people likely affected, the likely consequences and the steps taken or proposed, so the customer can notify the Data Commissioner within 72 hours and the people affected where required.

When the subscription ends, the customer can export its data. We then delete or anonymise customer data within the period set in the subscription agreement, unless the law requires us to keep some of it, in which case we keep it only for that purpose (DPA s.39 and s.40).

We make available the information reasonably needed to show we comply with these terms, and allow audits by the customer or an auditor it appoints, on reasonable notice and no more than once a year unless a regulator requires one or after a breach.

Questions about these terms? Write to us through our contact page.