Privacy notice

HRMSPay is a payroll and human resources service provided by Centric Limited, a company incorporated in Kenya (“we”, “us”). This notice explains how we handle personal data on hrmspay.com, in the HRMSPay application at my-workspace.hrmspay.com, and when we provide our services.

Centric Limited is registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor, as section 18 of the Data Protection Act, 2019 (DPA) requires.

The DPA separates a data controller, which decides why and how personal data is processed, from a data processor, which processes it on a controller’s behalf (DPA s.2). We act in both roles:

If you work for, or applied to, one of our customers, that organisation is the controller of your data in HRMSPay and its own privacy notice explains why it holds it. Please send requests about that data to the organisation first; we help it answer them (section 9).

As controller, we collect:

• Enquiry details you give us in the demo or contact form: name, work email, phone number, company, company size, how you pay staff, a preferred demo time and your message.
• Account details of people who sign in to HRMSPay: name, email address, role, organisation, and a password stored only as a one-way hash.
• Security and audit records: sign-ins, failed sign-ins and lockouts, IP address and browser, a record of changes made, and a record of who viewed or downloaded sensitive details.
• What you write in the live chat, with any name, email or phone number you give there. Chats are handled for us by DD Projects, our support inbox provider.
• Your light or dark mode choice, kept only in your own browser (see our cookie policy).

As processor, a customer may put into HRMSPay data about its employees and applicants, including identity and contact details; job, department, contracts and pay; bank account details; KRA PIN and statutory numbers (NSSF, SHIF); leave and attendance; loans, court orders and other deductions; performance reviews and training; applications and interview notes; and exit records.

Some of this is sensitive personal data under DPA s.2, for example health information (sick leave, disability for tax relief), marital status and family details such as next of kin or dependants, and property details. HRMSPay holds it only as the customer instructs, and the customer needs a lawful ground for it under DPA s.44 to s.46.

We process personal data only on a ground in DPA s.30:

We do not sell personal data, use it for advertising, or use it for any commercial purpose beyond providing the service. Using it commercially would need your express consent (DPA s.37).

HRMSPay works out pay, statutory deductions and leave balances automatically from rules the customer sets. These are not decisions based solely on automated processing under DPA s.35: people check and approve every payroll before anyone is paid, the person who processes a payroll cannot approve it, and every figure can be opened to show how it was worked out.

We share personal data only as needed to provide the service, with:

• Service providers who help us run HRMSPay, such as hosting, email delivery and support tools, under written contracts that require them to act only on our instructions and keep the data secure (DPA s.42).
• Systems a customer connects HRMSPay to and tells us to send data to, such as its bank (payment files) or its ERP.
• Authorities where the law requires it, for example under a court order or a lawful request from the Kenya Revenue Authority or the ODPC.
• A buyer or successor of our business, under the same protections, if the business is sold or reorganised.

Where a service provider stores or reaches personal data from outside Kenya, we transfer it only as the DPA allows: with appropriate safeguards such as a binding contract with the recipient, to a country with comparable data protection law, or where the transfer is necessary for a purpose listed in DPA s.48. Sensitive personal data leaves Kenya only with the data subject’s consent and on proof of appropriate safeguards (DPA s.49). We record each transfer, as the Data Protection (General) Regulations, 2021 require.

We keep personal data only as long as it is reasonably needed for its purpose or as the law requires, then delete, anonymise or pseudonymise it (DPA s.39).

Under DPA s.26 and the sections that follow, you have the right to:

• Be informed of how your personal data is used (this notice).
• Access the personal data we hold about you.
• Object to the processing of all or part of it (s.36).
• Have false or misleading data corrected, and data we no longer have a right to keep deleted (s.40).
• Ask us to restrict processing while accuracy or an objection is checked (s.34).
• Receive your data in a structured, machine-readable format and have it sent to another controller (s.38).
• Withdraw consent where we rely on it, without affecting what was done before (s.32).
• Not be subject to a decision based solely on automated processing that significantly affects you (s.35).

Employees can see and download their own payslips and many of their details in My Workspace in the HRMSPay app. We may need to confirm your identity before acting on a request. We aim to answer access requests within 7 days, erasure requests within 14 days and portability requests within 30 days, in line with the Data Protection (General) Regulations, 2021 and DPA s.38. Where we hold your data as processor for your employer, we pass your request to your employer and help it respond.

To make a request, write to us through our contact page.

We protect personal data with technical and organisational measures suited to the risk and built into the design of HRMSPay (DPA s.41), including:

• Encryption of sensitive fields such as bank account numbers and KRA PINs, and HTTPS for all traffic.
• Salaries, bank accounts and KRA PINs hidden from anyone whose role doesn’t allow them, and every full view or download recorded.
• Role-based access, separation of duties for payroll, and each customer organisation’s data kept apart.
• An audit log of changes that cannot be edited or deleted, alerts on unusual access, password rules and account lockout.

If personal data we control is accessed without authority and there is a real risk of harm, we will notify the Data Commissioner within 72 hours of becoming aware of it, and tell the people affected in writing as soon as reasonably practicable, unless the data was protected, for example by encryption (DPA s.43). Where we act as processor, we tell the affected customer without delay and, where practicable, within 48 hours, so it can meet its own duties.

This website and HRMSPay are for organisations and their staff and are not aimed at children. Where a customer employs someone under 18, as the Employment Act, 2007 allows in limited cases, the customer is responsible for the parent’s or guardian’s consent that DPA s.33 requires.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner (DPA s.56), which must investigate and conclude complaints within 90 days:

• Online: www.odpc.go.ke, “Lodge a complaint”
• Email: info@odpc.go.ke
• Telephone: 020 780 1800
• In person at an ODPC office, including Nairobi

We update this notice when our practices or the law change, and show the date of the latest version at the top. If a change materially affects how we use your data, we tell customers in advance.

Questions about this notice? Write to us through our contact page.

• Data Protection Act, 2019 (No. 24 of 2019)
• Data Protection (General) Regulations, 2021 (Legal Notice 263 of 2021)
• Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
• Employment Act, 2007
• Tax Procedures Act, 2015