Legal · Data Protection Act, 2019 (Kenya)
Privacy Policy
Last updated: October 2026 · Applies to kazily, a product of GRSL Recruitment Ltd, Nairobi, Kenya
The short version: candidate data belongs to candidates. We collect only what recruitment needs, we never sell data, every background check needs your signed consent, and you can export or delete your data by emailing one address.
1. Who we are
kazily is a recruitment applicant tracking system (ATS) operated by GRSL Recruitment Ltd ("kazily", "we", "us"), registered in Kenya and based in Nairobi. We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor under the Data Protection Act, 2019 (Kenya) ("DPA").
This policy explains what personal data we collect through the kazily website, job boards, application forms and the ATS workspace, why we collect it, and the rights you have over it.
2. The data we collect
If you are a candidate applying for a job
- Identity & contact: name, email, phone number, location.
- Professional history: CV/résumé, cover letter, work history, education, skills, certifications and documents you upload.
- Screening answers: responses to application and gate-keeping questions, self-interview videos where a role requires one.
- Assessment data: AI-assisted match scores against job descriptions, recruiter notes, interview feedback, reference and background checks (only with your consent — see section 5).
- Consent records: timestamps, the exact wording you consented to, and the IP address at signing, kept as proof of consent under the DPA.
If you are a recruiter or client using a kazily workspace
- Account details (name, work email, role), usage logs, billing and tax invoice records (KRA PIN where provided), and support correspondence.
Collected automatically
- Device, browser and log data, and essential cookies that keep you signed in. Optional analytics cookies load only if you accept them on our cookie banner.
3. Why we process it (lawful bases)
| Purpose | Lawful basis (DPA s.30) |
|---|
| Matching candidates to vacancies and progressing applications | Consent, given at application |
| Sending stage feedback within our 24h/48h feedback policy | Consent + legitimate interest |
| Background / reference checks | Explicit, separately-signed consent per check |
| Billing, proration, receipts and tax invoices | Contract performance + legal obligation (Tax Procedures Act) |
| Product improvement, security, abuse prevention | Legitimate interest |
4. Who we share it with
- The recruiting agency using kazily (the data controller for your application) and their client — the hiring company — only when you are shortlisted or presented.
- Processors that run the service: cloud hosting, email delivery (your stage emails come from the agency's configured address, e.g. feedback@gaprecruitment.co.ke), calendar sync (Google / Microsoft / iCloud / CalDAV, only when you connect one), and WhatsApp Business where enabled.
- Job boards (Google for Jobs, Jora, Jooble, CareerJet, Talent.com, MyJobMag) receive job postings, never candidate data.
- Regulators or law enforcement where the law requires it.
We never sell personal data. Ever.
5. Background checks & consent
No background, reference, credit or criminal-record check is initiated through kazily until you have signed the specific consent form for that check. Each consent is logged with the wording version, timestamp and IP address, and the signed record is kept on your profile for the statutory retention period. You may withdraw consent at any time before the check is conducted by emailing ops@kazily.africa.
6. Retention
- Active applications: for the life of the recruitment process plus 12 months.
- Talent pool profiles: until you withdraw consent or ask for deletion.
- Billing and tax records: 5 years, as required by Kenyan tax law.
- Signed consent records and audit logs: 7 years.
7. Your rights under the DPA
You may at any time: Access your data Correct it Delete it Withdraw consent Object to processing Port your data Complain to the ODPC
Email ops@kazily.africa — we respond within 72 hours and act within 30 days. Deletion of compliance records (consent logs, tax invoices) is subject to statutory retention and, inside agency workspaces, deletion of candidate records requires approval by the agency's lead recruiter — an accountability control, not a barrier to your rights.
8. Security
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access: recruiters see only their workspace; clients see only their shortlisted candidates.
- Every stage change, email, export and deletion request is written to an immutable audit log.
- Annual penetration testing and ODPC-aligned breach notification (within 72 hours where risk exists).
9. International transfers
Primary hosting is in cloud regions serving Kenya. Where a processor stores data outside Kenya, transfers rely on contractual safeguards approved under DPA s.48–49.
10. Contact
Data Protection Officer, GRSL Recruitment Ltd · Nairobi, Kenya · ops@kazily.africa. You may also lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke.
← Back to kazily