ActivA-HR Privacy Policy
27/08/2026
This Privacy Policy explains how Priority Activator Consulting ("ActivA-HR", "we", "us") collects, uses, and protects personal data through ActivA-HR (the "Service"), in accordance with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 (together, "the Act"), and drafted to the standard of internationally recognised frameworks such as the EU General Data Protection Regulation (GDPR) where the Act is silent.
This Policy applies to two groups of people, and the sections below indicate which apply to which: Client organisations that subscribe to ActivA-HR; Employees and other individuals ("Users") whose attendance data is processed through ActivA-HR on behalf of a Client organisation.
1. Who we are and our role
For Client organisations, ActivA-HR acts as a Data Processor for the personal data of a Client's employees — attendance, leave and site-assignment data — processing it only on the Client's instructions and only within the scope the Client configures (which sites exist, who belongs to them, what leave policies apply). The Client organisation is the Data Controller responsible for that data and for having a lawful basis to collect it from its own employees.
For data we collect directly from Client organisations themselves — the organisation's name, the account administrator's own name and email, billing and payment records — ActivA-HR acts as a Data Controller in our own right.
Our data protection contact: hello@activ-hr.com. A dedicated data-protection mailbox will be published here once one is provisioned; this address reaches the team responsible for privacy requests in the meantime.
2. What data we collect
Data category | Collected from | Examples
Account and billing data | Client organisation | Organisation name, admin name and email, plan tier, payment reference and phone number for M-Pesa payments
User identity data | Client organisation (entered by an admin or manager) | Employee full name, role, employment type, site assignment, phone number
Attendance data | User, via the app | Clock-in and clock-out timestamps, which site the punch was recorded against
Location data | User, via the app | GPS coordinates captured at the moment of each clock-in and clock-out, and the calculated distance from the employer's registered site location — collected specifically to confirm the User was within the geofence the Client configured; not tracked outside that moment
Leave data | User, via the app | Leave type, requested dates, approval status and history
Biometric data | Not currently collected | ActivA-HR supports connecting third-party biometric terminals as a future integration, but this is not yet part of the live Service. No fingerprint, face or other biometric data is collected today. If and when this feature ships, this Policy will be updated and separate, explicit opt-in consent will be sought before any biometric data is processed — see Section 5.
Technical data | Automatically | IP address (used only for rate-limiting and abuse prevention), browser/device type, request logs
Cookies | Web dashboard and marketing site visitors | See our Cookie Policy at activ-hr.com/cookie-policy
3. Why we process this data
To provide the attendance tracking, leave management and organisational-structure features of the Service
To verify a User was physically present at their assigned site when they clocked in or out
To maintain account security, rate-limit authentication attempts, and prevent misuse
To communicate service updates, maintenance notices, and support responses
To bill Client organisations and process payments
To meet legal and regulatory obligations, including retention and reporting requirements
4. Lawful basis for processing
Employee attendance, location and leave data is processed on the basis of the Client organisation's legitimate interest in workforce management and, where applicable, performance of the employment relationship between the Client and its employee. We do not rely on an employee's consent as the lawful basis for attendance or location processing — consent given to an employer by an employee is rarely considered freely given under either the Act or international standards such as the GDPR, given the imbalance in that relationship, so it is not an appropriate basis here.
Account and billing data is processed on the basis of performance of the contract between the Client organisation and ActivA-HR.
Security and technical logs are processed on the basis of our legitimate interest in operating a secure Service.
Any future biometric data (see Section 5) would be processed only on the basis of the individual's explicit, opt-in consent, as the Act requires for sensitive personal data.
Retention and reporting data is processed to comply with a legal obligation, where one applies.
5. Biometric data specifically
We do not collect biometric data today. Biometric terminal integration exists as planned, future functionality, not a live feature — see Section 2. If it is enabled in a future release, the following will apply as a minimum before any biometric data is collected:
Collected only where the Client organisation explicitly enables the feature
Requires explicit opt-in consent from the individual User, captured with a timestamp and the version of this Policy in force at the time
Users who decline must still be able to clock in using a non-biometric method
Stored as a mathematical template rather than a reconstructable image, and encrypted at rest
Subject to a defined retention window tied to the duration of employment, deleted automatically thereafter
6. Who we share data with
We do not sell personal data. We share data only with:
Sub-processors, who process data on our behalf to operate the Service — currently Supabase (database hosting, authentication), Vercel (application hosting and CDN), and, once configured by the Client's account, Resend (transactional email) and Cloudflare (bot-protection challenges). Each is contractually bound to process data only for the purpose of providing their service to us.
Other Client-authorised recipients, where the Client configures an export or integration.
Legal and regulatory bodies, where required by law, including the Office of the Data Protection Commissioner (ODPC).
Cross-border transfers: our sub-processors operate infrastructure outside Kenya. Where personal data is transferred outside Kenya, we rely on the transfer mechanisms recognised under the Act — including contractual safeguards with each sub-processor equivalent in substance to the EU's Standard Contractual Clauses — and will not transfer data to a jurisdiction without an adequate level of protection unless such safeguards are in place.
7. How long we keep data
We retain personal data only as long as necessary for the purposes described in this Policy — generally for the duration of the Client's subscription plus a reasonable period afterward to meet legal, accounting and dispute-resolution needs. A Client organisation may request deletion of its data on termination of its subscription, subject to any legal retention obligation that overrides that request.
8. Your rights
Under the Act, individuals have the right to: be informed of the use to which their personal data is to be put; access their personal data; request correction of inaccurate or outdated data; request deletion of false or unlawfully collected data; object to the processing of some or all of their data; withdraw consent, where processing is based on consent (such as any future biometric enrolment); and lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
Employees: to exercise these rights, contact your employer's HR team first, since your employer is the Data Controller for your employment data, or contact us directly at hello@activ-hr.com and we will route your request appropriately.
Client organisations: contact hello@activ-hr.com for data access, export, or deletion requests relating to your account.
9. Data security
We implement technical and organisational measures appropriate to the sensitivity of the data processed, including: encryption in transit (HTTPS/TLS, HSTS enforced) and at rest; row-level security enforced at the database layer so one organisation's data is structurally isolated from another's, not just filtered by the application; role-based access control distinguishing staff, managers, organisation administrators and platform administrators; and rate limiting on authentication endpoints to resist credential-stuffing and brute-force attempts.
10. Data breach notification
In the event of a personal data breach affecting User data, we will notify the affected Client organisation without undue delay, and in any event within 72 hours of becoming aware, consistent with the Data Protection (General) Regulations, 2021 and with the international standard set by the GDPR, so the Client can meet its own notification obligations to the ODPC and to affected individuals.
11. Children's data
The Service is not directed at, and we do not knowingly collect data from, individuals under the age of 18. ActivA-HR is intended for use by employed adults within a Client organisation's workforce.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page.
13. Contact us
For questions about this Policy or to exercise your data protection rights, contact us at hello@activ-hr.com.
You may also lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC), Kenya.