Privacy Policy

1. Who we are

Corpshore Kenya is a business process outsourcing company registered in Kenya. Registered address: Nairobi, Kenya. Contact email: info@corpshore.solutions.

For the purposes of the Kenya Data Protection Act 2019, Corpshore Kenya acts as a Data Processor when processing personal data on behalf of clients, and as a Data Controller when processing personal data for its own purposes (such as employment, marketing or website analytics).

2. Personal data we collect

2.1 Website visitors

• Contact form submissions: name, email address, company, country, service requirement, headcount, message
• Job applications: name, email address, phone number, county of residence, language profile, CV/LinkedIn URL, cover message
• Cookie consent preferences (stored in browser localStorage, not transmitted)
• Analytics data via session tracking (page views, scroll depth — no cross-site tracking)

2.2 Prospective and current clients

• Business contact details: name, email, phone, job title, company
• Commercial data: service requirements, headcount, contract details

2.3 Employees and contractors

• Employment records: National ID number (encrypted), NHIF, NSSF, KRA PIN
• Payroll data: bank account details, salary, deductions
• Performance data: quality scores, attendance records

National ID numbers are classified as sensitive personal data under the Act. They are encrypted at rest and in transit and are not shared with third parties except as required by law (KRA, NHIF, NSSF).

3. How we use personal data

Purpose	Lawful basis (DPA 2019)
Responding to contact form enquiries	Consent (data subject initiates contact)
Processing job applications	Consent (applicant submits application)
Client contract performance	Contractual necessity
Payroll and statutory compliance	Legal obligation (Employment Act 2007, KRA, NHIF, NSSF)
Marketing communications	Consent (opt-in; withdrawal available at any time)
Website analytics (session-level)	Legitimate interest (no cross-site tracking; no personal identifiers stored)

4. Data sharing and processors

Corpshore Kenya shares personal data only with:

• Formspree Inc. — contact and job application form processor. Data processed in the US under Formspree's privacy policy and standard contractual clauses.
• Kenya Revenue Authority (KRA), NHIF, NSSF, Housing Levy — statutory reporting obligations.
• Clients — where Corpshore Kenya acts as Data Processor under a signed Data Processing Agreement (DPA). Clients are Data Controllers responsible for their own data governance.

We do not sell personal data. We do not use personal data for automated decision-making or profiling.

5. Data retention

• Contact form submissions: 24 months from enquiry date
• Job applications (unsuccessful): 12 months from application date
• Employment records: 7 years from termination (KRA requirement)
• Client data processed on behalf of clients: per Data Processing Agreement (typically returned or deleted within 30 days of contract end)
• Cookie consent records: 12 months (per consent expiry)

6. Your rights under the Kenya Data Protection Act 2019

Under the Act, you have the following rights regarding your personal data:

• Right of access (Section 26): to request a copy of personal data we hold about you
• Right to rectification (Section 27): to request correction of inaccurate data
• Right to erasure (Section 28): to request deletion of your data (subject to legal retention obligations)
• Right to object (Section 30): to object to processing based on legitimate interest
• Right to withdraw consent (Section 31): to withdraw consent at any time for consent-based processing
• Right to complain to the ODPC: if you believe we have breached the Act, you may lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke

To exercise any of these rights, contact us at info@corpshore.solutions. We will respond within 21 days as required by the Act.

7. Cookies and localStorage

This website uses browser localStorage (not cookies) to store two items:

• corpshore_ke_lang — your language preference (en, sw, or fr). No expiry. Not transmitted to our servers.
• corpshore_ke_consent — your cookie/data consent choice and the date given. Expires after 365 days. Not transmitted to our servers.

We do not use third-party tracking cookies, advertising cookies, or cross-site tracking technologies. No personal data from this website is shared with advertising networks.

8. Security

We apply the following technical and organisational measures to protect personal data:

• HTTPS across all pages (TLS 1.2 minimum)
• Encrypted storage for sensitive personal data (National ID numbers)
• Access controls limiting personal data access to authorised personnel only
• Confidentiality agreements for all staff handling personal data
• Data Processing Agreements with all third-party processors

9. Changes to this policy

We may update this policy to reflect changes in our practices or the law. Material changes will be communicated by updating the "Last updated" date at the top of this page. We recommend reviewing this page periodically.

10. Contact

For all data protection enquiries, including rights requests and complaints:

Email: info@corpshore.solutions
Subject line: "Data Protection Request"
Response time: within 21 days (as required by the Kenya Data Protection Act 2019)