Privacy Policy

We collect personal data submitted to us through our website, email, WhatsApp and during in-person meetings, including:

• Client / hiring company data: company name, contact name, email, phone number, role requirements, job descriptions, budget ranges and internal HR notes.
• Candidate data: name, contact details, CV, employment history, qualifications, references, licences and certifications, salary expectations, identification documents required for verification (e.g. KMPDC, NCK, PSRA, KRA PIN).
• Technical data: IP address, browser and device data, pages visited (essential analytics only).

• To assess hiring requirements and build candidate shortlists.
• To verify candidate qualifications, references and statutory registrations.
• To communicate with clients and candidates throughout the placement process.
• To meet donor compliance, safeguarding and statutory reporting obligations.
• To improve our service, manage invoicing and resolve disputes.

We rely on legitimate interest, contractual necessity and — for sensitive data such as identity documents — your explicit consent.

We share data only with: (i) the prospective employer or client whose role you are being considered for; (ii) referees you nominate; (iii) regulatory bodies during licence verification; (iv) trusted infrastructure providers (e.g. Supabase, email and WhatsApp providers) under written data-processing terms. We do not sell personal data.

• Active client requirements: retained for the duration of the engagement plus 7 years for tax and audit compliance.
• Candidate profiles: retained for up to 3 years from last contact, then deleted or fully anonymised. You may request earlier deletion at any time.
• Verification documents: deleted within 90 days of a placement decision unless required by donor or statutory rules.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local supervisory authority.

We use industry-standard controls: TLS encryption in transit, encrypted storage at rest, role-based access, audit logging and least-privilege access for staff. No system is fully impenetrable, but we will notify affected parties and the Data Protection Commissioner within 72 hours of any confirmed personal data breach.

Some of our infrastructure providers are based outside Kenya. Where data is transferred internationally, we rely on standard contractual clauses and provider-side adequacy decisions to maintain protection equivalent to Kenyan and EU standards.

We use essential cookies for session management and a minimal set of analytics to measure page performance. We do not run third-party advertising trackers.

Email our Data Protection contact at privacy@daichiprocurement.com or WhatsApp +254 700 000 000. We respond to verified data subject requests within 30 days.

We will publish material changes on this page and update the "last updated" date. Significant changes affecting candidate or client data will additionally be notified by email.