Data Protection Notice

1. Candidate Consent

1.1 Registration Consent

When you create an account on Achol HR, you are asked to confirm two mandatory consent statements before your profile can be submitted for verification:

• Accuracy Consent: "I confirm all information provided is accurate."
• Data Processing Consent: "I consent to my data being processed for job matching purposes and I have read and agree to the Terms of Use and Data Protection Policy."

Both consent statements must be acknowledged before account activation. The timestamp and IP address of your consent are recorded in our system for audit purposes.

1.2 Withdrawing Consent

You may withdraw your consent at any time by contacting us at info@achol.co.ke. Upon withdrawal, your account will be deactivated and your personal data will be scheduled for deletion in accordance with our retention policy.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

2. Document Handling

2.1 Document Storage

• All uploaded documents (passport scans, certificates, CVs, etc.) are stored on our secure servers in a directory that is not accessible via direct URL.
• Documents are served only through authenticated PHP scripts that verify user permissions before granting access.
• Documents are organized by candidate and document type.

2.2 Document Encryption

• Passport numbers and national ID numbers are encrypted using AES-256-CBC encryption before being stored in the database.
• Hash values of passport and ID numbers are stored separately for duplicate detection, making it impossible to reconstruct the original number from the hash alone.
• Even if the database were compromised, encrypted values cannot be read without the encryption key, which is stored separately.

2.3 Document Access

• Only authorized staff members with the appropriate role (HR, Account Management, or Admin) can access your documents.
• Every time a staff member views or downloads a document, the action is logged with the staff member's name, the document accessed, and the exact timestamp.
• These access logs are available for Admin review at any time.
• Agency partners cannot access your uploaded documents. They can only see your verification status.

2.4 Document Verification Process

The document verification process works as follows:

1. You upload a document through your profile.
2. The document status is set to "Pending."
3. An authorized staff member reviews the document.
4. The document is marked as "Verified," "Rejected" (with a reason), or "Needs Correction."
5. You are notified of the result via in-app notification and email.
6. If rejected, you can upload a corrected version.

3. Profile Data Handling

3.1 Profile Editing

• You can edit most of your profile information at any time through your dashboard.
• After identity verification, your name and identity documents become locked. Changing them requires re-verification.
• Re-uploading a document triggers a new review by the HR team.

3.2 Profile Completion

Your profile completion percentage is calculated based on how many required and recommended fields you have filled. This percentage is visible to you on your dashboard and helps you understand how complete your profile is.

3.3 Internal Notes

Staff members may add internal notes to your profile during the verification and review process. These notes are never visible to you or any agency partner. They are used solely for internal quality control and communication between staff members.

3.4 HR Ratings

HR staff may assign internal quality ratings to your profile covering documentation quality, communication, professionalism, and motivation. These ratings are never visible to you and are used only to assist the Admin in making internal decisions.

4. Data Retention

4.1 Active Accounts

Your data is retained for as long as your account remains active on the platform.

4.2 After Successful Employment

If you are successfully hired through a listing on our platform, your data is retained for 7 months after the date of successful employment. After this period, your data is permanently deleted unless otherwise required by law.

4.3 Account Deletion

Your data may be permanently deleted under these conditions:

• 7 months have passed since your successful employment.
• You request deletion by contacting us.
• The Admin decides to delete your data for internal reasons.
• A legal authority requests deletion.

Before permanent deletion, the system requires confirmation from the Admin. The deletion action, including the reason, is logged in the audit trail.

4.4 Blacklisted Accounts

If your account is blacklisted (due to fake documents, fraud, or violations), certain identifying data (email, phone, passport hash, ID hash) may be retained to prevent re-registration. This data is retained for the duration of the blacklist (permanent or temporary as set by the Admin).

5. Third-Party Data Sharing

Achol HR does not share your personal data with third-party companies for marketing, advertising, or commercial purposes.

Limited data sharing occurs in the following controlled situations:

• Agency Partners: If you were sourced by an agency partner, they can see your current verification status and application status. They cannot access your documents, contact details, or personal information.
• Internal Staff: Authorized staff with assigned roles can access your profile data and documents for verification purposes. All access is logged.
• Legal Authorities: If required by court order or legal obligation.

6. Data Security Measures

• SSL/TLS encryption on all data transmission (HTTPS enforced).
• AES-256-CBC encryption for sensitive fields (passport and ID numbers).
• Bcrypt password hashing with a cost factor of 12.
• Session security with HTTP-only, SameSite, and Secure cookie attributes.
• Role-based access control for all staff members.
• Document access logging for full audit trail.
• Weekly automated database backups.
• Login attempt throttling (5 attempts, 15-minute lockout).
• CSRF token protection on all forms.
• Server-side input validation and sanitization.

7. Automated Reminders

The platform sends automated reminders for profile completion and account activity:

• 7 days after registration: Profile completion reminder (if below 80%).
• 14 days: Second reminder via push notification.
• 30 days: Final reminder.
• Agencies receive a re-engagement email if inactive for 30 days.

You can manage your non-critical notification preferences from your account settings. Critical notifications (identity verification, document rejections, interview scheduling, hiring confirmations) cannot be turned off.

8. Your Rights

You have the right to access, correct, delete, restrict, or port your personal data. You also have the right to withdraw consent at any time. To exercise these rights, contact us at info@achol.co.ke.

We aim to respond to all data rights requests within 30 days.

9. Changes to This Notice

We may update this Data Protection Notice from time to time. Changes will be reflected in the "Last updated" date. Continued use of the platform constitutes acceptance of the updated notice.

10. Contact

For any data protection concerns or requests, please contact: