Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

2. What Data We Collect

We collect the following categories of personal data:

2.1 Account Information

• Full name (as it appears on your passport or national ID)
• Email address
• Phone number (optional)
• Password (stored in encrypted format only)

2.2 Profile Information

• Date of birth
• Gender
• Nationality
• Resident location
• Professional background (profession, experience, career path)
• Education history
• German language level and certificates
• Motivation statements
• Relocation timeline
• Profile photograph
• Video introduction (optional)

2.3 Identity Documents

• Passport number (encrypted in our database)
• National ID number (encrypted in our database)
• Scanned copies of passport or national ID
• Academic certificates
• Language certificates
• Professional licenses
• CV / Resume
• Work experience letters
• Police clearance (optional)
• Medical certificate (optional)

2.4 Usage Data

• IP address
• Browser type and version
• Pages visited and time spent
• Login timestamps
• Actions taken on the platform (applications, saved jobs, etc.)

2.5 Contact Form Data

• Name, email, phone, subject, and message content submitted through the contact form

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your account on the platform
• To verify your identity and authenticate your documents
• To display your profile information for job application processing
• To notify you about job listings that match your profile
• To communicate with you about your account, applications, and platform updates
• To maintain platform security and prevent fraud
• To generate anonymized statistics about platform usage
• To comply with legal obligations

4. Legal Basis for Processing

We process your data based on the following legal grounds:

• Consent: You provide explicit consent when you register, complete your profile, and agree to the Terms of Use and this Privacy Policy.
• Contractual Necessity: Processing is necessary to provide the services you have requested (account management, job applications).
• Legitimate Interest: We have a legitimate interest in maintaining platform security, preventing fraud, and improving our services.
• Legal Obligation: We may process data to comply with applicable laws and regulations.

5. How We Store and Protect Your Data

5.1 Data Storage

• Your data is stored on secure servers hosted in Kenya.
• All uploaded documents are stored outside the publicly accessible web directory.
• Documents are served only through authenticated, permission-checked requests.

5.2 Encryption

• Passport numbers and national ID numbers are encrypted using AES-256-CBC encryption before storage.
• Passwords are hashed using bcrypt and are never stored in plain text.
• All data transmission is protected by SSL/TLS encryption (HTTPS).

5.3 Access Control

• Only authorized staff members can access candidate documents and personal data.
• Every document access is logged with the staff member's name, the document accessed, and the timestamp.
• Staff access is limited based on their assigned role and permissions.

6. Data Sharing

We do not sell, rent, or trade your personal data. We may share your data in the following limited circumstances:

• With authorized staff: Internal team members who need access to verify documents and process applications.
• With agency partners: If you were referred by an agency partner, they can see your application status but not your personal documents or contact details.
• Legal requirements: If required by law, court order, or regulatory authority.

We do not share your data with any third-party marketing companies, advertisers, or data brokers.

7. Data Retention

• Active accounts: Your data is retained for as long as your account is active.
• Successful placements: Data is retained for 7 months after successful employment, then permanently deleted.
• Inactive accounts: If your account is inactive for 24 months, we may contact you before deleting your data.
• Contact form messages: Retained for 12 months, then archived or deleted.

8. Your Rights

You have the following rights regarding your personal data:

• Right of Access: You can request a copy of all personal data we hold about you.
• Right of Correction: You can update incorrect or incomplete data through your profile settings.
• Right of Deletion: You can request permanent deletion of your account and all associated data.
• Right to Restrict Processing: You can request that we limit how we use your data.
• Right to Data Portability: You can request your data in a machine-readable format.
• Right to Withdraw Consent: You can withdraw consent at any time by contacting us.

To exercise any of these rights, please contact us at info@achol.co.ke.

9. Cookies

Our platform uses essential cookies to manage user sessions and maintain login states. We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. The session cookie is named ACHOL_HR_SESSION and is deleted when you close your browser or after your session expires.

10. Children

Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from a minor, we will delete it immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy regularly. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us: