This Privacy Policy explains how Staffluma collects, uses, protects, shares, and manages personal data across our website, software-as-a-service (SaaS) workforce management platform, and mobile applications. It also describes your privacy rights under applicable data protection laws.
Effective Date: October 18, 2026 Last Updated: October 18, 2026 Applicable Law: Kenya DPA 2019 & International Principles Version 1.0 (Enterprise Specification)
01. Introduction
Staffluma is an AI-powered, multi-tenant software-as-a-service (SaaS) platform providing employee management, payroll calculation, attendance and shift scheduling, leave management, applicant tracking, onboarding, performance reviews, document storage, and automated workforce workflows.
We are committed to operating transparently, safeguarding personal information, and respecting the fundamental privacy rights of individuals who interact with our services. This Privacy Policy governs data handling across:
Our public marketing website located at https://staffluma.com and associated subdomains;
Our SaaS cloud applications, customer administration dashboards, and self-service portals;
Our official mobile applications (including the Staffluma mobile application for Android and iOS);
Applicant tracking and careers interfaces hosted on behalf of customer organizations; and
Inquiries, customer support correspondence, and demo requests submitted to Staffluma.
This Privacy Policy should be read alongside our Terms of Service and any Master Services Agreement (MSA) or Data Processing Addendum (DPA) executed between Staffluma and customer organizations.
02. Who We Are
Staffluma ("we", "us", or "our") is the developer and service provider of the Staffluma workforce operating platform. Our primary public web presence is accessible at https://staffluma.com.
Corporate Entity & Legal Transparency Notice
Staffluma conducts business under the Staffluma brand name. Formal corporate registration details, statutory registered office location, certified ODPC registration numbers, and appointed Data Protection Officer (DPO) credentials remain subject to final verification and operational legal approval on our corporate register. In compliance with strict legal accuracy standards, Staffluma does not publish placeholder or fictitious registration certificates.
For general privacy inquiries, please contact our privacy compliance desk at [email protected] (or [email protected] upon formal activation).
03. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed in connection with:
Visitors: Individuals who browse our public marketing pages or submit contact/demo inquiries;
Account Administrators & Managers: Authorized personnel appointed by our business customers to administer HR, payroll, attendance, or IT operations;
Employees & Contractors: Workers who access self-service features via web browsers or mobile apps to view payslips, record attendance, request leave, or complete onboarding/performance milestones;
Job Candidates & Applicants: Individuals applying for job openings published through Staffluma-powered recruitment portals; and
Customer Support Inquirers: Users communicating with our team regarding service inquiries or technical troubleshooting.
Exclusions: This Policy does not apply to third-party software, external websites linked from our platform, or the independent employment and human resources policies of our business customers. Customer organizations are independently responsible for their own internal employment privacy notices.
04. Our Roles in Processing Personal Data
Under data protection legislation—including the Kenya Data Protection Act, 2019 (KDPA) and the General Data Protection Regulation (GDPR)—the legal obligations of parties depend on whether they act as a Data Controller or a Data Processor.
Data Controller
Staffluma as Data Controller
Staffluma acts as an independent Data Controller for data relating to: marketing website visitors, demo inquiries, customer business account contracts, billing contacts, customer administrator login credentials, and platform security telemetry collected to protect the service.
Data Processor / Service Provider
Staffluma as Data Processor
When customer organizations subscribe to Staffluma to manage their workforce, the customer organization acts as the Data Controller. Staffluma acts strictly as a Data Processor (or service provider), processing employee, payroll, and applicant records only on documented instructions from the employer.
Where should employees direct privacy requests?
If you are an employee, contractor, or job applicant using Staffluma on behalf of an employer, your employer determines why and how your workforce records are processed. Requests regarding access, correction, or deletion of your personnel files should be submitted directly to your employer's HR or privacy team. Staffluma provides the tools for employers to fulfill these requests.
05. Categories of Personal Data We Collect
We collect personal data only to the extent necessary to deliver and secure our workforce services. The specific categories processed depend on whether you visit our website, manage an organization, or access employee self-service features.
5.1 Account & Identity Data
Information used to authenticate users and manage access privileges: full name, business email address, telephone number, cryptographic password hashes (bcrypt), assigned user roles (e.g., Super Admin, Company Admin, HR Manager, Payroll Officer, Department Manager, Employee), and tenant identifiers.
5.2 Employee & Human Resource Records
Core workforce administration data maintained within customer accounts: employee identification number, job title, department, branch/office designation, reporting line/manager hierarchy, date of hire, probation period status, employment contract terms, emergency contact details (name, relationship, phone number), and professional background.
5.3 Payroll & Financial Records
Data processed to calculate compensation and facilitate payroll preparation: base salary, hourly rates, allowances, statutory and voluntary deductions, bank account details (bank name, branch code, account number), statutory identifiers (such as KRA PIN, NSSF, and NHIF/SHIF registration numbers where configured for Kenyan operations), payroll run lines, payslips, and disbursements.
5.4 Attendance & Working-Time Data
Records of workplace hours and schedules: clock-in and clock-out punch timestamps, work shift assignments, weekly timesheets, attendance correction requests, and branch geofencing parameters (configured boundaries for physical workplace verification, not continuous background location tracking).
5.5 Leave Management Data
Absence and time-off records: leave categories (annual, sick, maternity, paternity, compassionate, unpaid), accrued leave balances, leave transaction ledgers, submitted requests, manager approval workflows, and supporting documentation (such as medical certificates uploaded for sick leave).
5.6 Recruitment & Applicant Data
Information gathered during talent acquisition via our careers interfaces: applicant name, contact details, curriculum vitae (CV), employment history, academic qualifications, interview schedule records, panelist scorecards, candidate assessments, candidate communications, and offer letter terms.
5.7 Performance & Goal Management Data
Records tracking workplace performance: Objectives and Key Results (OKRs), key performance indicators (KPIs), individual and team goals, self-assessment submissions, manager performance reviews, and developmental evaluations.
5.8 Uploaded Documents & Content
Files uploaded by users into secure cloud object storage (Cloudflare R2): signed employment contracts, scanned national identification cards or passports, professional certificates, disciplinary records, company policies, and onboarding/offboarding clearance documentation.
5.9 Technical & Security Diagnostic Data
Information collected automatically for security monitoring and platform reliability: IP addresses, browser user-agent strings, operating system, session tokens, login history, and immutable database audit logs recording administrative actions.
5.10 Mobile Application Data
Data specific to mobile app usage: encrypted authentication tokens stored in the device's secure keystore/keychain via expo-secure-store, device connectivity state, and app version. The mobile app does not collect background location, harvest address books, or access device sensors without user interaction.
5.11 Sensitive Personal Data (Special Categories)
Under Section 44 of the Kenya Data Protection Act, 2019 and Article 9 of the GDPR, certain records constitute sensitive personal data (e.g., medical certificates submitted for sick leave, health-related emergency contact notes, or biometric punch records if enabled by a customer). Staffluma processes sensitive data strictly as a processor upon explicit instructions and lawful authorization from the customer organization.
06. Sources of Personal Information
We receive personal data from several distinct sources:
Directly from You: When you fill out website contact or demo forms, register an account, punch in for work, request leave, or upload documents;
From Your Employer: When company administrators provision user accounts, configure compensation lines, import employee rosters, or evaluate performance;
From Job Applicants: When candidates apply directly to job postings published via Staffluma recruitment portals;
Automated Platform Telemetry: When web servers and security software log IP addresses, session states, and audit trails; and
Connected Customer Systems: When an employer configures API integrations with accounting, calendar, or identity providers.
07. How We Use Personal Data
We process personal data only for legitimate business and operational purposes supported by our software architecture:
Operational Purpose
Categories of Data
Staffluma Role
User Authentication & Role Scoping
Account credentials, email, user roles, session tokens
Contracts, identity documents, policies in Cloudflare R2
Data Processor (on employer's instruction)
Security, Audit Trails & Abuse Prevention
Immutable audit logs, IP addresses, rate-limiting counters
Controller & Processor (Security safeguarding)
Demo Follow-up & Sales Inquiries
Contact name, work email, organization size, inquiry message
Data Controller
08. Legal Bases for Processing
Under Section 30 of the Kenya Data Protection Act, 2019 and Article 6 of the GDPR, processing of personal data must be grounded in an established lawful basis:
Performance of a Contract: Processing necessary to provide the platform services requested by customer organizations, fulfill subscriptions, and provide self-service access to workforce features.
Compliance with Legal Obligations: Processing required by employment law, statutory tax withholding, social security reporting, and lawful regulatory directives (e.g., Kenyan labor laws and tax filing mandates).
Legitimate Interests: Processing necessary for platform security, fraud prevention, tenant isolation enforcement, system diagnostics, and defending legal claims—balanced against individual privacy rights.
Consent: When you provide voluntary consent, such as opting in to marketing updates or specific optional workplace programs. Consent may be withdrawn at any time.
Note for Employment Records: In employment relationships, consent is generally not the sole basis for processing essential workforce and payroll records, as processing is predominantly required by contract and statutory employment obligations.
09. AI, Automated Processing & Agentic HR
Staffluma incorporates intelligent, agentic workflow capabilities designed to assist human teams with routine administrative coordination and discrepancy detection. Because workforce decisions deeply impact individuals, we uphold strict standards of transparency:
9.1 What Our AI Features Do
Staffluma's intelligence features assist with operational workflows, including:
Surfacing attendance exceptions (e.g., missing clock-outs or shift conflicts) for manager review;
Drafting routine administrative copy (such as job descriptions or onboarding task lists);
Highlighting discrepancies in payroll input calculations prior to human authorization; and
Coordinating interview scheduling steps and notification reminders.
9.2 Mandatory Human Review & Control
Human-In-The-Loop by Design
No autonomous employment decisions: Staffluma AI workflows do not make unilateral, automated employment decisions that produce legal or significant effects. AI agents prepare drafts, highlight exceptions, and organize workflows; however, final decisions regarding payroll disbursement, hiring, termination, performance evaluations, and disciplinary sanctions strictly require affirmative human approval by authorized company officers.
9.3 Data Training & External LLM Safeguards
Customer workforce records, employee personnel files, and proprietary company data stored in Staffluma are never sold or used to train public commercial generative AI foundation models. Where advanced natural language features utilize external enterprise AI APIs, data is transmitted over encrypted channels solely to fulfill the requested feature under zero-data-retention enterprise agreements.
10. Cookies & Storage Technologies
We believe in privacy by default. We do not use intrusive cross-site tracking pixels or commercial data-broker technologies.
10.1 Technologies Used
Essential Session Tokens: Secure HTTP headers and cryptographic tokens required to authenticate users, enforce tenant boundaries, and maintain active sessions;
Functional UI Cookies: The sidebar_state cookie, which stores the user's sidebar navigation collapse preference for 7 days; and
Mobile Secure Storage: Encrypted device storage via expo-secure-store on mobile devices to retain authenticated session credentials locally without plain-text exposure.
10.2 What We Do Not Use
Staffluma does not employ third-party behavioral advertising cookies (such as Meta Pixel or Google Ads retargeting scripts) on its platform or marketing pages. If non-essential web analytics are implemented in future releases, users will be provided with explicit cookie preference controls in accordance with applicable law.
11. Data Sharing & Third-Party Disclosure
Staffluma does not sell, lease, or monetize personal data. We disclose personal data only in the limited circumstances described below:
Your Employer & Authorized Coworkers: Within a customer's tenant, employee data is accessible strictly according to the role-based access permissions configured by the employer's administrators;
Cloud Hosting & Storage Subprocessors: We engage verified infrastructure subprocessors, including Cloudflare, Inc. (for Cloudflare R2 object storage of uploaded files, DNS, and edge delivery) and cloud database providers;
Transactional Communications: Email and SMS delivery infrastructure used to send password reset links, system notifications, and security alerts;
Professional Advisers: Auditors, legal counsel, and technical compliance specialists bound by confidentiality; and
Legal & Regulatory Authorities: Where compelled by valid subpoena, search warrant, court order, or mandatory statutory reporting requirements under applicable law.
12. International Data Transfers
Staffluma serves organizations operating primarily in Kenya and emerging markets. To ensure platform resilience, low latency, and secure backup redundancy, data may be hosted or processed on distributed cloud infrastructure across multiple geographic regions.
Whenever personal data is transferred across international boundaries (including outside Kenya or the European Economic Area), Staffluma ensures appropriate safeguards are in place, such as:
Standard Contractual Clauses (SCCs) incorporating data protection covenants;
Verification of subprocessor security compliance (e.g., SOC 2 and ISO/IEC 27001 certifications); and
Adherence to Section 48 and 49 of the Kenya Data Protection Act, 2019 governing cross-border transfers.
13. Data Security & Technical Safeguards
We implement robust technical and organizational security measures (TOMs) designed to protect personal data from unauthorized access, alteration, disclosure, or accidental destruction:
Strict Multi-Tenant Isolation: Data records are scoped at the application and database query layer by companyId, preventing cross-tenant leakage;
Granular Role-Based Access Control (RBAC): Over 400 permission checks enforce principle-of-least-privilege boundaries between roles;
Transport Security: All data transmitted over public networks is encrypted using Transport Layer Security (TLS 1.2 and TLS 1.3);
Storage Security: Passwords hashed with bcrypt; uploaded employee contracts, IDs, and payslips securely stored in private Cloudflare R2 buckets;
Session Protection: Revocable JWT session architecture allowing administrators and users to invalidate compromised sessions immediately;
Audit Logging: Immutable database audit logs record significant administrative and data modification events; and
Rate Limiting: IP-based rate limiting on sensitive API routes prevents brute-force credential stuffing.
Security Disclaimer: While we implement industry-standard safeguards, no Internet transmission or electronic storage method is completely immune to risk. We encourage users to maintain strong, unique passwords and protect their login credentials.
14. Data Retention & Deletion
We retain personal data only for as long as necessary to fulfill the operational purposes for which it was gathered, comply with statutory obligations, and resolve disputes.
14.1 Configurable Tenant Retention Schedules
Staffluma's backend architecture provides configurable retention settings for customer organizations:
Audit Logs: Default retention of 365 days;
User Login History: Default retention of 365 days;
Export Archives: Automatically pruned after 90 days; and
Deletion Request Grace Period: 30-day review period before processing.
14.2 Statutory Employment & Payroll Records
Under Kenyan employment law and tax legislation (including the Employment Act, 2007 and Tax Procedures Act), employers are legally obligated to retain wage, payroll, tax deduction, and employment records for minimum statutory periods (typically 5 to 7 years). In our capacity as a data processor, we maintain these records on behalf of customer organizations until instructed otherwise in accordance with their legal obligations.
14.3 Legal Hold & Deletion Workflows
Staffluma supports administrative legal holds that suspend scheduled record deletion during active investigations or legal disputes. When account termination occurs, customer data is deleted or anonymized following the contractual transition period.
15. Individual Privacy Rights
Depending on your jurisdiction and the nature of our relationship with you, you have established privacy rights under the Kenya Data Protection Act, 2019, the GDPR, and comparable privacy frameworks:
Right to be Informed
Right to transparent information about how your personal data is collected and processed.
Right of Access
Right to request confirmation and a copy of the personal data held about you.
Right to Rectification
Right to require correction of inaccurate, incomplete, or outdated personal information.
Right to Erasure
Right to request deletion of personal data where retention is no longer legally justified.
Right to Object
Right to object to processing based on legitimate interests or for direct marketing.
Right to Restriction
Right to request restriction of processing while a contest or dispute is investigated.
Right to Data Portability
Right to receive your data in a structured, commonly used machine-readable format.
Right to Withdraw Consent
Right to withdraw consent at any time where processing was grounded on consent.
15.1 How to Exercise Your Rights
For Workforce Data: If you are an employee, contractor, or applicant whose data is controlled by a customer organization, please submit your request directly to your employer's HR or privacy department.
For Direct Interactions with Staffluma: If your inquiry relates to our marketing website, sales communications, or administrative account data, contact us at [email protected], or submit a request on our public Account and Data Deletion page.
Right to Lodge a Complaint: You also have the right to lodge a formal complaint with your supervisory data protection authority:
In Kenya: Office of the Data Protection Commissioner (ODPC), Website: https://www.odpc.go.ke
In the European Economic Area: Your national Data Protection Authority (DPA).
16. Employer & Administrator Responsibilities
Customer organizations that use Staffluma act as Data Controllers for their workforce information and bear specific compliance obligations:
Providing fair processing and privacy notices to their workers before collecting personal data;
Establishing a verified lawful basis for processing employee and applicant records;
Ensuring prompt revocation of access privileges when employees or administrators resign or change roles;
Reviewing and configuring appropriate data retention schedules matching statutory legal periods;
Responding to data subject access and deletion requests submitted by their personnel; and
Ensuring workforce and payroll data uploads comply with applicable employment and labor regulations.
17. Recruitment & Applicant Privacy
When candidate applications are submitted through Staffluma's recruitment module:
Applicant data is accessible only to designated hiring managers and interview panelists for the specific role;
Interview notes, candidate scorecards, and assessment records remain private to the hiring organization;
Staffluma processes applicant records exclusively on instructions from the hiring organization; and
Retention of unhired candidate CVs is governed by the hiring organization's recruitment retention policies.
18. Children's & Dependents' Privacy
Staffluma is an enterprise B2B platform designed for business operations and adult professionals. We do not knowingly market to or solicit data from children under the age of 18.
Dependent & Beneficiary Information: When an employer maintains records relating to employee dependents or children (e.g., for statutory health insurance coverage, pension beneficiaries, or emergency contacts), the employer is responsible for ensuring appropriate parental/guardian consent and legal authorization in accordance with Section 33 of the Kenya Data Protection Act, 2019 and applicable child privacy protections.
19. Mobile Application Privacy
Our official mobile application (com.staffluma.mobile) provides authenticated employee and manager self-service on iOS and Android devices:
Device Storage & Keychain: Session authentication tokens are stored securely in the encrypted operating system keychain (iOS) or Android KeyStore/EncryptedSharedPreferences usingexpo-secure-store.
Camera & Document Access: Accessed only when a user actively chooses to take a photo for an expense receipt, upload a profile avatar, or attach a document.
No Continuous GPS Tracking: The mobile app does not harvest or track real-time background location telemetry. Department location fields represent organizational branch addresses, not device tracking coordinates.
Push Notifications: An in-app notification center is built into the platform. Remote push notification delivery will operate on explicit user opt-in when configured.
App Store Compliance: Our mobile privacy practices conform to Apple App Store Guideline 5.1 and Google Play Developer Program policies.
Account & Data Deletion: Instructions for requesting deletion of a Staffluma account or associated personal data—including for Google Play reviewers—are published at https://staffluma.com/data-deletion. No sign-in is required to view that page or submit a deletion request form.
20. Third-Party Integrations
Customer organizations may choose to connect Staffluma with third-party software products (e.g., corporate email systems, calendar providers, single sign-on identity providers, or accounting platforms). When integrations are enabled, data exchanged between Staffluma and third-party systems is governed by the terms and privacy policies of the respective providers.
21. Business Transfers
In the event of a merger, acquisition, corporate reorganization, asset sale, or bankruptcy, customer and platform information may be transferred as part of the business assets. Any successor entity will continue to be bound by the commitments set out in this Privacy Policy.
22. Data Breaches & Security Incidents
Staffluma maintains operational incident response protocols to detect, investigate, and contain security incidents:
In the event of a confirmed personal data breach affecting customer records, Staffluma will notify affected customer organizations without undue delay following confirmation;
Notifications will provide available details on the nature of the breach, affected categories of data, and mitigation measures implemented; and
Staffluma will assist customers in satisfying their statutory breach notification obligations to regulatory authorities (such as the ODPC under Section 43 of the KDPA 2019) and affected data subjects.
23. Changes to This Privacy Policy
We may revise this Privacy Policy periodically to reflect changes in our legal obligations, software capabilities, or operational practices. When material updates are made, we will revise the "Last Updated" date at the top of this page. Significant changes will also be communicated through administrative dashboard announcements or email notices.
24. Contact Us & Governance Inquiries
If you have questions about this Privacy Policy, wish to exercise privacy rights regarding direct communications, or require legal compliance clarification:
Staffluma Platform Operations · Verified corporate registration dossier, official registered agent, and physical address records are maintained on file with corporate counsel.
25. Jurisdiction-Specific Notices (Kenya & EEA)
25.1 Notice for Residents of Kenya
For processing subject to the Kenya Data Protection Act, 2019 (KDPA) and Data Protection (General) Regulations:
Principles of Data Protection: Personal data is processed in accordance with Section 25 principles (lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity/confidentiality);
Commercial Use Prohibition: Under Section 37, personal data will not be used for commercial marketing without explicit opt-in consent;
ODPC Oversight: Individuals have the right to lodge complaints with the Data Commissioner at the Office of the Data Protection Commissioner (ODPC) in Nairobi, Kenya.
25.2 Notice for EEA and UK Data Subjects
To the extent GDPR or UK GDPR applies to processing activities:
Staffluma processes European personal data primarily under contractual necessity and legitimate interests;
Data subjects may exercise rights under Articles 15 through 22 of the GDPR; and
You have the right to lodge a complaint with your competent supervisory authority in your EU Member State of residence or the UK Information Commissioner's Office (ICO).