The KMRC Recruitment Privacy Statement describes how we collect, handle and protect your personal data in relation to our recruitment processes and programs. This Recruitment Privacy Statement only applies to the personal data of job applicants, potential candidates for employment or partnership, and those who participate and interact with our recruitment processes and programs. Your personal data is submitted directly to KMRC through our online recruitment portal.

A recruitment agency will on occasion handle our recruitment programs and in so doing will be acting as a data processor at our request and based on our instructions. KMRC and the recruitment agency will have signed a contract to secure and protect your rights under the Data Protection Act.

By submitting your personal data to us you shall be deemed to acknowledge that:

• You have read and understood this Privacy Statement and agree to the use of your personal data as set out herein.
• You are not required to provide any requested information to us, but your failure to do so may result in our being unable to continue with our evaluation of your application for the job you have applied for.
• All of your representations are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature. Providing any inaccurate information may make you ineligible for employment.
• This Privacy Statement does not form part of any contract of employment offered to candidates hired by KMRC.

Personal data to be collected

The type of personal data requested by KMRC in its recruitment exercise may vary depending on the role and position applied for. Personal data we may collect and process, as appropriate throughout the recruitment process will include, but is not limited to:

• name and contact details (such as telephone number, e-mail address and postal address);
• date of birth;
• KRA Personal Identification Number, proof or registration with NHIF and NSSF;
• curriculum vitae / résumé;
• current and previous employment details (including salary/bonus and employee benefits schemes);
• academic background (such as your university or school diplomas/certificates and other educational achievements);
• languages spoken and level of proficiency;
• gender;
• marital status;
• results of any pre-employment testing such as psychometric testing;
• evidence of identity such as national ID/passport/resident card;
• video, photographic images or audio recordings submitted or made as part of the recruitment process.
• criminal proceedings or convictions data including Ethics & anti-corruption related clearances;
• racial / ethnicity information;
• trade union and professional bodies memberships
• health related information including physical/mental health.

After KMRC makes an offer to you for employment, we may conduct a further background check and, to the extent permitted by applicable law, collect data related to criminal offences and proceedings from third parties, collect similar personal data about you from third parties, such as professional recruiting firms, your references, your alma mater, prior employers, and employment background check providers. We may also collect personal data about you online to the extent that you have chosen to make this information publicly available.

Purpose for collection of personal data

We collect and use your personal data for legitimate human resources and business management reasons, including:

• identifying and evaluating candidates for potential employment, as well as for future roles that may become available;
• maintaining records in relation to recruiting and hiring;
• ensuring compliance with legal requirements, including those relating to public health and workplace safety;
• carrying out criminal record checks and pre-employment searches with a credit reference agency, where applicable laws permit with your consent;
• protecting our legal rights to the extent authorized or permitted by law;
• where you are offered the position, verifying the Personal Data provided including your identity, address, right to work, employment history and academic background and other background screening purposes including, where allowed by law, criminal record checks, searches with a credit reference agency and sanctions screening checks; and
• protecting the workplace and communicating with medical professionals, law enforcement, or other public authorities in the event of an emergency or public health event, such as when the health or safety of you or one or more individuals may be endangered, including, to the extent permitted by applicable law, sharing data about the status of an infection, test results, and vaccination status.

We may also use your personal data for analytics purposes, including in aggregated/anonymized form, to improve our recruitment and hiring process and augment our ability to attract successful candidates

How we collect your personal data

We collect personal data through the following channels:

1. career websites– We collect your Personal Data when you submit a job application and/or create a profile through our Careers website/portal or approved third party websites
2. recruitment agencies– Your Personal Data may be shared with us by recruitment agencies with whom you have registered an interest in working for KMRC. Where a recruitment agency refers you to us, a profile will be created for you in our recruitment database based on the information provided.
3. Social network sites– we may collect your personal data from social media channels such as LinkedIn when you choose to provide us with a link to your profile as part of your job application. KMRC also uses various social media channels and job boards to advertise and communicate open opportunities. If you sign-in to our recruitment system through a social media channel, or job board where the functionality allows, KMRC may use the content of your Job Board application.
4. Other sources– your Personal Data may also be collected from third parties during the recruitment process, such as references from previous employers.

Legal basis for processing your data

The processing of your personal data in line with the reasons disclosed herein above shall be based on:

Parties with whom we may share your data

Your personal data will be shared with individuals involved in the recruitment and interview process. These individuals will either be the KMRC Board of Directors or senior management depending on the position applied for. Where third/ external parties are involved in the recruitment process, they shall do so as data processors under instructions from KMRC and with contracts in place to ensure confidentiality and safeguard you right to privacy.

KMRC may from time to time receive technical assistance from its partners which may result in the recruitment of personnel to support the company. In such instances, KMRC may share your personal data with the specific partner for additional evaluation based on any underlying MOU. KMRC will however disclose the same on its recruitment portal and require your consent for the transfer of your personal data to the partner. Additionally, KMRC is licenced by the Central Bank of Kenya and may submit your personal data to the regulator to enable the conduct of its Fit and Proper exercise in line with the law.

We may also share your personal data with third-party service providers that may assist us in identifying and recruiting talent, administering and evaluating pre-employment screening and testing, and improving our recruiting practices including criminal records bureaus, Credit reference agencies and regulatory entities.

Except to the extent described and for the purposes stated in this Privacy Statement, we do not disclose your personal data to third parties. We prohibit our service providers from using your personal data for any Purpose auxiliary to those disclosed herein and stipulated in our instructions. We do not otherwise share or sell your personal data to third parties.

How long do we retain your data

Should you be offered the position applied for at the end of the recruitment process, the personal data collected during your pre-employment period will form part of your personnel records and will be retained for the duration of your employment and thereafter as prescribed by the Employment Act and other laws applicable to KMRC.

We may nevertheless continue to retain and use your personal data, in instances where we you are unsuccessful in your application, for a period of time for system administration purposes, to consider you for potential future roles, and thereafter in an aggregated/ anonymised form for research purposes.

We may remain in contact with you and consider you for future employment opportunities. In such an event, we will seek your consent to include you in one of our recruiting programs that provides you ways to inform you of any job opportunities at KMRC. Participation in these recruiting programs is entirely optional.

Your rights

In accordance with the Constitution of Kenya, the Data Protection Act and any other applicable law, KMRC recognises and protects your rights as detailed below:-

• a right to request information about the personal data we hold about you, including the details of how we use that information and who we share it with
• a right to request a copy of the personal data that we hold about you;
• a right to amend or rectify your personal data if any of the information held about you is incorrect or out of date;
• a right to portability of your personal data;
• a right to request erasure of your personal data;
• a right to demand that we cease the processing of your personal data or that we restrict the processing of your personal data;
• a right to withdraw your consent to the processing of your personal data, to the extent our processing relies on your consent as the lawful basis for processing. This right may not apply if there are other legal justifications to continue processing or we need to retain certain personal data where required or permitted under applicable law; and/or
• a right to provide us with instructions as to the processing of your personal data in case of death.

To help protect your privacy and security, we will take reasonable steps to verify your identity before granting you access to your personal data. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by law. Depending on the circumstances and the request, we may not be permitted to provide access to personal data or otherwise fully comply with your request; for example, where producing your information may reveal the identity of someone else. We reserve the right to charge an appropriate fee for complying with your request where allowed by applicable law, and/or to deny your requests where, in our discretion, they may be unfounded, excessive, or otherwise unacceptable under applicable law.

Automated decision making and profiling

KMRC uses diverse assessment tools throughout its recruitment process which may include aptitude tests or behavioural assessments, such as situational judgement tests. How you perform on these assessments may determine your progression to the next stage of the recruitment process. Data analytics and algorithms may from time to time be used to review applications. These algorithms help us prioritize the application review process and sort candidates based on professional characteristics that suggest strengths and capabilities necessary to perform the relevant role. The algorithms are designed to analyse the candidate’s application data and compare it to the job description and qualifications requested for the position. Any automated results will be considered in tandem with, and not in lieu of, human judgement. We evaluate each individual candidate on their own merits.

This Recruitment Privacy Statement does not apply to any processing of your Personal Data carried out by or on behalf of any third-party websites where our recruitment advertisements are displayed or to linked third-party websites that we not operate or control.

If you have questions about this Privacy Statement, or if you wish to exercise your privacy rights, please contact us through info@kmrc.co.ke. Attention: Data Protection Office.