Privacy Policy

We collect the following categories of personal data:

- Account data: your name, email address, phone number and password.
- Job seeker profile data: personal details (headline, nationality, current location, date of birth where operationally required), career preferences, work experience, education history, skills, languages and certifications.
- Documents: CVs/resumes, certificates, recommendation letters, professional licences and, only when specifically required for a legitimate recruitment stage, identity or passport copies.
- Employer data: company name, registration and contact details, industry, physical address and manpower requirements submitted to us.
- Application and communication data: jobs you apply for, application status history, messages exchanged with our recruitment team, and enquiry or contact form submissions.
- Technical data: IP address, browser type, device information and website usage data collected through cookies and similar technologies (see our Cookie Notice).

We collect personal data directly from you when you create an account, complete your profile, upload documents, apply for a vacancy, submit a manpower request, or contact us. We also collect limited technical data automatically when you use the Platform, for example through server logs and cookies.

We use personal data to:

- Create and manage your job seeker or employer account.
- Match candidates to relevant vacancies and process job applications.
- Communicate with you about your application, account, or a manpower request, including status updates and interview arrangements.
- Verify employer identities and the authenticity of manpower requests.
- Respond to enquiries submitted through our contact form.
- Maintain the security of the Platform, prevent fraud and investigate suspicious activity.
- Meet our legal, regulatory and record-keeping obligations.
- Improve our services, content and user experience.

We do not use your CV, profile, or application data for automated decision-making that produces legal or similarly significant effects on you without human involvement.

We process personal data on the following legal bases, consistent with Kenya's Data Protection Act, 2019: your consent (for example, when you register or upload optional documents); the necessity of processing to perform our recruitment services to you as a contract; our legitimate interests in operating and securing the Platform and preventing fraud; and compliance with legal obligations we are subject to.

We share job seeker information with a prospective employer only in connection with a vacancy you have applied for, or a request that employer has raised with us, and only to the extent necessary to progress that specific recruitment process. We may also share personal data with trusted service providers who support our operations (such as hosting, email delivery and IT support) under confidentiality obligations, and with regulators, government authorities, or law enforcement where required by law. We do not sell your personal data to third parties.

Because Kongato supports recruitment for opportunities outside Kenya, your information may need to be shared with prospective employers, their authorised agents, or government agencies in the destination country as part of a genuine recruitment or deployment process you have applied for. Where personal data is transferred outside Kenya, we take reasonable steps to ensure it continues to receive an appropriate level of protection, consistent with the requirements of the Data Protection Act, 2019.

We retain personal data for as long as your account is active, or as needed to provide our services, resolve disputes, meet legal or regulatory obligations, and for legitimate business record-keeping. When data is no longer needed for these purposes, we take steps to securely delete or anonymise it, subject to any retention periods required by law.

We apply technical and organisational measures designed to protect your personal data, including restricting staff access to candidate documents on a need-to-know basis, storing sensitive documents outside publicly accessible storage, encrypting passwords, and logging access to sensitive administrative actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, including the Data Protection Act, 2019, you have the right to: be informed of how your data is used; access the personal data we hold about you; request correction of inaccurate or incomplete data; request deletion of your data where it is no longer needed for the purpose it was collected; object to or restrict certain processing; and request a copy of your data in a portable format. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya. To exercise any of these rights, contact us using the details in Section 12 below.

Our services are intended for individuals who are legally permitted to work under Kenyan law and the law of any relevant destination country. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

We use cookies and similar technologies to operate the Platform and, where enabled, to understand how it is used. Details of the cookies we use and how to manage them are set out in our Cookie Notice.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last updated. If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us through our Contact page or by email.