Privacy Policy
Last updated: 9 August 2026
ABITECH Kazi ("we", "us") is a staffing introduction service operated by ALF Holdings East Africa Limited (Company Reg. No. CPR/2012/90232), Ikigai Offices, Merchant Square, Riverside Drive, Nairobi, Kenya. We connect verified workers with employers in Nairobi, primarily over WhatsApp. This policy explains what personal data we collect, why, how long we keep it, and your rights under Kenya's Data Protection Act, 2019.
1. Who is responsible for your data
The data controller is ALF Holdings East Africa Limited, at the Nairobi address above. You can reach us on WhatsApp at +254 143 829 078 or by email at kazi@abitech.io. Registration as a data controller with the ODPC is in progress.
2. What we collect
- Workers: your name, WhatsApp number, the role you are looking for, your area in Nairobi, a short description of your experience (typed or as a voice note), and a photograph of your national ID for verification. For security roles we may also record a Guard Force Number and Certificate of Good Conduct.
- Employers: your business or household name, WhatsApp number, optional email for invoicing, the role(s) you need, headcount, location, and the monthly gross salary you offer.
- Payments: the amount, currency, payment reference, channel (M-Pesa) and the payer's phone number. We never see or store your M-Pesa PIN — you enter it on your own handset and it stays with Safaricom.
- Technical: standard message metadata needed to deliver the WhatsApp conversation.
3. Why we use it (purpose & legal basis)
- To verify workers and match them with suitable employers — performance of a service you requested.
- To contact you and run the placement conversation over WhatsApp — your consent, given when you message us.
- To issue invoices and take placement payments over M-Pesa — performance of a contract.
- To meet legal, tax and record-keeping obligations.
4. Who we share it with
We share a worker's relevant profile with a prospective employer only for the purpose of a specific placement, and only the details that employer needs. We use trusted processors to operate the service — Twilio (WhatsApp messaging), Safaricom M-Pesa (payments), and our own servers in Germany. We do not sell your personal data, and we do not share it for advertising.
5. Identity photographs — what happens to your ID
Short version: a person on our team looks at your ID photo once to confirm you are who you say you are. The image is then deleted. We keep only a record that the check was done, on what date and by whom. We do not ask you for your ID number and we do not store it.
Why we ask for it
Employers are inviting a stranger into their home or business. Verified identity is the single thing that makes that trust possible, and it is the reason our service exists rather than an open listings board.
What we never do
- We never ask you to hand over your physical ID card, and we never hold it as security.
- We never send your ID photograph to an employer. Employers see your name, role, area and experience.
- We never ask you for your ID number, and we do not store it in any form. We look at the photograph, and then we delete the photograph.
How long we keep the image
| Situation | What happens to the photograph |
|---|---|
| Your ID has been checked (approved or rejected) | Deleted from our messaging provider within 24 hours of the decision |
| Your ID has not been checked yet | Deleted automatically 30 days after you sent it, whether or not the check happened |
| You send STOP | Deleted immediately, along with your profile and conversation |
| You ask us to delete your data | Deleted immediately on request |
Deletion is automated and runs every day. After deletion, what remains is a note that a check took place, on what date, and by whom — which we are required to keep to show that our verification claims are true.
6. How long we keep everything else
- Worker profiles: for as long as you remain in our pool. Send STOP at any time and we deactivate the profile and delete your ID photograph and conversation.
- Voice notes: deleted on the same schedule as identity photographs. Where a member of our team has written your experience onto your profile as text — from your recording or from a call — that summary stays; the recording itself does not.
- Employer and placement records: kept while the relationship is active.
- Payment and invoice records: kept for seven years, as Kenyan tax and company law requires. These contain the amount, date and reference — not your card details.
7. Your rights
Under the Data Protection Act, 2019 you may ask us for a copy of the data we hold about you, ask us to correct or delete it, object to certain processing, ask us to restrict processing, or withdraw your consent. To exercise any right, reply STOP on WhatsApp, message us on the number above, or email kazi@abitech.io. We respond within 30 days. If you are not satisfied you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya.
8. Transfers outside Kenya
Our servers are located in Germany and some of our processors are based outside Kenya. Where personal data leaves Kenya we rely on the processor's contractual data-protection commitments and on the safeguards permitted by Part VI of the Data Protection Act, 2019.
9. Security
We restrict access to personal data to the people who need it, transmit it over encrypted connections, keep identity documents only for the period described in section 5, and do not collect ID numbers at all. Payment confirmations are verified cryptographically against the payment provider. No system is perfectly secure, but we take reasonable measures to protect your information and will tell you and the ODPC without undue delay if a breach affects you.
10. Children
Our service is for adults. We do not knowingly register anyone under 18, and we delete any profile we discover to belong to a minor.
11. Changes
We may update this policy; the "last updated" date above will change accordingly. If a change materially affects how we use your data, we will tell you on WhatsApp before it takes effect.