DATA RETENTION, HOSTING, AND THIRD-PARTY PROVIDER IT OPERATIONAL POLICY
FOR
TECHSAVANNA COMPANY LIMITED
(Hereinafter referred to as “the Company”)
Dated 06.09.2026
| APPROVED BY | EFFECTIVE DATE AND VALIDITY |
|---|---|
1. Scope
This Policy establishes the corporate requirements and controls governing the lifecycle management, retention, hosting, infrastructure environments, security, and third-party service arrangements applicable to Techsavanna Company Limited (hereinafter “the company”) HR and Payroll systems and related data repositories.
The Policy applies to all employees, officers, contractors, system administrators, information technology personnel, data protection and legal compliance personnel, and third-party service providers who access, administer, host, process, transmit, or otherwise handle HR and Payroll data on behalf of the Company.
It covers the collection, storage, use, retention, archival, transfer, disclosure, deletion, and secure disposal of HR and Payroll data throughout its lifecycle, including data maintained in production, backup, archival, cloud, and other authorised storage environments.
2. Corporate data retention architecture
To ensure compliance with applicable international data protection standards and national statutory requirements, the System shall apply defined and documented data retention periods based on the purpose for which personal data is collected and processed. Personal data relating to employees and other data subjects shall not be retained for longer than is reasonably necessary to fulfil the relevant lawful purpose, satisfy applicable statutory or regulatory obligations, or establish, exercise or defend legal claims. Upon expiry of the applicable retention period, the relevant data shall be securely deleted, erased, anonymized or otherwise rendered inaccessible, subject to any applicable legal hold or continuing lawful basis for retention.
| Data Category / Scope | Retention Period | Automated Post-Retention Action |
|---|---|---|
Payroll records, compensation and statutory tax filings | 5 years after finalisation of the relevant financial year | Secure deletion through cryptographic erasure, including deletion of associated metadata and system copies, subject to any applicable legal hold or statutory retention requirement. |
Active employee contracts and core employee profiles | 3 years after termination or expiry of the employment relationship | Secure and irreversible deletion of the employee profile, associated documents and archived copies, subject to any applicable legal hold or statutory requirement. |
Attendance, shift, overtime and leave records | 3 years after the end of the calendar year to which the records relate | Automated deletion from active and archival storage environments, subject to applicable legal holds or retention requirements. |
Internal performance evaluations and appraisals | 3 years from the date of creation/completion of the relevant evaluation | Secure deletion or, where required for legitimate statistical or organisational purposes, irreversible anonymisation so that the information can no longer be linked to an identifiable employee. |
Unsuccessful job applicant digital dossiers | 1 year after the final recruitment decision | Automated deletion of applicant profiles, application materials and associated attachments, unless the applicant has consented to a longer retention period or a longer period is otherwise permitted or required by law. |
3. Enterprise infrastructure & cloud hosting mandates
3.1. Data residency and cross-border transfers
The Company shall ensure that all HR and Payroll data is hosted, stored and processed only through infrastructure and service environments that are approved in accordance with applicable data protection and other relevant legal requirements. Where HR or Payroll data is hosted, accessed, transferred or otherwise processed outside Kenya, such processing shall only be undertaken where permitted by applicable law and subject to appropriate contractual, legal, security and data protection safeguards.
The Company shall maintain adequate records identifying the location of material data repositories and the jurisdictions in which relevant third-party service providers operate. No transfer of personal data to another jurisdiction shall be undertaken in a manner that would expose the Company to a breach of applicable data protection or confidentiality obligations.
3.2. Compliance and Independent Assurance
Any third-party provider engaged to host, store, process or otherwise handle HR and Payroll data shall be required to maintain appropriate information security and data protection standards commensurate with the nature and sensitivity of the data entrusted to it.
Where applicable to the services provided, the Company shall require appropriate independent assurance of the provider's information security controls, including recognised certifications or independent audit reports such as ISO/IEC 27001 and SOC 2 Type II. Such assurance shall be reviewed periodically and shall form part of the Company’s ongoing due diligence and third-party risk management processes.
The engagement of any provider shall be subject to appropriate contractual provisions addressing confidentiality, data protection, security, permitted processing, subcontracting, data location, incident notification, audit or assurance rights, data return and deletion, and termination of services.
3.3. Protection of Data
The Company shall ensure that HR and Payroll data is protected by appropriate technical and organisational measures against unauthorised access, alteration, disclosure, loss, destruction or other unlawful or unauthorised processing.
Personal data shall be encrypted during storage and transmission using appropriate industry-recognised security standards. Access to encryption credentials and other security controls shall be restricted to authorised persons and managed in accordance with the Company’s information security requirements.
The Company shall periodically review the adequacy of its security measures having regard to the nature and sensitivity of HR and Payroll data, the risks associated with its processing, applicable legal requirements and recognized industry standards.
3.4. Availability, business continuity and data recovery
The Company shall ensure that appropriate arrangements are maintained to support the continued availability and recoverability of the HR and Payroll system and the data processed through it.
Where such arrangements are provided by a third-party service provider, the applicable service agreement shall establish appropriate service availability and business continuity obligations, including a target service availability of not less than 99.9%, subject to expressly agreed exclusions and service conditions.
The Company shall maintain appropriate backup and recovery arrangements for HR and Payroll data, including secure and appropriately segregated backup copies. Such arrangements shall be designed to minimise the risk of permanent loss, corruption or unauthorised destruction of data.
The Company shall maintain a recovery time objective of no more than four (4) hours and a recovery point objective of no more than twenty-four (24) hours, or such more stringent requirements as may be imposed by applicable law, contractual obligations or the Company’s risk assessment.
Backup and recovery arrangements shall be periodically reviewed and tested to establish their effectiveness, and any material deficiencies identified shall be addressed within a reasonable period.
3.5. Regulatory and Contractual Compliance
All infrastructure, hosting and service-provider arrangements relating to the HR and Payroll ecosystem shall at all times remain subject to applicable Kenyan data protection, employment, tax, cybersecurity, confidentiality and other relevant legal requirements.
Where a conflict arises between this Policy, a contractual obligation and an applicable legal or regulatory requirement, the Company shall comply with the applicable legal or regulatory requirement and shall take appropriate steps to amend the relevant contractual or internal arrangements where necessary.
4. Third-party provider procurement & DPA mandate
4.1. Mandatory data processing agreement
No third-party software provider, cloud service provider, SaaS provider, or other service provider that processes, stores, accesses or otherwise handles HR and Payroll data on behalf of the Company shall be engaged without a duly executed Data Processing Agreement (DPA) or equivalent contractual provisions that comply with applicable data protection laws. The DPA shall clearly define the subject matter and duration of processing, the nature and purpose of processing, the categories of personal data and data subjects involved, and the respective rights and obligations of the Organisation and the service provider.
4.2. Limitation on processing and use of data
The service provider shall process HR and Payroll data solely for the purposes authorised by the Company and specified in the relevant agreement or other lawful instructions. The service provider shall not, except where expressly authorised by the Company and permitted by law:
- sell, licence, monetise or otherwise commercially exploit HR and Payroll data;
- use the data for targeted advertising or unrelated profiling;
- monitor or analyse employee behaviour for purposes unrelated to the contracted services; or
- combine the Company’s data with data belonging to other customers in a manner that compromises confidentiality, purpose limitation or the rights of data subjects
The service provider shall not process HR and Payroll data for any purpose inconsistent with the Company’s lawful instructions or applicable data protection requirements.
4.3. Sub-processors
The service provider shall not appoint, replace or materially change any sub-processor that will process HR and Payroll data without providing the Company with at least thirty (30) days' prior written notice.
The Company shall have the right to object, on reasonable data protection, confidentiality or security grounds, to the appointment or replacement of a proposed sub-processor within the applicable notification period.
The service provider shall remain responsible for ensuring that every authorised sub-processor is bound by written contractual obligations providing a level of data protection, confidentiality and security equivalent to those imposed upon the service provider under the DPA.
No sub-processor shall process HR and Payroll data except in accordance with the Company’s lawful instructions, the DPA and applicable law.
4.4. Personal data breach notification
The service provider shall notify the Company without undue delay and, in any event, within twenty-four (24) hours of becoming aware of or reasonably suspecting a personal data breach affecting HR or Payroll data.
The notification shall, to the extent reasonably available at the time, provide sufficient information concerning the nature of the breach, the categories and approximate number of affected data subjects and personal data records, the likely consequences of the breach, and the measures taken or proposed to contain, mitigate and address the breach.
The service provider shall promptly cooperate with the Company in investigating, containing and mitigating the breach and in fulfilling any notification or reporting obligations imposed upon the Company by applicable law.
4.5. Audit and compliance assurance
The Company shall have the right, upon reasonable notice and subject to appropriate confidentiality and security arrangements, to obtain information reasonably necessary to demonstrate the service provider's compliance with its contractual, security and data protection obligations.
The Company may require the service provider to provide current independent audit reports, security assessments, certifications or other appropriate evidence of compliance.
Where reasonably necessary, including where there are reasonable grounds to believe that the service provider is not complying with its contractual or data protection obligations, the Company may conduct or procure an appropriate audit or assessment of the service provider's processing activities.
The exercise of audit rights shall be undertaken in a manner that reasonably protects the confidentiality, security and legitimate operational interests of the service provider and its other customers.
4.6. Return, portability and erasure of data upon termination
Upon expiry or termination of the contractual relationship, the service provider shall, at the Company’s direction, return or securely delete all HR and Payroll data in its possession or under its control, except to the extent that continued retention is required or permitted by applicable law or is necessary for the establishment, exercise or defence of legal claims.
Where data is to be returned, the service provider shall provide it in a commonly used, structured and machine-readable format reasonably capable of facilitating the Company’s continued access to and use of the data or migration to another service provider.
Following completion of the applicable return or deletion process, the service provider shall, upon request, provide a written certificate or equivalent confirmation of deletion identifying the data subject to deletion and confirming completion of the applicable deletion procedures.
Where personal data remains in secure backup or archival systems because immediate deletion is technically impracticable or legally prohibited, such data shall:
- remain subject to the confidentiality, security and data protection obligations contained in the DPA;
- not be accessed, restored or otherwise processed except where required by law or reasonably necessary for legitimate disaster recovery purposes; and
- be securely deleted in accordance with the Company’s applicable data retention schedule and the service provider's agreed deletion procedures.
4.7. Continuing Obligations
Termination of the service provider's engagement shall not relieve the service provider of its obligations relating to confidentiality, data protection, security, breach notification, audit cooperation, return or deletion of data, or any other obligation which, by its nature, is intended to survive termination of the contractual relationship.
5. Review of the policy
This Policy shall be reviewed at least annually or earlier where there are material changes to, applicable laws or regulations, the Company’s systems or operations, data processing activities, technology infrastructure, material third-party service arrangements, or information security risks. The Company shall coordinate the review and recommend amendments to the appropriate approving authority.
6. APPROVAL
This Policy has been approved by the Company and shall take effect from the Effective Date stated above.
Approved by: __________________________
Name: ________________________________
Designation: ___________________________
Date: _________________________________