EMPLOYEE PRIVACY NOTICE

1. Introduction

Techsavanna Company Limited (“the Company”) is committed to protecting the privacy and security of the personal data of its employees and other related personnel.

This Employee Privacy Notice (“Notice”) explains how the Company collects, uses, stores, discloses and otherwise processes personal data through its human resources and payroll processes, including through the Savanna360 HR & Payroll system (“the System”).

The System is intended to support the Company's HR and payroll administration and will contain employee profiles and contracts, attendance and leave records, payroll and bank details, performance information and other HR-related documents.

This Notice is intended to be read together with the Company's employment policies, employee handbook, information security policies and other applicable internal policies.

2. Who is responsible for an employee’s personal data

The Company is responsible for determining the purposes for which employee personal data is processed through the System and related HR processes. The Company engages third-party service providers to host, maintain or support the System or otherwise process employee personal data on its behalf, such providers may process personal data subject to appropriate contractual, confidentiality and data protection obligations.

3. Personal data we collect

Depending on the employee’s employment and the services provided through the System, the Company shall collect and process the following categories of personal data:

3.1 Employee profile and identification information

This includes employee’s full name, Identification or passport details, date of birth, contact details, residential or postal address, nationality where required, emergency contact and next-of-kin details, employee number, and other information necessary for employee identification and administration.

3.2 Employment information

This includes employment contracts, job title and department, employment commencement date, qualifications and professional information, employment history, performance information, training and development records, disciplinary and grievance records, and other HR documents relating to the employment.

3.3 Attendance and leave information

The System contains information relating to attendance, working hours, leave applications and approvals, absence records, and other information necessary for workforce administration.

3.4 Payroll and financial information

The Company may/shall process salary and remuneration information, allowances and benefits, statutory deductions, tax-related information, bank account details, payroll records, expense and reimbursement information, and pension, insurance and other employee benefit information.

3.5 Perfomance information

This includes information relating to performance reviews, objectives and targets, appraisals, feedback, training needs, and other information relevant to performance and employee development.

3.6 Sensitive personal data

Where necessary and permitted by applicable law, the Company may process employee’s sensitive personal data, including health or medical information, for purposes such as sick leave, occupational health and safety, employee benefits, insurance and workplace accommodation. Access to sensitive personal data will be restricted to authorised persons who have a legitimate need to access it.

4. How we collect an employee’s personal data

The Company may collect personal data directly from the employee during recruitment, onboarding and employment, through update on the employee profile, through HR and payroll processes, through an employee’s use of the System, the employee’s managers or authorised HR personnel, benefits, insurance or payroll service providers, government or statutory authorities where applicable and from other lawful sources where necessary for employment administration.

5. Why we process an employee’s personal data

The Company processes an employee’s personal data for the following purposes:

• Creating and maintaining your employee profile;
• Administering your employment contract;
• Managing attendance and leave;
• Processing salary, payroll and statutory deductions;
• Administering employee benefits, insurance and pension arrangements;
• Managing performance and employee development;
• Maintaining employment and HR records;
• Managing disciplinary and grievance processes;
• Communicating with employees regarding employment matters;
• Complying with applicable employment, tax and other legal obligations;
• Maintaining workplace security and information security;
• Administering access to Company systems and facilities;
• Investigating suspected misconduct, fraud or security incidents;
• Establishing, exercising or defending legal claims; and
• Carrying out other legitimate HR and business functions connected with your employment.

6. Lawful basis for processing

The Company will process employee personal data on an appropriate basis under applicable data protection law. Where processing is based on consent, an employee may withdraw their consent subject to applicable law. Withdrawal of consent will not affect processing carried out before withdrawal.

7. Information required for employment

Certain personal data is necessary for the Company to administer an employee’s employment and comply with applicable legal and statutory requirements. This includes information required for payroll, taxation, statutory contributions, benefits, attendance, leave and other employment-related documents.

Where particular information is mandatory, failure to provide it may prevent the Company from being able to provide a particular employment-related service or fulfil a legal obligation.

8. Savanna360 Hr & Payroll System

The System will be used as part of the Company’s HR and payroll processes. The System contains employee profiles and contracts, attendance records; leave records, payroll information, bank details, performance information, and other HR documents.

Access to the System will be controlled according to the user/employee’s role and responsibilities. Employees, HR personnel, managers, payroll personnel, system administrators and other authorised users may have different levels of access depending on their legitimate responsibilities.

Employees must not access, disclose, copy or use another employee's personal data unless they are authorised to do so.

9. Disclosure to third parties

Where necessary and lawful, the Company may disclose employee personal data to Government and statutory authorities, tax and regulatory authorities, banks and payment service providers, insurance and benefits providers, pension administrators, payroll and HR service providers, IT hosting and technical support providers, professional advisers, including lawyers and auditors, entities within the Company's corporate group, and courts, law enforcement agencies or other competent authorities where disclosure is legally required.

Third parties processing personal data on behalf of the Company will be required, where applicable, to comply with appropriate confidentiality and data protection obligations.

10. Hosting and international transfers

The System and related HR services may involve the storage, hosting or processing of personal data by third-party service providers. Where employee personal data is transferred or accessed outside Kenya, the Company will take appropriate steps to ensure that the transfer or access is undertaken in accordance with applicable data protection requirements. Further information regarding the hosting arrangements, relevant service providers and applicable safeguards may be obtained from the Company's Data Protection Officer/Privacy Contact.

11. Data security

The Company will implement reasonable technical and organisational measures to protect employee personal data against unauthorised access, loss, alteration, disclosure, destruction or other unlawful processing.

These measures includes role-based access controls, user authentication, access restrictions, confidentiality obligations, system security controls, appropriate backup and recovery measures, and procedures for responding to suspected data breaches. Employees are also responsible for protecting their login credentials and must not share passwords or provide unauthorised persons with access to the System.

12. Data retention

The Company will retain employee personal data for as long as reasonably necessary for the purposes for which it was collected and processed, and at a minimum duration demanded by prevailing statutory laws and the Company policies. Personal data may also be retained where necessary to maintain employment records, resolve disputes, establish or defend legal claims, meet accounting or audit requirements or maintain appropriate business records in accordance with the Company’s policies.

When personal data is no longer required, The Company will take reasonable steps to securely delete, destroy or anonymise it in accordance with applicable retention requirements and the Company's data retention policies.

13. Employee rights

Subject to applicable law, an employee has the right to be informed about how their personal data is being processed, request access to personal data held about them, request correction of inaccurate or incomplete personal data, request deletion of personal data where legally applicable, request restriction of processing in applicable circumstances, withdraw consent where processing is based on consent and exercise other rights available under applicable data protection law. Requests relating to an employee’s personal data should be submitted to the Company’s Data Protection Officer and/or HR Manager.

14. Requests and complaints

In the event an employee has a question, concern or complaint regarding the processing of their personal data, they should contact the HR Manager. The Comp[any will consider and respond to requests in accordance with applicable law and its internal procedures. Where an employee remains dissatisfied, they may exercise any available statutory right to make a complaint to the relevant data protection regulator.

15. Personal data breaches

The Company maintains procedures for identifying, assessing and responding to personal data breaches. Where a personal data breach occurs, the Company will take appropriate steps to contain and investigate the incident and make any notifications required by applicable law.

16. Changes to this notice

The Company may update this Notice from time to time to reflect changes to the System, HR processes, applicable law or regulatory requirements, third-party service providers, data processing activities, or information security practices. Where appropriate, employees will be notified of material changes.