This policy explains what personal data EOR Kenya collects, why we collect it, and the rights you have. It applies to this website and to our services.
Last updated: January 2026
EOR Kenya provides Employer of Record, payroll and benefits services in Kenya. When we act as the employer of record for your staff, we process employee personal data as part of delivering that service. In this policy, "we" and "us" mean EOR Kenya.
We collect information you give us directly and information generated when you use our site or services, including:
We use personal data to respond to enquiries, provide and administer our services, run compliant payroll and remit statutory deductions, administer benefits and work injury cover, meet legal and regulatory obligations in Kenya, and improve our website. We process employee data on the documented instructions of the client for whom we act as employer of record, alongside our own legal duties as the legal employer.
We process personal data where it is necessary to perform a contract, to comply with a legal obligation, to protect a legitimate interest that is not overridden by your rights, or with your consent. Where consent is the basis, it must be express, informed and freely given, and you may withdraw it at any time, although this may prevent us from continuing to provide the service.
We share personal data only where needed to deliver the service: with the Kenya Revenue Authority, the National Social Security Fund, the Social Health Authority and the National Industrial Training Authority; with banks and mobile money providers for salary payment; with insurers and administrators for medical, life and work injury cover; and with registered pension schemes. We require our processors to protect personal data to a comparable standard. We do not sell personal data.
Our handling of personal data is governed by the Data Protection Act 2019, which is enforced by the Office of the Data Protection Commissioner. The Act follows the broad structure familiar from European data protection law, and it is actively enforced, with the Commissioner having issued penalty notices against organisations that mishandle personal data. Data controllers and processors falling within the prescribed thresholds must register with the Commissioner.
Under the Act, data subjects have rights of access, rectification, erasure, objection and, in defined circumstances, portability, along with rights in relation to automated decision making. Transfers of personal data outside Kenya require an appropriate basis, such as adequate safeguards or the data subject's consent, and certain categories of data carry additional handling requirements. Where processing is likely to result in a high risk, a data protection impact assessment is required. Where a personal data breach occurs, the controller must notify the Commissioner within seventy two hours where the risk threshold is met, and must inform affected data subjects without undue delay where there is a real risk of harm.
We keep personal data only as long as needed for the purposes described here or as required by Kenyan law. Employment, payroll and tax records are retained for the periods set by the applicable legislation. Enquiry data that does not lead to an engagement is held for a limited period and then deleted.
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. Identity, payroll and banking data is treated as sensitive, and access is restricted to staff who need it to deliver the service.
You may ask us to access, correct or delete your personal data, object to processing, or withdraw consent. To make a request, email us at the address below. We may need to verify your identity before acting on a request. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner.
Our site uses only the cookies needed to function and to understand basic, aggregated usage. You can control cookies through your browser settings.
For any privacy question or request, including to reach the person responsible for data protection, contact us at hello@eorkenya.com. If we materially change this policy, we will update the date above.