Last updated: August 10, 2026
HomeCrew is operated by Digital Cloud Bytes, registered in Kenya. This policy explains what personal data we collect, why we collect it, and how we protect it — in compliance with Kenya's Data Protection Act, 2019.
1. Who This Policy Applies To
This policy applies to:
- Agency administrators who sign up and manage the platform.
- Staff members whose employment records are managed through HomeCrew.
- Client contacts at companies where staff are placed.
- Visitors to our website at jijenge.digitalcloudbytes.org.
2. Data We Collect
Account & agency data:
- Organisation name, admin email address, and phone number.
- Login credentials (passwords stored as bcrypt hashes — we never store plaintext passwords).
Staff employment data:
- Full name, national ID number, date of birth, gender, contact details, and address.
- Employment records: assignments, contracts, placement history, and reliever requests.
- Payroll data: salary, NHIF number, NSSF number, PAYE, advances, and expense claims.
- Performance reviews and disciplinary records.
- Documents uploaded (ID scans, certificates) stored securely on AWS S3.
Client data:
- Company name, contact person name, email, phone number, and address.
- Service requests, invoices, and payment records.
Technical data:
- IP addresses, browser type, and device information (collected in access logs).
- Session data required to keep you logged in securely.
3. Why We Collect This Data
- To provide payroll processing, placement management, and HR administration services.
- To generate statutory compliance documents (payslips, P9 tax certificates, NSSF/NHIF reports).
- To send payslips, invoices, and system notifications by email.
- To enable staff self-service (leave requests, expense submissions, payslip access).
- To improve platform performance and diagnose technical issues.
4. Data Storage & Security
All data is stored on Amazon Web Services (AWS) servers in the US-East-1 region. Each agency's data is held in a fully isolated private database — no agency can see another's data.
- All connections are encrypted in transit (HTTPS/TLS 1.2+).
- Passwords are hashed with bcrypt; payslip PIN codes are bcrypt-protected.
- Session cookies are marked
httpOnly, Secure, and SameSite=Lax.
- Security headers (CSP, HSTS, X-Frame-Options) are enforced on all responses.
- Database backups are encrypted and stored separately on AWS S3.
5. Data Sharing
We do not sell personal data. We share data only with:
- AWS — cloud hosting and storage infrastructure.
- Africa's Talking — SMS notifications (staff phone numbers only, when SMS is enabled).
- Safaricom (M-Pesa) — payment processing (for agencies using M-Pesa billing).
- Kenya Revenue Authority (KRA) — statutory tax filings where legally required.
We share data with third parties only to the extent necessary to deliver the service, under data processing agreements that require equivalent protections.
6. Data Retention
We retain data for as long as your agency account is active. When an account is closed:
- Active data is deleted within 30 days of account closure request.
- Payroll and statutory records may be retained for 7 years to meet Kenya Revenue Authority requirements.
7. Your Rights Under the Data Protection Act, 2019
As a data subject under Kenyan law, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request deletion of your data where there is no legal obligation to retain it.
- Objection — object to certain types of processing.
- Portability — request your data in a structured, machine-readable format.
To exercise any of these rights, contact us at info@homecrew.co.ke. We will respond within 21 days.
8. Cookies
We use session cookies to keep you logged in and to maintain security (CSRF protection). We do not use tracking cookies or advertising cookies. The only cookies set are strictly necessary for the platform to function.
9. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of HomeCrew after changes take effect constitutes acceptance of the updated policy.
10. Contact
For privacy questions, data requests, or complaints:
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at odpc.go.ke.