Privacy Policy
Last updated: August 2026 · Compliant with the Kenya Data Protection Act 2019
Tornad Business Solutions Ltd is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect information in compliance with the Kenya Data Protection Act 2019 and other applicable laws.
1. Data Controller
Tornad Business Solutions Ltd is the data controller for personal data processed through our website, software products, and professional services. Our registered office is located at Mageso Chamber, Moi Avenue, Nairobi, Kenya. For data protection enquiries, contact us at info@tornad.co.ke.
2. Personal Data We Collect
We collect the following categories of personal data:
| Category | Examples | Collected Via |
|---|---|---|
| Identity Data | Full name, KRA PIN, National ID/Passport number | Account registration, payroll onboarding |
| Contact Data | Email address, phone number, postal address | Contact forms, account setup |
| Employment Data | Job title, salary, start date, leave records | HRMS and Payroll system |
| Biometric Data | Fingerprint and facial recognition templates | Biometric attendance devices |
| Financial Data | Bank account numbers, M-Pesa numbers, salary details | Payroll and ERP systems |
| Usage Data | Login times, pages visited, IP address | Automated via system logs |
| Communication Data | Emails, WhatsApp messages, support tickets | Customer support channels |
3. How We Use Your Data
- Service delivery: To provide, maintain, and support the software and professional services you have contracted.
- Statutory compliance: To compute and remit PAYE, SHIF, NSSF, Housing Levy, NITA, and VAT on your behalf through KRA iTax and relevant portals.
- Payments processing: To initiate M-Pesa salary disbursements, vendor payments, and e-commerce transactions via Safaricom Daraja API.
- Account management: To create and manage user accounts, subscriptions, and billing.
- Communication: To send service notifications, payslips, system alerts, and support responses.
- Security: To detect fraud, unauthorised access, and security incidents.
- Analytics: To improve our products using aggregated, anonymised usage data.
- Legal obligations: To comply with court orders, regulatory requests, or applicable Kenyan law.
4. Legal Basis for Processing
- Contractual necessity: Processing required to fulfil our service agreement with you.
- Legal obligation: Processing required for KRA, SHIF, NSSF, and other statutory compliance.
- Legitimate interests: Security monitoring, fraud prevention, and product improvement.
- Consent: For optional communications and non-essential cookies where required by law.
5. Biometric Data
Biometric data (fingerprint and facial recognition templates) collected via ZKTeco, Anviz, Suprema, or HikVision devices is treated as sensitive personal data under the Data Protection Act 2019. This data is:
- Stored only in encrypted form on the client's own hardware or cloud environment
- Never shared with third parties except device SDK providers for technical synchronisation
- Deleted from all systems upon termination of the attendance service contract
- Processed only with the explicit consent of each data subject (employee)
6. Third-Party Data Sharing
We share personal data with the following categories of third parties only to the extent necessary: Safaricom (M-Pesa Daraja API) for payment processing; KRA iTax for PAYE, VAT, and ETR filing; SHIF and NSSF for statutory deduction remittance; cloud providers (Microsoft Azure / AWS) for secure data hosting; email/SMS providers for transactional communications; and Meta (WhatsApp Business API) for notifications where configured. We do not sell personal data to third parties. All sub-processors are bound by data processing agreements.
7. Data Retention
- Payroll and tax records: 7 years (as required by the Kenya Income Tax Act)
- Employee HR records: Duration of employment + 3 years
- Biometric templates: Until the employee leaves + 30 days
- Contact form submissions: 2 years
- System logs: 12 months
8. Data Security
- AES-256 encryption for data at rest
- TLS encryption for data in transit
- Role-based access control (RBAC) for all system modules
- Multi-factor authentication (MFA) for administrator accounts
- Regular penetration testing by accredited security firms
- Automated daily backups with geo-redundant storage
9. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to access, correct, or request deletion of your personal data; object to processing for legitimate interest purposes; withdraw consent; request data portability; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya. To exercise any of these rights, contact us at info@tornad.co.ke. We will respond within 30 days.
10. Cookies
Our website uses essential cookies to maintain session state and security. We also use Google Analytics 4 (GA4) cookies to collect anonymised usage statistics that help us improve the website. You may disable non-essential cookies via your browser settings. We do not use advertising or tracking cookies for third-party ad targeting.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact Us
Data Protection Officer
Tornad Business Solutions Ltd
Mageso Chamber, Moi Avenue, Nairobi, Kenya
Email: info@tornad.co.ke
Phone: +254 110 088 686
If you are not satisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.