Data Protection Act, 2019 — compliance statement

1. Who is who

Your organisation is the data controller for the employee payroll data you enter. Fortunatus Dynamic Enterprises acts as data processor for that data, processing it only on your instructions to compute payroll and produce statutory outputs. For your own account and billing records, FDE is the controller.

2. Data we process on your behalf

• Employee identity: names, national ID, contact details.
• Statutory identifiers: KRA PIN, NSSF and SHIF/SHA numbers.
• Pay data: basic pay, allowances, benefits, reliefs, loans and advances, and computed PAYE, SHIF, NSSF, Housing Levy and NITA amounts.
• Access data: sign-in events and audit records of changes.

3. Lawful basis

Processing is necessary for the performance of the employment contract and to comply with legal obligations under Kenyan tax and employment law, and to deliver the service you have subscribed to. Where consent is the only available basis, we ask for it and you can withdraw it.

4. Principles we apply (s.25)

• Lawfulness, fairness and transparency in every processing step.
• Purpose limitation — payroll data is not repurposed or sold.
• Data minimisation — we collect only fields required to compute pay and file statutory returns.
• Accuracy — the validator flags malformed KRA PINs and statutory identifiers before a run is finalised.
• Storage limitation and integrity, as described below.

5. Access control and safeguards

• Every record is scoped to your organisation at the database layer.
• Role-based access: owner, admin, payroll and employee roles see only what their role permits; employees see their own payslips only.
• Data is encrypted in transit and at rest by our hosting provider.
• Finalised payroll runs are immutable, and changes are written to an append-only audit trail.

6. Transfer outside Kenya (s.48–49)

Our hosting, email and payment providers may process data outside Kenya. We rely on written processor agreements with appropriate safeguards, and we process no more data abroad than is necessary to deliver the service. On request we will confirm the current list of processors for your account.

7. Retention

Payroll and statutory records are retained for the periods Kenyan tax and employment law require, and then deleted. You may request deletion of data no longer subject to a retention obligation, and export your data at any time via the CSV and payslip exports.

8. Data-subject rights (s.26)

Employees may request information about, access to, correction of, deletion of, or object to the processing of their personal data. Send requests to your employer as controller; if you contact us directly we will refer the request to them and support the response.

9. Breach notification (s.43)

If a personal-data breach affecting your data is detected, we will notify you without undue delay and within 72 hours of becoming aware, with the facts known at the time, the likely impact and the steps taken. Our internal incident process is documented and rehearsed.

10. Contact

Data-protection enquiries, requests and breach reports: ssapayroll@fdegroup.co.ke. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya.

See also our Privacy Policy and Terms of Service.