Privacy Policy

Fortunatus Dynamic Enterprises ("FDE", "we") operates SSA Payroll (the "Service"). This policy explains how personal data is handled under the Kenya Data Protection Act, 2019 (the "Act").

1. Our roles: controller and processor

Our role depends on the data:

• Account, billing and support data — FDE is the data controller. We decide why and how this data is used to create accounts, invoice subscribers and support them.
• Employee payroll data uploaded or entered by an employer (names, national ID, KRA PIN, NSSF/SHIF numbers, PWD exemption numbers, bank details, pay records) — the employer is the data controller and FDE is the data processor. We process this data only on the employer's documented instructions, for the purposes of running their payroll.

The Office of the Data Protection Commissioner (ODPC) distinguishes these roles, and the obligations differ accordingly. Employees whose payroll data is processed in the Service should direct data-subject requests to their employer in the first instance; we will assist the employer in responding.

2. Data Processing Agreement

Where FDE acts as processor, our Data Protection & Processing terms form the Data Processing Agreement (DPA) between the employer (controller) and FDE (processor). It covers scope and duration of processing, confidentiality, security measures, use of subprocessors, assistance with data-subject requests, breach notification, and return or deletion of data on termination. Subscribers who require a countersigned copy may request one at ssapayroll@fdegroup.co.ke.

3. What we collect

Account data: name, email, organization details. Payroll data: employee identifiers (KRA PIN, national ID, NSSF/SHIF numbers), pay records and computed statutory amounts. Usage data: logs and analytics necessary to operate and secure the Service.

4. Why we process it

To provide payroll computation, generate statutory filings, invoice you, secure the Service, and meet our own legal obligations under Kenyan tax and employment law.

4A. Subprocessors and hosting jurisdictions

We use the following subprocessors. Each is engaged under a written agreement with confidentiality and security obligations, and we notify subscribers before adding or replacing one.

• Supabase — managed database, authentication and file storage. Data is hosted in the AWS region configured for this project (currently the European Union).
• Cloudflare — application hosting, edge delivery and DDoS protection; processing occurs at globally distributed edge locations, with payroll data at rest held only in the database region above.
• Paystack — payment processing for subscriptions (Kenya / Nigeria). Paystack receives billing data only, never employee payroll data.
• Resend — transactional email delivery (payslip notifications, account emails), hosted in the European Union and United States.

Where data is transferred outside Kenya, we rely on the safeguards permitted by sections 48–49 of the Act, including contractual safeguards with each subprocessor and, where applicable, the data subject's consent obtained by the controller.

4B. Retention periods

• Payroll records, payslips and statutory returns: 7 years from the end of the relevant year of income, matching the record-keeping period required by the Tax Procedures Act.
• Employee master records: for the duration of employment plus 7 years, unless the employer instructs earlier deletion.
• Account and billing records: 7 years after the subscription ends (accounting and tax requirements).
• Security, access and audit logs: 12 months.
• Support correspondence: 24 months.

On termination, an employer may request export and deletion of their organisation's payroll data; we delete it within 30 days except where law requires longer retention.

4C. ODPC registration

FDE processes personal data as both controller and processor and is registering with the Office of the Data Protection Commissioner as required by the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. Our current registration status and certificate number are available on request at ssapayroll@fdegroup.co.ke, and our Data Protection Officer can be reached at the same address.

5. Legal basis

Contract (to deliver the Service you subscribe to), legitimate interests (running and improving the Service), legal obligation (tax and employment record-keeping), and consent where required. Where we act as processor, the employer is responsible for establishing the lawful basis for processing its employees' data.

6. Sharing

We do not sell personal data. We share it only with the subprocessors listed in section 4A, and with authorities where the law requires it.

7. Your rights

You may request access, correction, deletion, portability or objection under the Data Protection Act, 2019. Contact: ssapayroll@fdegroup.co.ke. Employees should contact their employer, who controls their payroll data.

8. Security

Data is encrypted in transit and at rest. Access is restricted by role. We follow a documented breach-response process.

9. Contact

For any privacy question or a data-subject request: ssapayroll@fdegroup.co.ke.