Privacy Policy
Last updated: 16 October 2026. Items in [[double square brackets]] must be completed, and this document reviewed by a Kenyan advocate, before publication.
1. Who we are
This policy is issued by [[LEGAL ENTITY NAME]] ("OurPay", "we", "us"), registered in [[COUNTRY]] under number [[REGISTRATION NUMBER]], with its address at [[REGISTERED ADDRESS]]. We are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya under registration number [[ODPC REGISTRATION NUMBER]]. You can contact us about privacy at [[PRIVACY EMAIL]].
We act in two different roles:
- Data controller for personal data about visitors to this website, people who contact us, and our client contacts.
- Data processor for payroll data about our clients' employees, which we handle only on our clients' instructions. See our Data Processing terms. If you are an employee of one of our clients, your employer is the controller and you should direct requests to them first.
2. What we collect
- Information you give us: name, company, work email, phone number, number of employees, countries, how payroll is run today, and any message you write, when you use the contact or parallel-run forms.
- Self-check answers: answers to the "Why OurPay" self-check stay in your browser session. They are sent to us only if you submit a parallel-run request afterwards.
- Technical data: IP address and basic request data, processed by our hosting and security providers to serve the site and block abuse.
- Client data: contact details of client staff, contract and billing records.
The payslip calculator runs in your browser. What you type into it is not sent to us.
Please do not enter salaries, bank details or employee records into website forms. We set up a separate secure intake with clients.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to enquiries and parallel-run requests | Your consent, and steps taken at your request before a contract |
| Providing and billing our payroll service | Performance of a contract |
| Meeting tax, statutory and record-keeping obligations | Legal obligation |
| Securing the website and preventing spam or abuse | Legitimate interest |
| Following up with prospects about our services | Your consent, which you can withdraw at any time |
4. Who we share it with
- Service providers acting for us under written terms: Cloudflare (website hosting, security and the Turnstile spam check), [[EMAIL PROVIDER, e.g. Resend]] (delivers form submissions to our inbox), and Google Fonts (which receives your IP address when fonts load).
- Tax and statutory authorities in Kenya, Uganda, Tanzania and Rwanda, where we file payroll returns for clients.
- Professional advisers such as lawyers and auditors, under confidentiality.
- Anyone else only where the law requires, or with your consent. We do not sell personal data.
5. Transfers outside Kenya
Some providers process data outside Kenya. Where personal data leaves Kenya, we rely on the safeguards the Data Protection Act, 2019 and its regulations allow, such as contractual protections, and your consent where needed. Details are available on request.
6. How long we keep it
- Enquiries that do not become clients: up to [[12]] months, then deleted.
- Client contract and billing records: for the contract term plus [[7]] years.
- Payroll records we process for clients: as the client instructs and as statutory record-keeping rules in each country require.
7. Security
Website forms are sent over HTTPS to our own endpoint, which validates every field and verifies a spam check before accepting a submission. Access to client payroll data is limited to the specialists assigned to the account, who are bound by confidentiality agreements. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the ODPC as the law requires.
8. Your rights
Under the Data Protection Act, 2019 you may ask us to: tell you what we hold about you; give you access to it; correct it; delete it; stop or restrict certain processing; and provide your data in a portable format. Where we rely on consent you can withdraw it at any time. Email [[PRIVACY EMAIL]] and we will respond within the time the law allows. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner of Kenya.
9. Children
This website is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.
10. Cookies
See our Cookie Policy.
11. Changes
We will post changes on this page and update the date above. If a change materially affects how we use your data, we will tell you directly where we can.