Privacy notice for job applicants
How Software Dynamics uses your personal data when you apply for a job, under the Kenya Data Protection Act, 2019. Version 1.0, effective 2026-10-26.
Who is responsible for your data
Software Dynamics is the data controller.
- Address
- [to be confirmed by the Data Protection Officer]
- Data protection officer
- Data Protection Officer, careers@softwaredynamics.co.ke
Write to that address for any question about your data or to use any of your rights below.
What we collect
- Identity and contact: name, National ID or passport number, date of birth, nationality, e-mail, phone and address.
- Your application: education, work history, skills, professional registrations, references, your CV and the documents you upload, your answers to screening questions and your signed declaration.
- Right to work, and, only for vacancies where the role requires it, dismissal and criminal-conviction history. We do not ask for these in quick apply.
- Voluntary: gender, disability and the details of a disability, and race. These are optional, are used only to monitor equal opportunities in aggregate, and are never used to score or shortlist you.
- How you found us (a first-visit source such as a LinkedIn post) and the e-mails and texts we send you.
Why we use it, and our lawful basis
- To assess your suitability for the vacancies you apply for and to take steps you ask for before a contract of employment: processing needed to take steps at your request before entering a contract (DPA 2019 s. 30(1)(b)).
- To meet legal obligations, such as keeping recruitment records and checking the right to work (s. 30(1)(b)).
- Your consent (s. 30(1)(a)) for your profile and application, for the talent pool, for e-mail and text updates, and for the voluntary equal-opportunities answers. You can withdraw consent at any time in the privacy centre; this does not affect what was done before.
Wording for DPO and legal review.
Automated tools and your right to a person (DPA 2019 s. 35)
We use automated tools to score applications against the vacancy. A recruiter looks at every application the tools rank, a person reviews every rejection, and the tools never reject anyone on their own. If you are unsuccessful you can ask for a person to review the outcome from your application page.
- How it works. Every application is checked against the vacancy's stated requirements (knock-out questions such as a required qualification or right to work) and given a rule-based score. For applications that meet the requirements, an AI model reads the application text and adds a score and a short summary. The two scores are blended into one ranking that decides which applications recruiters see first, and above a threshold an application is placed on the long list automatically.
- What it never does. The tools never reject an application on their own and never shortlist: a recruiter decides both.
- Ask for a person. If you are unsuccessful, open the application in your applications and choose Request human review. A recruiter will look at the application again and tell you the result within 14 days. You can also use the link in the e-mail we send you.
Who sees it, and our processors
The Software Dynamics recruitment team and the hiring managers for the vacancies you apply for. If you are shortlisted, your application is sent to our HR system (HRFlow365 on Microsoft Dynamics 365 Business Central). We do not sell your data.
Companies that handle data for us, only on our instructions:
| Processor | What it does | Where |
|---|---|---|
| Microsoft Azure | Hosts the careers site, the database, your uploaded documents and the encryption keys | East US (United States), Microsoft Azure |
| Microsoft Entra External ID | Signs you in (with Google or with an e-mail and password held by Microsoft) | Microsoft cloud; the directory region is set by the controller |
| Anthropic (AI provider) | Reads the text of your application, without your ID number and contact details, to give recruiters a score and a summary. Recruiters decide; it never rejects anyone | United States |
| SMS and WhatsApp provider (Africa's Talking, Twilio or Meta, as configured) | Sends text messages to your verified mobile number, only if you switched them on | Provider's network; may include countries outside Kenya |
| E-mail delivery provider | Sends the e-mails about your applications | Provider's network |
Where your data is kept, and transfers outside Kenya
Your data is stored in: East US (United States), Microsoft Azure.
Some processors above are outside Kenya. We transfer personal data out of Kenya only as the Data Protection Act allows (ss. 48-49): where the destination has appropriate safeguards, or with your consent. Ask the Data Protection Officer which safeguards apply to a transfer.
Wording for DPO and legal review.
How long we keep it
The schedule (DPA 2019 s. 39; General Regulations 2021 reg. 19). A daily job applies it.
| Data | Purpose | Kept for | Then |
|---|---|---|---|
| Your profile, documents and applications once none of your applications is in progress | Let you reuse your profile, and answer questions about an earlier application | 24 months after you last used your account | Your identity is removed (anonymised) and your documents are deleted; anonymous counts stay so our vacancy statistics remain true |
| The same, if you joined our talent pool | Consider you for future roles | 36 months after you last used your account | Anonymised as above |
| Applications in progress, and shortlisted applications not yet closed in the HR system | Assess you and run the recruitment process | While the application is in progress; the retention clock starts when it closes | Then as in the first row |
| Talent community sign-up (name, contact details, interests) | Tell you about matching vacancies | Until you leave (every e-mail has a link) or 24 months after you consented; a sign-up you never confirm is deleted after 7 days | Deleted |
| When you delete your account or ask us to erase your data | Your right to erasure | Promptly: the retention job checks for these requests every few minutes | Anonymised and documents deleted as above; if you were shortlisted, the HR system is asked to apply its own erasure rules to its copy |
| Recruiters' notes, shortlist notes, rejection reasons and feedback about you | Record how decisions were made | With your application | Cleared when your data is anonymised |
| Requests for human review of an outcome, and what you wrote in them | Answer you and show a person reviewed it | With your application | Your words and the recruiter's note are cleared when your data is anonymised |
| Record of when automated scoring ran on an application (no names or contact details) | Evidence that a person reviews automated advice, and to control cost | Kept as an audit record; it holds no personal data | Kept |
| A shortlisted application in the HR system (HRFlow365) | Interview, reference checks, offer and employment records | Follows the HR system's own retention schedule (statutory employment records are kept as the law requires) | Set by HR; erasure requests are forwarded |
Your rights, and how to complain
| Right | Law | We respond |
|---|---|---|
| A copy of my personal data | DPA 2019 s. 26(b); General Regulations 2021 reg. 9 | within 7 days (reg. 9(4)) |
| Correct my personal data | DPA 2019 s. 40(1)(a); reg. 10 | within 14 days (reg. 10(4)) |
| Export my data (portability) | DPA 2019 s. 38; reg. 11 | within 30 days (reg. 11(3)) |
| Delete my personal data | DPA 2019 s. 40(1)(b); reg. 12 | a response within 14 days (reg. 12(3)) |
| Object to how my data is used | DPA 2019 s. 36; reg. 8 | within 14 days (reg. 8(3)) |
| Restrict the use of my data | DPA 2019 s. 34; reg. 7 | within 14 days (reg. 7(3)) |
| Withdraw my consent | DPA 2019 s. 32 | handled as an HR case; HR confirms in writing |
Signed in, you can correct your profile under My profile, and download your data, change your consent choices or delete your account in the privacy centre. For anything else write to careers@softwaredynamics.co.ke. A refusal is given in writing with reasons.
If you are not satisfied you may complain to the Office of the Data Protection Commissioner (DPA 2019 s. 56), odpc.go.ke.
Cookies and talent community
We use cookies to keep you signed in and to protect forms, which the site needs. We also set one optional cookie that remembers, until you close your browser, how you found us (for example a LinkedIn post or a shared link), so we know which channels work. It holds no personal details and the site works if you block it. If you join our talent community, we keep your name, contact details and interests until you leave (every email has a link) or until our candidate retention period ends; sign-ups never confirmed are deleted after a few days.
Terms of use
Information you submit must be true and complete. Submitting false information may lead to disqualification or, if discovered after appointment, dismissal. Do not upload documents that belong to someone else.