Privacy Policy

Last updated October 2026

Klokd is a data controller under the Kenya Data Protection Act, 2019 (DPA). This policy explains what we collect, why, who we share it with, and the rights you have. The short version: we collect the minimum needed to verify you once and pay you correctly, and we never sell your data.

1. What we collect

Account: your phone number and name. Identity verification is performed by our identity partner (Identiti) — Klokd does not store national ID images or biometrics. Location: a coarse distance calculation to rank shifts near you; we do not store your GPS history. Work record: shifts you post or apply to, clock-in/out events, ratings, and (once payment rails are live) payment records with statutory deductions.

2. Why we process it

To verify identity once so any employer can trust it; to show you relevant shifts; to keep an auditable record of work agreed and done; to calculate and remit statutory deductions; to prevent fraud and enforce our Terms; and to comply with Kenyan law (DPA 2019, KRA, NSSF, SHIF, WIBA).

3. Who we share it with

Identity data flows through our identity rail (Identiti) — your phone number never crosses to employers or other workers; employers see only your first name, last initial, ratings and verification status. One-time codes are delivered by our messaging rail (Todoku). Shift discovery is published through our discovery rail (Hakken). We do not sell personal data or share it with advertisers.

4. How long we keep it

Work and payment records are retained for 7 years (Kenyan tax and employment record requirements). Account data is kept while your account is active. You can request deletion at any time — where retention is legally required we anonymise instead of deleting outright.

5. Your rights

Under the DPA 2019 you can ask for a copy of your data, correction of wrong data, deletion where the law allows, and to object to or restrict processing. Email privacy@klokd.co.ke and we will respond within the statutory window. You may also complain to the Office of the Data Protection Commissioner (ODPC).

6. Security

Data is encrypted in transit and at rest; access is role-restricted and audit-logged. If a breach ever affects your personal data we will notify you and the ODPC within 72 hours as the law requires.

7. Registration status

Klokd is aligned to DPA 2019 requirements and is completing its registration with the ODPC. This policy will be updated as registrations (ODPC, KRA, NSSF, SHIF) complete. Material changes will be announced in the app.