Privacy Policy

Geno Essence (“we”, “us”) operates GENO HR Audit, a platform used by our audit team and by the client organisations we audit. This policy explains how we handle personal data in the platform, in line with the Data Protection Act, 2019 of Kenya and its regulations.

For account, security and usage data we are the data controller. For HR records and other material a client organisation shares with us for an audit, we process the data to deliver the audit under our engagement agreement with that organisation, which remains responsible for having a lawful basis to share it with us.

• Account details: name, work email, job title, phone number, time zone, profile photo and, if you add one, your signature for report sign-off.
• Security data: a hashed password (we never store it in readable form), two-step verification settings and recovery codes (encrypted), session records, IP address, browser details and sign-in attempts used for rate limiting.
• Audit content: client organisation details and contacts, documents and evidence you upload, interview notes recorded against respondent codes, findings, comments, action plans and reports. Uploaded HR records can contain personal data about employees, including sensitive data such as health or disciplinary information.
• Activity records: an audit log of material actions (for example approvals, uploads, downloads and setting changes) and the in-app notifications sent to you.

• To provide the platform: create and secure your account, run audits, produce reports and share them with the right client.
• To protect the platform and its users: verify sign-ins, detect misuse, limit repeated attempts and keep an audit trail.
• To communicate with you: invitations, verification and password reset emails, reminders and notifications you can manage in your notification settings.
• To meet our legal and professional obligations.

We rely on the lawful bases in section 30 of the Data Protection Act: performance of our contract with you or your organisation, compliance with legal obligations, our legitimate interests in running a secure audit service, and consent where we ask for it. We do not sell personal data, use it for advertising, or make decisions about anyone solely by automated means.

Access inside the platform follows your role. Our audit staff see the engagements they work on. Client users see only their own organisation’s requests, issued reports and action plan, never draft findings or internal comments.

We use these service providers to run the platform, under contracts that require them to protect the data:

• Vercel: application hosting.
• Neon: database hosting.
• Cloudflare R2: private storage for files and reports.
• Resend: delivery of account and reminder emails.
• Google or Microsoft: only if your organisation uses them for sign-in.

We may also disclose data where the law requires it, for example to a regulator or court.

Our providers store and process data in data centres outside Kenya, including in the United States. We transfer data only with the safeguards required by Part VI of the Data Protection Act, such as contractual protections and providers that apply appropriate security measures.

• Audit records and evidence are kept for the retention period set by the audit firm (five years by default). At the end of that period they are reviewed and deleted or anonymised, unless the law requires us to keep them longer.
• Account details are kept while you have access. When your access ends, we delete or anonymise them on request, except where audit records must identify who approved or signed them.
• Unconfirmed uploads, expired sessions, expired verification links and old sign-in attempt records are deleted automatically every day.

Data is encrypted in transit. Files are kept in private storage and shared only through short-lived download links after an access check. We support two-step verification, which your firm can make mandatory, limit sign-in attempts, separate each firm’s and each client’s data, and record material actions in an audit log. If a breach puts your data at risk, we will notify the Data Commissioner within 72 hours as section 43 requires, and inform affected people where needed.

We use only the essential cookies needed to keep you signed in securely. They are not readable by scripts and are not used for tracking or advertising. We do not use analytics or advertising cookies.

Under section 26 of the Data Protection Act you may ask to be informed about how your data is used, access it, correct or delete it, object to processing, and receive a copy in a portable format. You can update most account details yourself in My Profile.

To make a request, email admin@genoessence.com. If your data was shared with us by your employer for an audit, we may refer your request to them. You can also complain to the Office of the Data Protection Commissioner (ODPC).

The platform is for professional use and is not intended for anyone under 18.

We will update this policy when our practices change and show the new effective date above. Questions about privacy can be sent to admin@genoessence.com. See also our Terms of Use.