Privacy Policy

This Privacy Policy forms Part 2 of Kiruko's Unified Terms of Service & Privacy Policy. It explains how Zilwa Eklere Ltd (Mauritius), the operator of Kiruko, collects, uses, and protects your data under the Mauritian Data Protection Act 2017.
Contact: hello@kiruko.mu · WhatsApp: +230 5719 4590

1. Who We Are & Data Controller Roles

Kiruko is operated by Zilwa Eklere Ltd, a company registered in Mauritius. For the purposes of the Mauritian Data Protection Act 2017:

• For employee/worker data: Your Employer acts as the Data Controller. Kiruko acts as a Data Processor, processing data strictly on the documented instructions of the Employer.
• For account data, billing, and security: Kiruko acts as an independent Data Controller to manage your account, send notifications, and secure the platform.

2. Data We Collect

• Account Information: Name, email address, phone number, hashed password, preferred language, and role.
• Workplace Data: Job title, department, payroll details (salary, allowances, deductions), leave requests and balances, clock-in/out records (including GPS location and optional photo verification), and task completion history.
• Documents: Uploaded receipts, payslips, or supporting documents (which may be scanned via OCR for data extraction).
• Device & Usage: Device type/OS, push notification tokens, app version, and security audit logs (e.g., logins and critical actions).
• Website Analytics: We use Umami Analytics on our marketing website—a cookieless, privacy-first tool that collects aggregate data (page views, referrers, country level) without identifying individual users. No personal data is collected there.

Biometrics: If you enable Face ID or Fingerprint unlock, the verification occurs entirely on your local device via your operating system. Kiruko never receives, stores, or processes your biometric data.

3. How We Use Data

We process personal data solely to:

• Provide and improve the Service (attendance, payroll, scheduling, notifications);
• Authenticate users and secure accounts;
• Calculate pay, overtime, and statutory amounts;
• Send operational alerts (e.g., clock-in reminders, expiry notices);
• Comply with legal, tax, and audit obligations;
• Detect, prevent, and investigate fraud or security incidents.

We do not sell your personal data to third parties.

4. Sharing & Disclosure

We share data only:

• With your Employer: Accessible to authorized administrators for workforce management.
• With Service Providers: Vetted vendors (e.g., cloud hosting via Google Cloud, OVH; file scanning; email delivery; push notifications via Expo), bound by strict confidentiality and processing agreements.
• Legal Obligations: Where required by Mauritian law, court order, or to protect the rights, property, or safety of Kiruko, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or asset sale, subject to the same privacy protections.

5. Retention & Deletion

• Active Use: Data is retained while your account is active and as needed to provide the Service.
• Deletion: Upon account deletion, we remove or anonymize your personal identifiers and uploaded files. However, certain records (specifically, payroll and attendance logs) may be retained by your Employer to satisfy statutory retention periods (e.g., up to 7 years for tax and labour compliance). Security and audit logs may also be retained for a limited period for forensic purposes. You can request deletion any time via Settings → Delete Account or by emailing hello@kiruko.mu.

6. Your Rights (Data Subject Rights)

Subject to the Data Protection Act 2017, you have the right to:

• Access your personal data;
• Correct inaccurate or incomplete data;
• Request Deletion of your data (subject to employer retention obligations);
• Export a copy of your data (portability);
• Object to or restrict certain processing (e.g., direct marketing).

For employee data managed by your employer, we may direct your request to them. To exercise your rights, contact us at hello@kiruko.mu.

7. Security

We implement industry-standard safeguards, including:

• Encryption in transit (HTTPS/TLS);
• Hashed and salted passwords;
• Role-based access control (RBAC);
• Trusted-device sign-in verification;
• Append-only audit trails for sensitive actions;
• Malware scanning for uploaded files.

While no system is 100% secure, we continuously update our measures to protect your data.

8. International Transfers

We are based in Mauritius and primarily serve the Mauritian market (with expansions to Madagascar, Tanzania, and the wider region). Some service providers may process data outside Mauritius; we ensure that any such transfers comply with applicable law by imposing Standard Contractual Clauses or equivalent safeguards.

9. Children

Kiruko is a workplace tool intended for employers and working individuals. It is not directed at children under the age of 16. We do not knowingly collect data from minors under 16. If we become aware of such data, we will delete it promptly.

10. Changes to this Policy

We may update these Terms and Privacy Policy from time to time. We will post the updated version with a revised "Last Updated" date and, where appropriate, notify users via in-app alert or email.

11. Contact for Privacy Concerns

For any privacy-related questions or to report a data breach, contact:

Data Protection Officer (DPO) – Zilwa Eklere Ltd
Email: hello@kiruko.mu
WhatsApp: +230 5719 4590