The County Government of Nakuru (hereinafter referred to as “the County”) is committed to protecting
the privacy, confidentiality, and integrity of personal data collected and processed through the
Nakuru County Recruitment Portal (hereinafter referred to as “the Portal”).
This Privacy Policy explains what information we collect from applicants and system users, the purposes
for which it is collected, how it is processed and stored, the legal basis for processing, and the
safeguards implemented to protect it, in line with the Data Protection Act, 2019 and applicable
public service and recruitment regulations.
By registering on, accessing, or using the Portal, you acknowledge that you have read, understood,
and agreed to this Privacy Policy. If you do not agree with any part of this Policy, you should
refrain from using the Portal.
1. Information We Collect
In the course of creating an account, submitting an application, and participating in the recruitment
process, the County may collect and process the following categories of information:
Personal Identification Information:
Full name, national ID/passport number, KRA PIN, gender, date of birth, nationality, and other
identity details as required for public service recruitment.
Contact Information:
Postal and physical address, email address, mobile/telephone number, and next-of-kin or emergency
contact details.
Academic and Professional Qualifications:
Education history, institutions attended, qualification levels, grades, professional certifications,
membership to professional bodies, license numbers, and validity information.
Employment and Experience Information:
Current and previous employment details, job titles, employer names, employment duration, job
responsibilities, salary scales where required by law or policy, and other work history.
Referees and Character References:
Referees’ full names, positions, organization, relationship to the applicant, contact details, and
any reference letters or recommendations provided.
Special Category and Compliance Information (where applicable):
Disability status, affirmative action information, and compliance data required under law or public
service policies, strictly processed in accordance with data protection requirements.
Attachments and Supporting Documents:
Copies of identification documents, academic and professional certificates, transcripts, curriculum vitae (CV),
professional memberships, clearance certificates, and any other documents required as part of the
recruitment process.
System and Usage Data:
IP address, browser type, device identifiers, login timestamps, activity logs, and other technical
metadata generated when you access or interact with the Portal, used for security, audit, and
performance monitoring.
2. Purpose and Use of Information
The County collects and processes your information strictly for lawful and predefined purposes,
including but not limited to:
Account Creation and Applicant Management:
To create and maintain your user account, manage your applicant profile, and enable you to apply
for advertised positions.
Recruitment and Selection:
To receive, process, assess, shortlist, interview, and make decisions on your application for
employment or engagement with the County.
Verification and Due Diligence:
To authenticate your identity, verify academic and professional qualifications, validate work
experience, and carry out background checks as may be required.
Regulatory, Policy, and Audit Compliance:
To comply with statutory, regulatory, and internal policy requirements relating to public service
recruitment, reporting, record keeping, and audit trails.
Communication and Notifications:
To send you alerts and updates regarding your application status, interviews, further requirements,
system updates, or changes to this Policy or related terms.
System Security and Performance:
To monitor system usage, detect and prevent fraud, abuse, or unauthorized access, and ensure the
stability, availability, and performance of the Portal.
Analytics and Service Improvement:
To generate aggregated and anonymized statistics for improving recruitment processes, planning
human resource needs, and enhancing user experience on the Portal.
3. Legal Basis for Processing
The County processes your personal data on one or more of the following legal bases:
Performance of a Task Carried Out in the Public Interest:
Recruitment into County public service is a statutory public function governed by law and
applicable regulations.
Contractual Necessity:
Processing is required to take steps at your request prior to entering into an employment contract
and, where applicable, for contract administration.
Legal Obligations:
Processing is necessary to comply with obligations under national legislation, public service
regulations, and directives from regulatory authorities.
Legitimate Interests:
The County has a legitimate interest in ensuring transparent, accountable, efficient, and secure
recruitment processes.
Consent:
In limited cases, we may process certain categories of data based on your explicit consent,
which you may withdraw subject to legal and contractual constraints.
4. Disclosure and Sharing of Information
The County treats your data as confidential. However, your information may be disclosed or shared
under strictly controlled circumstances, including:
Internal County Departments and Organs:
Relevant County departments, panels, and authorized officers involved in recruitment,
human resource management, audit, or compliance.
Government and Regulatory Authorities:
National and County-level bodies where disclosure is required by law, court order, or regulatory
directive.
Third-Party Service Providers:
Verified service providers engaged to support Portal hosting, maintenance, security, communication
(e.g., SMS, email), or other technical services, subject to appropriate data protection agreements.
Verification and Reference Entities:
Educational institutions, professional bodies, previous employers, and referees for the purpose of
validating information provided in your application.
Legal and Security Disclosures:
Where necessary to establish, exercise, or defend legal claims, investigate fraud, or respond to
security incidents.
The County does not sell or commercially exploit your personal data.
5. Data Security and Protection Measures
The County, together with its authorized ICT service providers, implements appropriate technical
and organizational measures to safeguard your personal data against accidental or unlawful destruction,
loss, alteration, unauthorized disclosure, or access. These measures include, but are not limited to:
Encryption:
Use of industry-standard encryption protocols (e.g., TLS/SSL) to secure data in transit between
your browser and the Portal.
Access Control and Authentication:
Role-based access control (RBAC), strong authentication mechanisms, session management, and
audit logs to ensure only authorized personnel can access sensitive data.
Secure Infrastructure:
Hosting on secure servers protected by firewalls, intrusion detection/prevention systems, regular
security patching, and hardened configurations.
Backup and Recovery:
Regular system and database backups, with secure storage and tested recovery procedures to
ensure continuity and integrity of data.
Operational and Administrative Controls:
Staff confidentiality undertakings, restricted administrative access, and continuous monitoring of
system activity to detect anomalies or misuse.
While we strive to use commercially reasonable means to protect your personal data, no information
system can be guaranteed to be 100% secure. Users are encouraged to keep their login credentials
confidential and to log out of the Portal after use.
6. Data Retention and Disposal
The County retains personal data only for as long as is reasonably necessary to fulfill the purposes
for which it was collected, to comply with legal, regulatory, or policy requirements, and to maintain
accurate records of recruitment processes.
Retention periods may vary depending on the nature of the data and applicable laws. At the end of the
retention period, personal data will be securely deleted, anonymized, or otherwise disposed of in a
manner that prevents unauthorized access or use.
7. Your Rights as a Data Subject
As a data subject, you have the following rights in relation to your personal data processed
through the Portal, subject to lawful limitations:
Right of Access:
To request confirmation of whether your data is being processed and to obtain a copy of the
personal data held about you.
Right to Rectification:
To request correction of inaccurate or incomplete personal data.
Right to Erasure:
To request deletion of your personal data where there is no lawful reason for its continued
processing, subject to legal and archival obligations.
Right to Restrict Processing:
To request that the processing of your personal data be restricted in certain circumstances.
Right to Object:
To object to processing based on legitimate interests or public interest grounds, where applicable.
Right to Data Portability:
Where technically feasible, to request a copy of your personal data in a structured, commonly
used, and machine-readable format.
Right to Lodge a Complaint:
To lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe
your data protection rights have been infringed.
To exercise any of these rights, please contact us using the contact details provided in
Section 11 below. We may require you to verify your identity before processing your request.
8. International Data Transfers
The Portal is primarily hosted and operated within Kenya. Where, in limited circumstances, data
may be transferred outside Kenya (for example, due to use of secure cloud services), such transfers
shall be carried out in compliance with the Data Protection Act, 2019 and any applicable regulations,
including ensuring appropriate safeguards are in place.
9. Cookies and Tracking Technologies
The Portal may use cookies and similar tracking technologies to enhance user experience, remember
user preferences, improve navigation, and compile aggregate statistics on Portal usage.
You can manage or disable cookies through your browser settings. However, disabling certain cookies
may impact the functionality or performance of the Portal.
10. Changes to This Privacy Policy
The County may update or amend this Privacy Policy from time to time to reflect changes in legal
requirements, technological advances, or Portal functionalities.
Any material changes will be communicated via the Portal and, where appropriate, via email or
system notifications. Continued use of the Portal after such changes have been published shall
constitute your acceptance of the updated Privacy Policy.
11. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing
of your personal data, please contact:
