CromaHR Mobile App Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Croma Interactive Limited ("Croma Interactive", "we", "us" or "our"), a company incorporated in Kenya, handles personal data when you use the CromaHR mobile application (the "App").

The App is a companion to the CromaHR platform (the "Service"). It lets employees view payslips, apply for leave, submit expense claims and record attendance, and lets managers and HR teams review and approve requests.

A pan-African policy. CromaHR is used by employers across Africa. This policy sets one common standard of protection for every user, wherever they are. It is designed to meet the requirements of the data protection laws of the countries listed in Section 10, and the principles of the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention). Section 10 also sets out country-specific terms.

Local law prevails. If the law of the country where you work gives you more protection than this policy, that law applies. Nothing in this policy limits any right you have that cannot be limited by law.

Relationship to other documents. This policy covers what is specific to the App. It applies together with the CromaHR Privacy Policy and the CromaHR Terms of Service. Where they differ on a matter specific to the App, this policy applies.

Who controls your data

Your employer is the data controller for your employment records, such as your salary, payslips, statutory deductions, leave and attendance. Your employer decides why and how this data is processed. Croma Interactive processes it on your employer's behalf, as a data processor, under a written agreement.

Croma Interactive is the data controller for data about how you use the App, such as device, diagnostic and usage data, and for your App account.

Your employer is responsible for having a lawful basis to process your employment records and for telling you how it uses them. Questions about your employment records should go to your employer first.

2. Data the App Collects

The App collects only the data needed to provide CromaHR features on your phone. The exact data depends on the features your employer has switched on.

The App does not request access to your contacts, call logs, SMS messages or browsing history, and it does not use an advertising identifier. The App does not collect your location in the background, or at any time other than when you clock in or out.

Keeping your data accurate. Please tell your employer if your employment records are wrong, and keep your own App profile up to date. We rely on the accuracy of the data your employer and you provide.

3. Device Permissions

The App asks for each permission only when you first use the feature that needs it. You can refuse or withdraw any permission at any time in your device settings. The rest of the App keeps working; only the related feature stops.

Biometric data stays on your device. Fingerprint and face unlock are handled by your phone's operating system. The App receives only a confirmation that unlock succeeded or failed. The App does not receive, collect or store your fingerprint or face data.

4. Sensitive Personal Data

Some HR data is classed as sensitive (or "special") personal data under African data protection laws, and receives extra protection. Depending on the features your employer uses, the App may process:

• Health data, such as a medical certificate attached to a sick leave request;
• Trade union membership, where union dues are deducted through payroll;
• Family details, such as dependants or next of kin recorded for benefits or emergencies.

We process sensitive data only on your employer's documented instructions, only where your employer has a lawful basis under employment, social security or other applicable law, or your explicit consent, and only for the purpose it was provided. Access is restricted to authorised people who need it. Do not upload sensitive information that the request does not require.

5. How We Use Your Data and Our Legal Basis

We use data collected through the App only for the purposes below. We do not use it for any new purpose that is incompatible with these without first telling you and, where the law requires it, getting your consent.

Where we rely on legitimate interest, we have weighed it against your rights and concluded that the processing is necessary and does not override them. Where we rely on consent, you can withdraw it at any time, without affecting processing that took place before.

What we do not do. We do not sell personal data. We do not use App data for advertising or to build marketing profiles. We do not use your personal data from the App to train artificial intelligence models.

Automated decisions. Payroll figures in the App are calculated automatically from your employer's data and applicable statutory rates. Decisions about your pay, leave and employment are made by your employer, not by the App. If you think a figure is wrong, ask your employer to review it.

6. Sharing Your Data

We share personal data only in the cases below, and only as much as each case requires.

• Your employer. Leave requests, expense claims, attendance records and other content you submit are shared with your employer's authorised HR staff, managers and payroll administrators. This is how the App works.
• Statutory bodies. Your employer may file payroll data with tax, social security, health insurance and other authorities in your country, using the Service. The App itself does not send data to these authorities.
• Service providers. We use carefully selected providers for cloud hosting, push notifications and crash reporting. They act only on our written instructions, under contracts that require confidentiality, security and compliance with data protection law. We remain responsible for their processing of your data.
• Legal requirements. We may disclose data where required by law, a court order or a lawful request from a government authority. We disclose only what legally required and, where the law allows, tell your employer first.
• Business transfers. If Croma Interactive is involved in a merger, acquisition or sale of assets, personal data may transfer to the new owner. The new owner must continue to protect it in line with this policy, and we will notify you of any change in who controls your data.

Third-party services in the App

We will update this list before adding a new service that receives personal data from the App.

7. International Data Transfers

Your data may be stored or processed outside the country where you work, for example on cloud servers in another country. We transfer personal data across borders only where the law of the country it comes from allows it. Depending on that law, we rely on one or more of the following:

• The receiving country has been recognised as providing adequate protection;
• Appropriate safeguards are in place, such as contractual clauses approved or recognised by the relevant authority;
• We hold any registration, authorisation or approval the relevant authority requires before the transfer;
• The transfer is necessary to perform the contract with your employer, or another ground the applicable law permits.

Countries with local storage or approval rules. Some countries restrict transfers further. For example, Rwanda's law requires personal data to be stored in Rwanda unless the regulator has authorised storage or transfer elsewhere. Where a country's law sets requirements like these, we comply with them before data is stored or transferred outside that country.

You can ask us for details of the safeguards that apply to your data using the contact details in Section 11.

8. Security, Retention and Data Breaches

Security

We use technical and organisational measures appropriate to the sensitivity of HR and payroll data. These include encryption in transit (TLS) and at rest, role-based access controls, audit logs, regular security testing, and confidentiality and training obligations for our staff. Employees see only their own records; managers see only the records their employer authorises. The App signs you out after a period of inactivity.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You can help by keeping your password private, locking your phone, and signing out on shared devices. Tell us immediately if you think your account has been compromised.

Data stored on your device

The App keeps a limited amount of data on your phone, such as your sign-in session and recently viewed records, so it loads quickly. This data is kept in encrypted app storage and is removed when you sign out or uninstall the App. Payslips or documents you choose to download are saved to your device's storage, where you control them and our security measures no longer apply.

Retention

We keep personal data only as long as necessary for the purposes in Section 5:

When data is no longer needed, we delete or anonymise it securely.

Data breaches

If a personal data breach occurs, we act promptly to contain it. As a processor, we notify affected employers without undue delay so they can meet their own obligations. Where we are the controller, we notify the relevant data protection authority and affected individuals within the timeframes and in the manner required by the law of each affected country.

9. Your Rights and Deleting Your Account

Your rights

Subject to the law that applies to you, you have the right to:

• Be informed about how your personal data is used;
• Access a copy of your personal data;
• Have inaccurate or incomplete data corrected;
• Have your data deleted, either in full (by deleting your account) or in part (for example, when you downgrade your plan), subject to legal retention requirements;
• Receive your data in a structured, machine-readable format;
• Object to processing based on legitimate interest;
• Restrict processing while a request or complaint is considered;
• Withdraw consent, including any device permission, at any time;
• Not be subject to decisions based solely on automated processing that significantly affect you;
• Complain to a data protection authority (see Section 10).

How to make a request. For your employment records, contact your employer, who controls that data. If you contact us instead, we will pass your request to your employer promptly and help them respond. For App account, device and usage data, contact us using the details in Section 11. We may ask you to verify your identity before acting on a request. We respond within the time limits set by the law that applies to you, and we do not charge for reasonable requests.

Deleting your App account

You can request deletion at any time:

• In the App: Profile > Settings > Delete Account.
• On the web, without the App: visit cromahr.com/delete-account or email privacy@cromainteractive.com with the subject "Delete my CromaHR account".

Within 30 days, we delete your App login, device data, notification tokens, diagnostic data and usage data, except any data we must keep by law. Deleting your App account does not delete your employment and payroll records, which your employer is legally required to keep. To ask for those to be deleted, contact your employer.

Deleting data from specific modules (plan downgrades)

If you downgrade your CromaHR plan — for example, from Enterprise to Professional, or from Professional to Starter — you may lose access to certain modules. You can request that the data stored in those modules be deleted without deleting your account. Your login, core employment and payroll records, and the modules you still have access to are not affected.

Examples of data you may ask us to delete after a downgrade:

• Performance management and appraisal records;
• Training and development records;
• Succession planning data;
• Analytics and workforce forecasting data;
• Case management and employee relations files;
• Any other module you no longer have access to under your new plan.

You can request partial data deletion at any time:

• On the web: visit cromahr.com/data-deletion-request and tell us which modules you want data deleted from.
• By email: contact privacy@cromainteractive.com with the subject “Data deletion request — plan downgrade”.

We process partial data deletion requests within 30 days. Before deleting anything, we will confirm with you exactly which data will be removed. We do not delete your employment and payroll records, which your employer is legally required to keep, or any data we are legally required to retain. If you later upgrade your plan again, the deleted module data cannot be restored.

10. Country-Specific Information

The table lists the main data protection law and authority in each country where CromaHR provides statutory payroll support. You can complain to the authority in your country at any time, although we encourage you to contact us first so we can try to resolve your concern.

Registration and local obligations. Where a country's law requires us to register with its data protection authority, appoint a data protection or information officer, or obtain authorisation for transfers, we do so.

Countries without a data protection law in force. Where no general data protection law applies, we still protect your data to the full standard in this policy. When a new law comes into force, we will comply with it and update this policy.

Other countries. If you use the App in a country not listed above, this policy applies, together with any data protection law of that country.

11. Other Terms and Contact Details

Young workers. The App is a workplace tool and is not directed at children. Where an employer lawfully employs workers under 18, such as apprentices, the employer is responsible for obtaining any consent the law requires before giving them access to the App.

Links to other services. The App may link to websites or services we do not control, such as a government tax portal. This policy does not apply to them; please read their privacy policies.

Changes to this policy. We may update this policy to reflect changes in the App, our practices or the law. We will notify you of material changes through the App or by email at least 30 days before they take effect, unless a change is required sooner by law. The effective date at the top shows when the policy was last updated.

Language. This policy is written in English. If we provide a translation and there is a conflict, the English version applies, unless local law requires otherwise.

Governing law. This policy is governed by the laws of Kenya, without affecting the protections and remedies you have under the data protection law of the country where you work.

Contact us. Our Data Protection Officer handles all privacy questions and requests from every country we serve.