How we look after your data

CareerCraft Connections (registered business name CAREERCRAFT CONNECTIONS) runs this website and the services on it. For the personal data described here we are the data controller under Kenya’s Data Protection Act, 2019.

Questions or requests about your data: careercraftconnections206@gmail.com, subject “Privacy request”.

• Account details: your name, email address, password (stored only as a secure hash) and, for staff, two-step verification settings.
• Profile: phone number, county and town, institution, course, qualification level, year of study, availability dates, goals, skills, experience, projects, certifications and a CV if you upload one.
• Documents you upload: for example an introduction letter, transcripts or identification your institution or host requires.
• Assessments: your answers, scores and the time taken.
• Placement records: placement requests, the host you were allocated to, placement letters, weekly logbook entries, supervisor sign-offs and completion confirmations.
• Payments: the M-Pesa phone number used, the amount, the M-Pesa confirmation code and the time. We never see or store your M-Pesa PIN.
• Career tools: job adverts you paste, applications you track, and the letters, emails and CVs the tools prepare for you.
• A connected mailbox, if you choose Smart Applications: a send-only permission for your Gmail or Outlook account, stored encrypted. It lets us send the applications you approve; it does not let us read your mail.
• Organisation users: for hosts, employers, institutions and agencies, your work contact details and the organisation’s registration details.
• Technical data: IP address, browser and device type, pages requested and error reports, used to keep the service secure and working.

• To provide the service you asked for (performing our agreement with you): creating your account, assessing and placing you, issuing placement letters, processing payments, sending applications you approve.
• With your consent: sharing your profile with hosts and employers as described below, connecting a mailbox, and any marketing messages. You can withdraw consent at any time; it does not affect what was done before.
• To meet legal obligations: keeping financial and tax records, and responding to lawful requests from authorities.
• For our legitimate interests, balanced against yours: preventing fraud and fake documents, keeping accounts secure, fixing faults and improving the service.

A host organisation (attachment)

Only the student allocated to it, and only what it needs to receive them: name, course and institution, qualification level and year of study, county, availability dates, and email and phone. A host never sees your uploaded documents, assessment scores, payment history, or any other student.

An employer (internships and jobs)

Only when you apply to its vacancy: your profile, CV, cover note, verified skills and assessment results relevant to the role. Your email and phone are shared only once the employer shortlists you. Your documents and identification are never shared.

An employer you applied to may keep you in its talent pool, to invite you to apply for a later role. We tell you when it does; it keeps what it already saw from your application, and nothing new. If you choose “Keep me in mind” on an employer’s careers page, it sees your name, headline and county. You can leave any pool at any time from My Career.

Your institution

If your institution works with us, it can see which of its students are at which stage of attachment. It does not see your scores, documents or contact details through us.

Your institution may also put you on its own attachment list and invite you, by email, to link your profile. Nothing is linked unless you accept. If you do, it can also see your host and reporting date once placed, whether your CV and introduction letter are in place, and when you last wrote your logbook, and it can issue your introduction letter straight into your documents. Anyone holding that letter can check it at the address printed on it, which shows only what the letter says. You can unlink at any time under Account, Privacy.

Our team

Staff see what their role needs (for example, document reviewers see documents; finance sees payments). Sensitive actions are recorded in an audit log that cannot be edited.

Authorities

Where the law requires it, for example a court order or a request we are legally bound to answer.

We do not sell personal data. You can see and change who can find your profile under Account → Privacy.

We use trusted providers to run the service. They process data only on our instructions:

• Railway (application hosting and database) and Supabase (secure file storage for uploaded documents).
• Safaricom M-Pesa (payments).
• Resend (sending account and notification emails).
• OpenAI (AI features: checking documents, reading CVs and job adverts, drafting letters). We send only what the task needs.
• Sentry (error monitoring, configured not to collect personal details by default).
• Google or Microsoft, only if you connect your mailbox for Smart Applications.

Some of these providers store or process data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires, including contractual commitments to protect the data to a standard at least equivalent to Kenyan law.

Some steps are automated: multiple-choice assessment answers are marked by the system, uploaded documents are checked by an AI model, and match scores estimate how well a profile fits an opportunity.

Doubtful document checks go to a person. Written answers are marked by a person. A match score is information for you and for employers, never a decision on its own. If an automated result affects you and you disagree, ask us and a person will review it.

• Your account and profile: while your account is open, and deleted or anonymised when you ask us to close it.
• Expired or signed-out sessions: 7 days.
• Notifications you have read: 90 days.
• The text of emails we sent you: 30 days (the record that an email was sent is kept).
• A place in an employer’s talent pool: 12 months from when it was given, then deleted. You can leave sooner from My Career.
• Payment, receipt and audit records: as long as Kenyan tax and accounting law requires, even after an account is closed.
• Placement records and verified evidence: while your account is open, because they are your verified work history. You can ask us to delete them.

• All connections to the site are encrypted.
• Uploaded files are held until a virus scan passes, and are stored privately, never as public links.
• Mailbox permissions are encrypted, and passwords are stored only as secure hashes.
• Staff accounts require two-step verification, and sensitive actions are recorded in an audit log.

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used (this notice);
• get a copy of the data we hold about you;
• have inaccurate data corrected;
• have data deleted where we no longer need it or have no lawful basis to keep it;
• object to processing, including any direct marketing;
• receive your data in a format you can move to another service;
• not be subject to a decision based only on automated processing that significantly affects you.

To use a right, email careercraftconnections206@gmail.com from the address on your account. We may ask you to confirm your identity, and we respond within the time the Act and its regulations allow. Many settings you can change yourself under Account → Privacy.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke.

A parent or guardian must agree on your behalf before you create an account or use CareerCraft Connections. If we learn that we hold a child’s data without that agreement, we will delete it.

We send tips, guides and opportunity round-ups only if you ask for them — the box at sign-up is never ticked for you, and you can change it in your account settings. Every one of those emails has a one-click unsubscribe that works without signing in. Emails about your account, placements and payments are separate: you get those whatever you choose, because you need them.

Cookies the site needs to work are always on: one that keeps you signed in, a short-lived security cookie while you connect a mailbox, and one that remembers your cookie choice.

We do not use analytics or advertising cookies. If that changes, we will ask for your permission first and update this notice.

When we change this notice we update the date at the top. If a change affects how we use data you have already given us, we will tell you by email or in your account before it takes effect.