1. Data Controller
The data controller responsible for your personal data is:
Eens Business Park, Mombasa Road
Nairobi, Kenya
Email: advisory@2maxgroup.com
Phone: +254 720 609 482
Website: www.2maxgroup.com
Two Max Group is registered with the Office of the Data Protection Commissioner (ODPC) of Kenya as a data controller and data processor as required under Section 18 of the Kenya Data Protection Act, 2019 (Cap. 411C).
2. Scope of this Policy
This Privacy Policy applies to:
- Visitors to www.2maxgroup.com and all its subpages
- Clients, prospective clients, and their authorised representatives
- Employees, contractors, and workers placed under our Employer of Record (EOR) and payroll services
- Job applicants and candidates introduced through our recruitment and executive search services
- Individuals whose immigration, work permit, or corporate secretarial files we manage
- Any person who contacts us via our website, email, telephone, or WhatsApp
This policy does not cover the privacy practices of third-party websites that may be linked from our site. We encourage you to review the privacy policies of any third-party sites you visit.
3. Data We Collect
3.1 Website Visitors
- IP address and general geographic location (country/city level)
- Browser type, device type, and operating system
- Pages visited, time on site, referral source, and navigation paths
- Cookie identifiers (see Section 13)
- Language preference (via Google Translate cookie)
3.2 Contact Form & Enquiry Submissions
- Full name, work email address, and telephone number (including dial code)
- Company name, job title, and country of location
- Service enquiry details including headcount, timelines, and budget range
- Any additional information you provide in the message field
3.3 Client & Service Data
When we provide EOR, payroll, HR, or corporate services, we collect and process:
- Employee personal details: full name, date of birth, national ID or passport number, KRA PIN, NSSF number, SHIF number
- Contact details: residential address, personal email, personal phone number
- Employment data: job title, department, start date, contract type, probation period, leave records, performance records
- Payroll data: gross salary, allowances, deductions, net pay, bank account details, PAYE tax codes
- Statutory registration data: KRA iTax credentials (managed on your behalf), NSSF, SHIF, and Housing Levy registration details
- Bank account details for payroll disbursement
- Immigration data: nationality, passport details, visa status, work permit class and expiry, entry/exit records
- Next-of-kin and emergency contact details
- Health information where required for statutory insurance or SHIF registration
- Disciplinary records, grievance notes, and employment tribunal correspondence
3.4 Recruitment & Executive Search
- Curriculum vitae, professional profile, and cover letter
- Academic and professional qualifications and certificates
- Employment history and references
- Criminal background check results (where consented)
- Academic verification results
- Salary expectations and notice period
3.5 Corporate Services
- Director and shareholder identification documents (passport, national ID)
- KRA PIN certificates
- Company registration documents, memoranda, and articles of association
- Bank account opening documentation
- Business licence applications and supporting material
4. Legal Basis for Processing
We process personal data on the following legal grounds under the Kenya Data Protection Act, 2019 and, where applicable, GDPR Article 6:
| Processing Activity | Legal Basis (DPA 2019) | GDPR Equivalent |
|---|---|---|
| Payroll & statutory compliance | Legal obligation (KRA, NSSF, SHIF) | Art. 6(1)(c), Legal obligation |
| EOR employment contracts | Contract performance | Art. 6(1)(b), Contract |
| Work permit processing | Legal obligation & contract | Art. 6(1)(b)(c) |
| Company registration filings | Legal obligation | Art. 6(1)(c) |
| Recruitment services | Consent & legitimate interest | Art. 6(1)(a)(f) |
| Website analytics | Legitimate interest | Art. 6(1)(f) |
| Contact form responses | Consent & contract | Art. 6(1)(a)(b) |
| Marketing communications | Consent | Art. 6(1)(a) |
| Background screening | Explicit consent | Art. 9(2)(a), Explicit consent |
Where we rely on consent as a legal basis, you may withdraw that consent at any time by contacting us at advisory@2maxgroup.com. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
5. How We Use Your Data
5.1 Service Delivery
- Processing monthly payroll and filing PAYE, NSSF, SHIF, and Housing Levy returns on KRA iTax
- Drafting and managing employment contracts under the Employment Act Cap. 226
- Managing work permit and Special Pass applications with the Department of Immigration
- Registering and maintaining companies with the Business Registration Service (BRS) via eCitizen
- Managing employee onboarding, offboarding, and HR records
- Conducting and reporting on HR compliance audits
- Responding to enquiries submitted through our website contact form
5.2 Legal & Regulatory Compliance
- Filing statutory returns with the Kenya Revenue Authority (KRA)
- Meeting obligations under the Employment Act Cap. 226, the National Social Security Fund Act, and the Social Health Insurance Fund Act
- Complying with orders from the Employment and Labour Relations Court
- Responding to lawful requests from government authorities
- Retaining records as required by Kenyan tax and employment law
5.3 Communication
- Responding to enquiries and providing proposals
- Sending payslips, statutory receipts, and compliance reports to clients
- Issuing HR and compliance updates, regulatory alerts, and newsletters (where consented)
- Communicating with employees and workers on employment matters
5.4 Website Improvement
- Analysing website traffic via Google Analytics 4 to improve content and user experience
- Monitoring website security and detecting fraudulent or abusive activity
- Improving the functionality of our online tools and calculators
6. HR & Payroll Data (Sensitive Processing)
HR, payroll, and employment data is among the most sensitive personal data we process. We apply the highest standards of care to this category of data, consistent with our obligations under Section 46 of the Kenya Data Protection Act, 2019 and applicable employment law.
6.1 Data We Process as Data Processor
When acting as an Employer of Record or payroll processor for a client, Two Max Group acts as a data processoron behalf of the client (who is the data controller). We process employee personal data strictly in accordance with the client's documented instructions and our Data Processing Agreement (DPA).
6.2 Data We Process as Data Controller
When we are the legal employer of a worker under our EOR service, Two Max Group acts as both data controller and employerwith respect to that worker's employment records, payroll data, and statutory filings.
6.3 Special Category Data
Certain data we process may constitute special category (sensitive) personal data, including health information (for SHIF registration or sick leave records), immigration status, and criminal background check results. We process such data only where:
- The data subject has given explicit written consent
- Processing is necessary to carry out our obligations or exercise rights in the field of employment law
- Processing is required for compliance with a legal obligation
6.4 Bank Account & Financial Data
Bank account details provided for payroll disbursement are used exclusively for that purpose. They are stored in encrypted form and transmitted only via secure, TLS-encrypted channels to our banking partners.
7. Third-Party Services
Our website uses the following third-party services that may process personal data. We have appropriate data processing agreements or standard contractual clauses in place with each provider.
9. International Data Transfers
Our primary operations are based in Kenya. Some personal data may be transferred to or processed in countries outside Kenya, including the United States and the European Economic Area, in connection with the third-party services listed in Section 7.
For such transfers, we rely on appropriate safeguards under Section 48 of the Kenya Data Protection Act, 2019, including:
- Standard Contractual Clauses (SCCs) approved by the ODPC or the European Commission
- Adequacy decisions where the recipient country has been deemed to offer adequate protection
- Binding corporate rules where applicable
- Explicit consent of the data subject for specific transfers
10. Data Retention
| Data Category | Retention Period | Legal Basis for Retention |
|---|---|---|
| Payroll records & payslips | 7 years from date of processing | KRA iTax & Income Tax Act Cap. 470 |
| Employment contracts | 7 years after termination | Employment Act Cap. 226 |
| NSSF / SHIF records | 7 years | NSSF Act & SHIF Act |
| Work permit files | 5 years after expiry | Immigration Act |
| Company registration docs | Duration of company + 7 years | Companies Act 2015 |
| HR compliance audit reports | 5 years | Employment Act Cap. 226 |
| Website enquiry / contact forms | 3 years from last contact | Legitimate interest |
| Recruitment / candidate CVs | 1 year from last contact (or sooner on request) | Consent |
| Website analytics data | 26 months (Google Analytics default) | Legitimate interest |
| Website cookies | Session to 2 years depending on type | See Section 13 |
After the applicable retention period, data is securely deleted or anonymised. Where deletion is not immediately possible (e.g. data stored in backup systems), the data is isolated and protected from further processing until deletion is possible.
11. Your Rights
Under the Kenya Data Protection Act, 2019 (Sections 26-38) and, where applicable, the GDPR, you have the following rights with respect to your personal data:
12. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction, consistent with Section 41 of the Kenya Data Protection Act, 2019.
- All data in transit is encrypted via TLS 1.2 or higher (HTTPS)
- Payroll and employment records are stored in access-controlled, encrypted cloud systems
- Access to personal data is restricted to authorised personnel on a strict need-to-know basis
- All staff handling personal data are bound by written confidentiality obligations
- We conduct regular internal security reviews of our data processing systems
- Passwords and access credentials are stored using industry-standard hashing algorithms, never in plain text
- Bank account and financial data is transmitted only through encrypted channels to regulated banking partners
- We maintain a documented incident response procedure for notifying the ODPC and affected individuals of data breaches within the statutory 72-hour window
Data breach notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ODPC within 72 hours of becoming aware and will inform affected data subjects without undue delay as required under Section 43 of the DPA 2019.
14. Children's Data
Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data without appropriate parental consent, please contact us immediately at advisory@2maxgroup.com and we will delete such data promptly.
15. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. Where changes are material, we will notify you by posting a prominent notice on our website and, where we hold your contact details, by email.
The “Last Updated” date at the top of this policy indicates when it was most recently revised. We encourage you to review this policy periodically.
16. Contact & Complaints
For any questions, data subject requests, or concerns about how we handle your personal data, please contact our Data Protection Officer:
Two Max Group Limited
Eens Business Park, Mombasa Road, Nairobi
Email: advisory@2maxgroup.com
Phone: +254 720 609 482
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya:
If you are located in the European Economic Area, you also have the right to lodge a complaint with the supervisory authority in your country of residence or the authority where the alleged infringement occurred.