SandRose Job Applicant Data Privacy Policy

31 March 2021

1. Introduction

Welcome to the SandRose Job Applicant’s Privacy Policy (the “Privacy Policy”). We appreciate you taking the time to read all Our notices carefully.

SandRose Limited (“SandRose”, “We” “Us” “Our”) is committed to protecting your privacy by ensuring that any personal data is collected and used lawfully and transparently. We process your personal information under the Kenya Data Protection Act 2019.

2. Who is SandRose?

SandRose is a project management and consulting firm specializing in supporting infrastructure projects across Africa with a specific focus on energy transition, infrastructure projects, industrial parks and sustainable cities. Our offices are situated at with offices off Timau Plaza, Off Timau Road, PO Box 25177 00100 Nairobi, Kenya.

3. What is the Purpose of this Policy?

As part of any recruitment process, SandRose collects and processes personal data relating to job applicants so as to assess their fit for an open position. We are committed to being transparent about how We collect and use the data as well as meeting the data protection obligations set out in the Kenya Data Protection Act.

For purposes of the Kenya Data Protection Act, SandRose Limited is a “data controller”. This means that We are responsible for deciding how We hold and use personal information about you. We are required under the Kenya Data Protection Act to notify you of the information contained in this Privacy Policy.

This Privacy Policy explains:

  • How We process your personal data i.e., collect, use, store, transfer or share your personal data.
  • Your data rights as a Job Applicant and how you can exercise them.
  • Your point of contact, should you have any questions about Our use of your personal data.
  • The process of how you can access and update your personal data.

It is important that you read this Privacy Policy so that you are aware of how and why We are collecting or processing personal information about you.

4. What is Personal Data?

For purposes of this Privacy Policy, personal data includes any information about an identifiable individual.

5. What Personal Data Do We Collect and How Do We Use It?

As part of any recruitment process, SandRose collects and processes personal data relating to job applicants. We collect a range of information about you. This includes:

  • your first name, middle name and last name
  • telephone numbers
  • email addresses
  • national identification number or passport number
  • information contained in your curriculum vitae (CV)
  • work/employment history including details of your employment background, position, work experience, skills, competencies
  • information relating to your job expectations
  • education history including degrees, certificates, transcripts
  • current compensation levels including salary and benefits
  • referee names and contact details
  • details of any secondary employment, political declarations, conflict of interest declarations or gift declarations
  • security clearance details including police clearance checks
  • job interview video recordings
  • interview notes and related documentation
  • passport photographs
  • information about your immigration status or eligibility to work in Kenya or in the country where job is located.

SandRose does not usually request for sensitive personal information i.e. information regarding your race, ethnicity, political opinions, religion and religious beliefs, trade union membership, details of your spouse or children, sexual orientation or political affiliation in regards with your application. Unless specifically responding to a question asked by Us, please do not include sensitive personal data as part of your application. If We do require this information in connection with your application, this will be highlighted to you where We will obtain necessary consents and acknowledgements.

SandRose is committed to leveraging each applicant skills and competencies to find the right match for a role in the organisation as opportunities arise.

If you are successfully hired, SandRose keeps this information for the course of the employment relationship and, to the extent permitted, after termination of employment.

If your application is not successful, We may retain and use your personal data for a further five years in order to consider you for other job opportunities where permitted by applicable law and/or for as long as necessary to comply with legal record retention requirements. if you do not wish Us to retain your personal data, please contact Us on

6. How is Your Personal Data Collected?

We get information about you from the following sources:

  • Directly from you. For example the information may be contained in your CV, application letter, your identification documents or it may be gathered form interviews or assessments that you take during the interview process.
  • Automatically-collected information – this includes:
      • Online identifiers such as IP addresses, domain names, information about pages you view on Our website including but not limited to the links clicked, traffic data, features used,
      • Cookies or similar activity – cookies (small text files stored in a user’s browser), beacons (electronic images that allow Us to count users who have accessed particular content and to access certain cookies), the tags through the website, tracking technology.
  • From a recruitment or employment agency. We may also receive your CV and information from recruitment agencies whom We have engaged to carry Our recruitment on Our behalf.
  • From your references or background checks providers. We contact your employment references to obtain personal information relating to your employment. We may also obtain such information from background check providers whom We shortlist from time to time.
  • From your LinkedIn or other publicly available professional networking platforms – We may sometimes obtain your contact details from these platforms. Where We do so, We adhere to the platform’s terms and your privacy settings. We will only contact you if your settings and the terms of use permit Us to do so.

7. Why We Collect, Use and Store Personal Data

SandRose processes your personal data for the following purposes:

  • To establish and perform the employment contract. We assess your capabilities and job qualifications so as to make a decision about your recruitment or appointment.
  • Where necessary for SandRose legitimate interests as listed below, where those interests are not overridden by you data protection rights:
  • sourcing talent and administering the recruitment process
  • managing the selection process and making an appropriate employment offer
  • protection Our legitimate business interests and legal rights
  • carrying out background checks to verify the details you have supplied during the recruitment
  • To respond to queries that you may raise during your interview.
  • Where required by applicable laws: Immigration documentation is processed to ensure the candidate is entitled to work in the country where job is located.
  • To comply with specific provisions of law concerning personal data processing at work for reasons of substantial public interest as may be determined by law.

8. International Transfer

Although We are based in Kenya, We may carry out assignments in countries outside of Kenya and We may therefore seek to recruit candidates globally. This means your information may be stored or processed outside of the country or region where it was originally collected. Regardless of where your information is processed, We apply the same protections described in this Policy. We also comply with the Kenya Data Protection Act in relation to the transfer of your data.

9. How Your Personal Information is Shared

Your personal data may be shared with service providers acting on SandRose’s behalf for the purposes of verification/background checks. These service providers may be located outside the country in which you live or the country where the position you have applied for is located.

SandRose may sometimes be required to disclose your personal data to external third parties such as local labour authorities, courts and tribunals, regulatory bodies and/or law enforcement agencies for the purpose of complying with applicable local laws and regulations or in response to legal process.

SandRose may also share your personal data with other third parties if We have your consent (for example if you have given Us permission to contact your referees) or to detect or prevent or otherwise address fraud, security or technical issues or protect against harm to the rights, property or safety of SandRose, Our users, applicants, candidates, employees, the public or as otherwise required by law.

10. How We Protect Your Personal Data

SandRose has taken appropriate technical, administrative, physical and procedural security measures, consistent with local and international information practices, to protect the personal data from misuse, unauthorized access or disclosure, loss, alteration, or destruction. These measures include:

  • Physical safeguards – such as locked doors and file cabinets, controlled access to Our facilities, and secure destruction of media containing personal data.
  • Technology safeguards – such as use of anti-virus and endpoint protection software, passwords, encryption, and monitoring of Our systems and data centres to ensure compliance with Our security policies.
  • Organizational safeguards – through training and awareness programs on security and privacy, to ensure employees understand the importance and means by which they must protect personal data, as well as through privacy policies and policy standards that govern how SandRose treats personal data

11. Your Rights

You have the right to ask SandRose for a copy of your personal data, to correct, delete or restrict processing of your personal data; and to obtain the personal data you provide in a structured, machine readable format.

In addition, you can object to the processing of your personal data in some circumstances (in particular where We don’t have to process the personal data to meet a contractual or other legal requirement).

Where We have asked for your consent, you may withdraw consent at any time. If you ask to withdraw your consent to SandRose processing your personal data, this will not affect any processing which has already taken place at that time. There are exceptions to these rights so that access may be denied, for example, if making the information available would reveal personal information about another person or if SandRose is legally prevented from disclosing such information. Relevant exemptions are included in the Kenya Data Protection Act. We will inform you of relevant exemptions We rely upon when responding to any request you make.

If you have unresolved concerns, you have the right to complain to the Data Commissioner in Kenya. You may also be able to seek a remedy through the courts if you believe that your rights have been breached.

Any aptitude tests taken form part of the application process but are not solely determinative of your outcome or success.

It is important that We maintain up to date records of key information on you. Please notify Us of any changes in your personal circumstances as soon as they occur (e.g., change of address,).

Where We require personal data to comply with legal or contractual obligations, then provision of such personal data is mandatory: if such personal data is not provided, then We will not be able to manage the recruitment process or meet obligations placed on Us. In all other cases, provision of requested personal data is optional. However, We may not be able to process your application properly. You can exercise your rights by using the contact details below.

12. How to Exercise Your Rights

  • If you wish to exercise any of the rights outlined above, please write an email to the Data Protection Officer (DPO) on
  • We will endeavour to answer all questions via email within one month after receipt.
  • That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. In that event, We will keep you informed of the progress on your request.
  • If the provision of the data involves the data of third parties, these third parties can be asked in advance whether they have objections to the provision.
  • We may ask for identification, because We need to know for certain whether We are issuing the data to the right person.
  • In some cases, We will not be able to comply with your request. We may, for example, not be required to delete the data SandRose is legally obliged to retain.

13. To Whom Shall I Direct a Question or Complaint?

If you have any questions or complaints about the processing of personal data, you can contact SandRose on

14. Changes to this Privacy Policy

This Privacy Policy may be updated periodically. We will update the date at the top of this Privacy Policy accordingly. On some occasions, We may also actively advise you of specific data handling activities or significant changes to this Privacy Notice as required by applicable law.


How can we help?

Get in touch