How we handle yourPersonal Data

Kora is the data controller of your Personal Data and, if you have any queries in relation to your Personal Data, this policy or any related matters, please contact our Data Protection Officer at dpo@korapay.com.

The Personal Data we process about you includes your name, contact details and People Ops Data. This Personal Data is used by us to run our business and manage our workforce.

We collect, use and process your Personal Data where: (i) this is necessary for the purposes of a legitimate interest pursued by us, such as managing the workforce, considering your recruitment process with us, and the protection of our business, (this is not applicable to applicants resident in Nigeria); (ii) we are permitted or required to do so by applicable law; (iii) this is necessary in connection with your employment contract or (iv) you have consented to us processing your information for a specific reason.

We do not collect, use or otherwise process your Special Categories of Personal Data, except where: (i) we are required or permitted to do so by law; or (ii) we have, in accordance with applicable law, obtained your explicit consent to process such Personal Data.

We may obtain Personal Data about you from third parties, (e.g. former employers, referees, educational institutions, etc.) for purposes such as gathering references, administering pensions and other purposes permitted by law. When we obtain Personal Data about you from third parties, we will do so in accordance with applicable law.

Appendix 1 provides an indicative, non-exhaustive, list of the categories of Personal Data that we may process about you.

If any information which you provide to us relates to any third party (such as a spouse or next of kin), by providing us with such Personal Data you confirm that you are permitted to give this information.

We take reasonable and proportionate steps to ensure that the Personal Data we process is: (i) accurate, up-to-date and complete; and (ii) limited to the Personal Data required. Candidates are responsible for ensuring that they update any changes to their personal details, e.g. change of address, phone number, marital status, etc.

Some personnel across Kora will have access to your business contact information such as name, position, work email address, telephone number and address. Access to, use of and other processing of Personal Data by Kora will be limited to individuals who have a need to know the information for the purposes described in this Notice, which may include your appraiser or others appointed by him or her, as well as personnel in People Operations, IT, Risk and Compliance, Legal and Finance.

From time to time, we may make Personal Data available to other entities within the Kora group and to other parties, such as legal and regulatory authorities; professional bodies; educational institutions; external professional advisors (such as lawyers, accountants etc.); and service providers (such as providers of payroll, pension scheme, insurance, medical benefits, human resources services, IT systems and support, and other third parties engaged to assist Kora in carrying out business activities) located wherever they operate. Be assured that we only provide your information upon verification of the necessary checks and assurances of sufficient security for your personal data.

Kora may disclose Personal Data to third parties other than service providers: (i) to our merchants or prospective clients, as may be necessary for the performance of your usual duties (ii) if we are required to do so by law, regulation or legal process; (iii) in response to requests by government agencies, where validly backed by law; or (iv) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.

We may disclose your Personal Data in the event that we sell or transfer all, or a portion of, our business or assets (including in the event of a reorganisation, dissolution or liquidation).

We have in place appropriate legal, organisational, physical and technical measures to protect Personal Data consistent with applicable privacy and data security laws. As required by applicable law, when we retain a third-party service provider, that provider will be required to: (i) use measures to protect the confidentiality and security of the Personal Data, and (ii) process the Personal Data only as directed by Kora.

We will only keep the information we collect about you on our systems or with third parties for as long as required for the purposes set out above or as required to comply with any legal obligations to which we are subject.

Where you consent to it, we will retain your application documents in our system for consideration for subsequent employment roles. You will have the opportunity to update such documents or information as the need arises.

Kora will only retain your data as long as is necessary for protecting our legitimate business purpose or legal requirements.

You may have certain rights with respect to our Processing of your Personal Data, which may include the right to: (i) access, modify, correct, update, delete, block, port, cancel, or object to the use of, your Personal Data held by us; (ii) request information about the basis on which your Personal Data is Processed by us; and (iii) withdraw any consent that you have given to us in connection with the Processing of your Personal Data. If you would like to exercise any of these rights that apply to you, ask a question, or raise a complaint regarding the Processing of your Personal Data please contact a member of the privacy team via dpo@korapay.com. Please note that under applicable data protection laws, certain Personal Data or certain uses of your Personal Data may be exempt from the above rights.

Further information about data subject rights can be found in our Privacy Policy.

Candidates are responsible for ensuring that they inform the People Operations team of any changes to their personal details.

Candidates may have access to a certain amount of Personal Data in the course of their work, relating to colleagues, clients and other third parties. Candidates must adhere to the data protection policies and procedures as published by Kora from time to time. Candidates must not access or use Personal Data for any purpose other than in connection with, and to the extent necessary for, your work with us. Your obligation to keep the Personal Data of others confidential continues after termination of your relationship with us.

If you have any queries in respect of this Privacy Notice, please do not hesitate to contact our Data Protection Officer at dpo@korapay.com.

HR Data: personal details such as candidates’ names, dates of birth, social security numbers, bank account details, next of kin, contact details terms and conditions of employment, job details, learning and development, performance review process, salary information, bank account details; job application details; family details such as names and dates of birth of children (e.g. relevant if an individual is applying for parental leave); marital status; gender; additional details required for pension and taxes;

Personal Data: data that relates to a natural person who is identifiable either from the data itself or from the data in conjunction with other information held by Kora.

Processing Personal Data: means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage adaptation or alteration, retrieval, consultation, use disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Special Categories of Personal Data: means data relating to an individual’s racial or ethnic origin; political opinions; religious and philosophical beliefs; membership of a trade union; physical or mental health; genetic data, biometric data; health data or data relating to sex life and sexual orientation.

Applicability: This Notice applies to all jurisdictions where we operate and recruit or have staff.

Updates: This Notice may be updated from time to time to reflect changes in our Personal Data processing practices.

Note that references to candidates may include current, former and potential candidates.

As Kora continues to expand its operations, we may also disclose your Personal Data to countries outside of the jurisdiction where you were primarily employed. These countries may have differing (and potentially less stringent) laws relating to the degree of confidentiality afforded to the information held in your primary jurisdiction and such information can become subject to the laws and disclosure requirements of such countries, including disclosure to governmental bodies, regulatory agencies and private persons, as a result of applicable governmental or regulatory inquiry, court order or other similar process. In addition, a number of countries have agreements with other countries providing for the exchange of information for law enforcement, tax and other purposes.

When we, or our permitted third parties, transfer your information outside your primary jurisdiction, we or they will impose contractual obligations on the recipients of that data to protect your information to the standard required in your primary jurisdiction. We or they may also require the recipient to subscribe to international frameworks intended to enable secure data sharing. In the case of transfers by us, we may also transfer your information where you have specifically consented to the transfer or we have obtained the necessary approval from the regulatory authority. If we transfer your information in other circumstances (for example because we have to provide such information by law), we will seek to put in place appropriate safeguards to ensure that your information remains adequately protected.

The Personal Data relating to you which we may collect, use, transfer, disclose or otherwise process, includes:

This list is non-exhaustive.