Data Collection & Usage Disclosure

Effective 3 November 2026Version 1.0

What TalentOS collects about each type of user, why, on what legal basis, who sees it and how long it is kept. It follows our record of processing activities and our retention schedule. Items marked as consent are optional and stay off until you turn them on.

This document is available in English, Kiswahili, French and Arabic. If the versions differ, the English version prevails.

1.Everyone with an account

What we collect	Why	Legal basis	Who sees it	How long
Name, email, mobile number, password hash, language	Create and secure your account; sign-in codes and service messages	Contract	You, El Roi, your organisation's administrators	Life of the account; anonymised 30 days after closure
Sign-in records, IP address, device, security logs	Protect accounts and investigate misuse	Legitimate interests	El Roi security staff	Sessions 30 days after expiry; audit logs 24 months
Consent and privacy-notice decisions, with time and IP address	Show what you agreed to, and when	Legal obligation	You and El Roi	Life of the account, plus the audit period
Age and eligibility confirmation	Make sure under-18 trainees go through guardian consent	Legal obligation (children's data) and contract	El Roi and your institution	Life of the account, plus the audit period
Marketing preference (email or SMS)	Send news, programme offers and partner opportunities	Consent (optional, off by default)	El Roi and its SMS and email providers	Until you withdraw it; SMS records 90 days
Requests for a copy, correction or deletion of your data	Answer your data-protection requests	Legal obligation	You, El Roi's Data Protection Officer, and your institution for trainees	As long as needed to show the request was handled

What we collect: Name, email, mobile number, password hash, language
Why: Create and secure your account; sign-in codes and service messages
Legal basis: Contract
Who sees it: You, El Roi, your organisation's administrators
How long: Life of the account; anonymised 30 days after closure

What we collect: Sign-in records, IP address, device, security logs
Why: Protect accounts and investigate misuse
Legal basis: Legitimate interests
Who sees it: El Roi security staff
How long: Sessions 30 days after expiry; audit logs 24 months

What we collect: Consent and privacy-notice decisions, with time and IP address
Why: Show what you agreed to, and when
Legal basis: Legal obligation
Who sees it: You and El Roi
How long: Life of the account, plus the audit period

What we collect: Age and eligibility confirmation
Why: Make sure under-18 trainees go through guardian consent
Legal basis: Legal obligation (children's data) and contract
Who sees it: El Roi and your institution
How long: Life of the account, plus the audit period

What we collect: Marketing preference (email or SMS)
Why: Send news, programme offers and partner opportunities
Legal basis: Consent (optional, off by default)
Who sees it: El Roi and its SMS and email providers
How long: Until you withdraw it; SMS records 90 days

What we collect: Requests for a copy, correction or deletion of your data
Why: Answer your data-protection requests
Legal basis: Legal obligation
Who sees it: You, El Roi's Data Protection Officer, and your institution for trainees
How long: As long as needed to show the request was handled

2.Trainees and students

What we collect	Why	Legal basis	Who sees it	How long
Admission number, programme, intake and phone from the institution's register; whether you are under 18	Activate your account and run your studies	The institution's legal basis; El Roi processes on its behalf	Your institution and El Roi	While you are enrolled, then by the institution's schedule
Classes, attendance, CAT and exam results, attachment records and logbooks	Teaching, assessment, attachment and reports to regulators	The institution's legal obligations and contract	Your trainers, HOD, ILO and institution administrators; your attachment supervisor	By the institution's schedule; official results may be kept after erasure
Learning progress, projects, skills, credentials and CV	Your learning track, skill gap and career readiness	Contract	You and your trainers; employers only when you share	Life of the account
Messages to the AI tutor, counsellor, interviewer and coach; transcripts and AI reports	AI feedback, practice and learning plans	Consent (optional)	You; the AI model provider processes it for us	Up to 365 days; deleted when you withdraw consent
Live camera and microphone in video avatar sessions; voice practice audio	Live avatar sessions and voice practice	Consent (optional, off by default)	Beyond Presence for avatars; your browser's speech service for voice practice	Video is never stored by TalentOS; transcripts up to 365 days
First name and initial, verified skills, readiness, programme and county	Let employers find you in Talent Radar and talent search	Consent (optional, off by default)	Employers on TalentOS	Until you withdraw; you leave search within 15 minutes
Profile snapshot and AI interview report sent with a job application	Apply for a job	Consent for each application	The employer of that opening	The employer's own retention, as a controller
Guardian consent record for trainees under 18 (the guardian's phone is kept only in coded form)	Protect children's data	Legal obligation (section 33 of the Act)	Your institution and El Roi	While you are enrolled

What we collect: Admission number, programme, intake and phone from the institution's register; whether you are under 18
Why: Activate your account and run your studies
Legal basis: The institution's legal basis; El Roi processes on its behalf
Who sees it: Your institution and El Roi
How long: While you are enrolled, then by the institution's schedule

What we collect: Classes, attendance, CAT and exam results, attachment records and logbooks
Why: Teaching, assessment, attachment and reports to regulators
Legal basis: The institution's legal obligations and contract
Who sees it: Your trainers, HOD, ILO and institution administrators; your attachment supervisor
How long: By the institution's schedule; official results may be kept after erasure

What we collect: Learning progress, projects, skills, credentials and CV
Why: Your learning track, skill gap and career readiness
Legal basis: Contract
Who sees it: You and your trainers; employers only when you share
How long: Life of the account

What we collect: Messages to the AI tutor, counsellor, interviewer and coach; transcripts and AI reports
Why: AI feedback, practice and learning plans
Legal basis: Consent (optional)
Who sees it: You; the AI model provider processes it for us
How long: Up to 365 days; deleted when you withdraw consent

What we collect: Live camera and microphone in video avatar sessions; voice practice audio
Why: Live avatar sessions and voice practice
Legal basis: Consent (optional, off by default)
Who sees it: Beyond Presence for avatars; your browser's speech service for voice practice
How long: Video is never stored by TalentOS; transcripts up to 365 days

What we collect: First name and initial, verified skills, readiness, programme and county
Why: Let employers find you in Talent Radar and talent search
Legal basis: Consent (optional, off by default)
Who sees it: Employers on TalentOS
How long: Until you withdraw; you leave search within 15 minutes

What we collect: Profile snapshot and AI interview report sent with a job application
Why: Apply for a job
Legal basis: Consent for each application
Who sees it: The employer of that opening
How long: The employer's own retention, as a controller

What we collect: Guardian consent record for trainees under 18 (the guardian's phone is kept only in coded form)
Why: Protect children's data
Legal basis: Legal obligation (section 33 of the Act)
Who sees it: Your institution and El Roi
How long: While you are enrolled

3.Institution and El Roi staff

What we collect	Why	Legal basis	Who sees it	How long
Name, title, role, department and work contacts	Give you the access your role needs	Contract with your organisation	Your organisation's administrators and El Roi	While you are a member, then anonymised
Actions on records, such as marks, approvals and register changes	Accountability and audit	Legal obligation and legitimate interests	Your organisation's administrators and El Roi auditors	Audit logs 24 months
AI drafts you ask for: CAT questions, score suggestions, report summaries	Save time; a person approves every result	Legitimate interests of the institution	You and colleagues with access	Up to 365 days

What we collect: Name, title, role, department and work contacts
Why: Give you the access your role needs
Legal basis: Contract with your organisation
Who sees it: Your organisation's administrators and El Roi
How long: While you are a member, then anonymised

What we collect: Actions on records, such as marks, approvals and register changes
Why: Accountability and audit
Legal basis: Legal obligation and legitimate interests
Who sees it: Your organisation's administrators and El Roi auditors
How long: Audit logs 24 months

What we collect: AI drafts you ask for: CAT questions, score suggestions, report summaries
Why: Save time; a person approves every result
Legal basis: Legitimate interests of the institution
Who sees it: You and colleagues with access
How long: Up to 365 days

4.Employers and their teams

What we collect	Why	Legal basis	Who sees it	How long
Organisation name, KRA PIN, registration, sector and contacts	Verify the employer and handle billing	Contract and legal obligation (tax)	El Roi; learners see the public company profile	While the organisation is active; tax records as the law requires
Job descriptions, openings, shortlists, interview notes and offers	Hiring and attachment	Contract	Your team; applicants see their own status	While the opening is active, then the employer's own retention
AI job-description drafts, match scores and their explanations	Help you write openings and review candidates	Legitimate interests; advisory only	Your team	Up to 365 days
Invoices and M-Pesa references	Payments	Contract and legal obligation	Your billing administrators and El Roi finance	As long as tax law requires

What we collect: Organisation name, KRA PIN, registration, sector and contacts
Why: Verify the employer and handle billing
Legal basis: Contract and legal obligation (tax)
Who sees it: El Roi; learners see the public company profile
How long: While the organisation is active; tax records as the law requires

What we collect: Job descriptions, openings, shortlists, interview notes and offers
Why: Hiring and attachment
Legal basis: Contract
Who sees it: Your team; applicants see their own status
How long: While the opening is active, then the employer's own retention

What we collect: AI job-description drafts, match scores and their explanations
Why: Help you write openings and review candidates
Legal basis: Legitimate interests; advisory only
Who sees it: Your team
How long: Up to 365 days

What we collect: Invoices and M-Pesa references
Why: Payments
Legal basis: Contract and legal obligation
Who sees it: Your billing administrators and El Roi finance
How long: As long as tax law requires

5.Mentors

What we collect	Why	Legal basis	Who sees it	How long
Name, expertise, availability and declarations	List you as a mentor and arrange bookings	Contract	Learners who can book you, and El Roi	While you are a mentor
Session bookings, notes and feedback	Run mentoring and keep it safe	Contract and legitimate interests	You, the learner and El Roi safeguarding staff	Life of the account

What we collect: Name, expertise, availability and declarations
Why: List you as a mentor and arrange bookings
Legal basis: Contract
Who sees it: Learners who can book you, and El Roi
How long: While you are a mentor

What we collect: Session bookings, notes and feedback
Why: Run mentoring and keep it safe
Legal basis: Contract and legitimate interests
Who sees it: You, the learner and El Roi safeguarding staff
How long: Life of the account

Questions about this document? Write to El Roi's Data Protection Officer at amitwashington7@gmail.com.