Privacy and Data Protection Notice

1. Introduction

Recroot Africa respects your privacy and is committed to protecting your personal data.

This Privacy and Data Protection Notice explains how Recroot Africa collects, uses, stores, shares and protects personal data when you:

• Visit the Recroot Africa website.
• Apply for an employment opportunity.
• Submit your profile to our talent pool.
• Participate in coaching, training or other programmes.
• Register for an event.
• Subscribe to the Recroot Africa monthly newsletter.
• Request recruitment, managed services or other employer services.
• Contact us by email, telephone, website form or another communication channel.
• Use the Recroot Africa Digital Assistant.

We process personal data in accordance with the laws of Tanzania, including the Personal Data Protection Act, 2022 and the Personal Data Collection and Processing Regulations, 2023.

2. About Recroot Africa

Recroot Africa Enterprise, referred to in this notice as “Recroot Africa”, is responsible for deciding how and why personal data submitted through its website and services is processed.

Office address
11 Zanaki Street
Opposite Maratha Club / Badminton Institute
Dar es Salaam, Tanzania

Privacy email: hr@rec-rootafrica.com
Telephone: +255 694 933 250
Website: https://rec-rootafrica.com

Questions or requests concerning personal data should be sent to the privacy email above with the subject line Privacy Request.

3. Personal data we may collect

The personal data we collect depends on how you interact with Recroot Africa.

3.1 Candidates and talent-pool members

We may collect:

• Full name and contact details.
• Country, location and nationality information.
• Curriculum vitae, professional profile or portfolio.
• Employment history and professional experience.
• Education, training, qualifications and certifications.
• Skills, professional interests and career preferences.
• Current or previous job title.
• Salary information and compensation expectations.
• Preferred roles, locations and working arrangements.
• References and referee contact details.
• Interview notes, assessment results and recruitment communications.
• Information concerning eligibility or authorization to work.
• Information provided through application forms, emails or shared document links.
• Publicly available professional information where it is lawful and relevant to recruitment.
• Background, reference or police-clearance information where appropriate and permitted by law.

Please ensure that you have permission before providing another person's information, including referee contact details.

3.2 Employers, clients and business contacts

• Names and business contact details.
• Employer or organization information.
• Recruitment, workforce and service requirements.
• Job descriptions and candidate requirements.
• Consultation requests and meeting information.
• Contracts, proposals, invoices and payment records.
• Communications and feedback relating to our services.

3.3 Coaching, training and event participants

• Names and contact details.
• Professional and career information.
• Programme or event selections.
• Attendance and participation information.
• Coaching objectives and feedback.
• Payment and transaction information where applicable.
• Accessibility or support requirements that you choose to disclose.

3.4 Newsletter subscribers

When you subscribe to the Recroot Africa monthly newsletter, we may collect:

• Your email address.
• Your subscription consent and the date it was provided.
• Subscription, delivery and unsubscribe records.

3.5 Website and technical information

The website and its hosting or security services may process limited technical information needed to operate and protect the website, including:

• Internet Protocol address.
• Browser and device type.
• Date and time of access.
• Pages requested.
• Website security and diagnostic logs.

3.6 Sensitive personal data

Some recruitment activities may involve personal data that requires additional protection, such as salary information, health or disability information, criminal-record information, identification documents or other sensitive information.

We will only request or process sensitive personal data when it is relevant, necessary and legally permitted. Access will be restricted to authorized persons.

Candidates should not send sensitive information unless Recroot Africa has requested it for a legitimate and clearly explained purpose.

4. How we collect personal data

We may collect personal data:

• Directly from you through forms, applications, emails, interviews, calls or meetings.
• From referees you have identified.
• From employers or clients involved in a recruitment process.
• From recruitment and workforce partners.
• From publicly available professional sources where relevant and lawful.
• From service providers supporting recruitment, assessments or background checks.
• Automatically through limited website hosting and security systems.

5. Why we process personal data

Recroot Africa may process personal data to:

• Receive and administer employment applications.
• Assess candidates against role requirements.
• Communicate with candidates during recruitment.
• Match candidates with suitable opportunities.
• Present suitable candidates to prospective employers.
• Verify qualifications, experience, references and other relevant information.
• Maintain an optional talent pool for future opportunities.
• Provide coaching, CV editing, training and job-market-readiness services.
• Organize events and professional programmes.
• Send the monthly newsletter to people who have subscribed.
• Respond to enquiries and consultation requests.
• Provide recruitment, managed services and workforce support to employers.
• Manage client relationships, contracts, payments and service delivery.
• Improve the website and the quality of our services.
• Protect the website, candidates, clients and Recroot Africa against fraud or misuse.
• Meet legal, regulatory, contractual and reporting obligations.
• Establish, exercise or defend legal claims.

6. Legal bases for processing

Depending on the activity, Recroot Africa may process personal data based on:

• Consent: Where you have freely agreed to a particular use of your information.
• Steps requested before entering a contract: For example, responding to an application or service request.
• Performance of a contract: Where processing is necessary to provide an agreed service.
• Legal obligation: Where the law requires us to collect, retain or disclose information.
• Legitimate interests: Where processing is necessary for a genuine recruitment or business purpose, provided that the purpose does not unfairly override your privacy rights.
• Establishment or defence of legal claims: Where records are reasonably needed to protect legal rights.

Where we rely on consent, you may withdraw it by contacting hr@rec-rootafrica.com. Withdrawal will not affect processing that was lawful before consent was withdrawn.

Newsletter emails are sent on the basis of consent. Subscribers may withdraw that consent at any time by using the unsubscribe option in a newsletter or by contacting Recroot Africa.

Submitting a form confirms that you have read this notice. Where consent is legally required for a separate activity, such as joining our optional talent pool, Recroot Africa requests that consent separately.

7. Candidate information and prospective employers

Recroot Africa may share a candidate's information with a prospective employer when:

• The candidate has applied for that employer's opportunity.
• The candidate has asked Recroot Africa to represent them.
• The candidate has agreed to be considered for a relevant opportunity.
• Another lawful and clearly communicated basis applies.

We aim to share only information relevant to the recruitment process.

Recroot Africa will not knowingly send a candidate's identifiable profile or CV to an unrelated employer without informing the candidate or having another lawful basis.

Employers receiving candidate information are expected to handle it securely and use it only for the stated recruitment purpose.

8. Background and reference checks

Where relevant to a role, Recroot Africa or an authorized provider may conduct:

• Reference checks.
• Employment-history verification.
• Qualification verification.
• Identity or work-eligibility checks.
• Police-clearance or other background checks permitted by law.

Candidates will be informed when additional checks are required. We will only request information proportionate to the requirements and risks of the role.

9. Who may receive personal data

Recroot Africa may share personal data with:

• Prospective or current employers involved in a recruitment process.
• Authorized Recroot Africa employees and consultants.
• Recruitment, assessment and background-check providers.
• Website hosting, cloud-storage, email, communications and form-processing providers.
• Payment or accounting providers where applicable.
• Professional advisers, including legal and accounting advisers.
• Regulators, courts, law-enforcement agencies or public authorities where disclosure is legally required.
• Cross-border recruitment partners where you are being considered for an international opportunity.

Service providers are expected to process personal data only for authorized purposes and to apply appropriate security and confidentiality measures.

Recroot Africa does not sell or rent personal data.

10. International and cross-border data transfers

Recroot Africa supports recruitment and workforce services across several countries. Personal data may therefore be shared with a prospective employer, recruitment partner or technology provider located outside Tanzania.

Recroot Africa Enterprise has obtained the required Personal Data Protection Commission authorization for cross-border transfers involving overseas employers and technology providers.

When transferring personal data outside Tanzania, Recroot Africa will continue to:

• Assess the recipient and the destination.
• Use appropriate contractual, technical and organizational safeguards.
• Limit the information transferred.
• Obtain consent where required.
• Obtain any additional authorization required for a future transfer that is not covered by the existing authorization.

International candidate information will only be transferred for a legitimate and communicated purpose.

11. How long we retain personal data

Recroot Africa retains personal data only for as long as it is reasonably required for the purpose for which it was collected, subject to legal, contractual and regulatory obligations.

Unsuccessful applications

Information submitted for a specific employment opportunity will normally be retained for up to 12 months after that recruitment process closes.

It may be retained longer where:

• The candidate has separately agreed to join the talent pool.
• A legal obligation requires retention.
• The information is required to establish, exercise or defend a legal claim.

Talent-pool profiles

Profiles submitted for future opportunities or added to the talent pool with permission will normally be retained for up to 24 months from submission or the candidate's last meaningful interaction with Recroot Africa.

Before the period ends, Recroot Africa may ask the candidate whether they wish to remain in the talent pool. If renewed permission is not received, the profile will be deleted or anonymized, unless another lawful retention requirement applies.

Candidates may request removal from the talent pool at any time.

Successful candidates and placements

Information concerning successful candidates may be retained for as long as necessary to manage the placement, onboarding, contractual obligations, compliance requirements and any related legal claims.

Newsletter subscriptions

Newsletter subscription information will normally be retained until the subscriber unsubscribes or withdraws consent. Recroot Africa may retain a limited suppression record where reasonably necessary to ensure that an unsubscribed address is not added again without fresh consent.

Client, programme and business records

Employer, coaching, training, event, financial and contractual records will be retained only for the period required for service delivery, legal compliance, accounting, dispute management or another legitimate operational purpose.

Deletion and anonymization

At the end of the applicable retention period, personal data will be securely deleted, destroyed or anonymized. Limited copies may remain temporarily in secure backups until those backups are overwritten in accordance with normal system procedures.

Information may be retained longer when subject to a legal hold, investigation or regulatory requirement.

12. Recroot Africa Digital Assistant

The Recroot Africa Digital Assistant provides general guidance based on information available on the website.

At present:

• Questions are processed within the visitor's browser.
• Questions and conversations are not transmitted to or stored by Recroot Africa.
• Conversations disappear when the visitor refreshes or closes the page.
• The assistant does not assess candidates or make recruitment, shortlisting or employment decisions.
• The assistant is not a substitute for advice from a member of the Recroot Africa team.

Visitors should not enter confidential, financial, medical or other sensitive personal information into the Digital Assistant.

If a visitor chooses to continue the conversation through email, telephone, a website form or another communication channel, information submitted through that separate channel will be processed in accordance with this notice.

If Recroot Africa changes the assistant so that conversations are stored or sent to an external service, this notice will be updated before that change is introduced.

13. Cookies and website analytics

At the time of this notice, Recroot Africa does not use Google Analytics or non-essential advertising analytics on the website.

The website or its hosting and security providers may use strictly necessary technologies and technical logs to:

• Deliver website pages.
• Maintain security.
• Prevent abuse.
• Diagnose errors.
• Remember essential website settings.

If Recroot Africa introduces non-essential analytics, advertising technologies or additional cookies, this notice will be updated and appropriate consent choices will be provided where required.

14. Data security

Recroot Africa uses reasonable technical and organizational measures to protect personal data against:

• Unauthorized access.
• Accidental loss or destruction.
• Improper disclosure.
• Unauthorized alteration.
• Fraudulent or unlawful use.

These measures may include access controls, confidentiality obligations, secure systems, staff awareness, appropriate service-provider arrangements and procedures for handling security incidents.

No online service can guarantee absolute security. If Recroot Africa becomes aware of a personal-data breach, it will assess the incident and notify affected individuals and the relevant authorities where required by law.

15. Your data-protection rights

Subject to applicable law and any lawful exceptions, you may have the right to:

• Be informed about how your personal data is used.
• Request access to personal data held about you.
• Request correction of inaccurate or incomplete information.
• Request deletion or destruction of personal data.
• Request restriction of processing.
• Object to certain processing activities.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.
• Request information about automated decision-making.
• Complain about how your personal data has been handled.
• Seek compensation where legally available.
• Exercise other rights provided by applicable data-protection law.

The Recroot Africa Digital Assistant does not make automated recruitment or employment decisions.

To exercise a right, email hr@rec-rootafrica.com with the subject line Privacy Request. Please explain your request clearly.

Recroot Africa may need to verify your identity before disclosing or changing personal data. Requests will be handled within the period required by applicable law.

Some requests may be limited where Recroot Africa must retain information to comply with the law, protect another person's rights or establish or defend a legal claim.

16. Children's information

Recroot Africa's recruitment and employer services are primarily intended for adults.

We do not knowingly collect personal data from a child without an appropriate lawful basis and any consent or authorization required by law. If you believe that a child's information has been submitted improperly, contact hr@rec-rootafrica.com.

17. Third-party websites and services

The Recroot Africa website may contain links to external services, including social-media platforms, document-hosting services, maps and prospective employers' websites.

Recroot Africa is not responsible for the privacy practices of an external website or service. Visitors should review the external provider's privacy notice before submitting personal information.

18. Questions and complaints

Privacy questions, concerns and complaints may be submitted to:

Email: hr@rec-rootafrica.com
Telephone: +255 694 933 250
Address: 11 Zanaki Street, opposite Maratha Club / Badminton Institute, Dar es Salaam, Tanzania

Recroot Africa will review and respond to privacy complaints in accordance with applicable law.

If you are not satisfied with our response, you may submit a complaint to the Personal Data Protection Commission of Tanzania through its official website.

19. Changes to this notice

Recroot Africa may update this notice when its services, technology or legal obligations change.

The updated notice will be published on the website with a revised effective or review date. Where a change materially affects how personal data is used, Recroot Africa will provide additional notice or request consent where required.

20. Contact