Privacy Policy

SchemaHR is an applicant tracking system built and operated by Ackberry Technologies, a company based in Nairobi, Kenya. Throughout this policy, “we”, “us” and “SchemaHR” refer to Ackberry Technologies.

We provide SchemaHR to hiring organisations (“Clients”) who use it to post jobs, screen applicants, and manage their hiring pipeline. For most of the personal data described below, the Client is the data controller and Ackberry Technologies acts as the data processor, processing data on the Client’s instructions and under a data processing agreement with them.

This policy applies to three groups of people:

• Candidates who apply for a job through SchemaHR, including through a Client’s branded careers page.
• Client users — recruiters, hiring managers and administrators at organisations using SchemaHR.
• Visitors to our public website and marketing pages.

Depending on how you interact with SchemaHR, we may collect:

• Application data — your name, contact details, CV/resume, cover letter, work history, education, skills, and your answers to a Client’s screening questions.
• Compliance documents — where a Client’s hiring process requires it (for example, national ID or academic certificates), documents you upload for review at the compliance stage of a hiring pipeline.
• Account data — for Client users, your name, work email, role and company affiliation.
• Communications — records of emails, WhatsApp messages, and other notifications sent through the platform in connection with an application.
• Payment information — when a Client pays for a subscription, our payment processors (see Section 8) handle card, mobile money, or bank details directly; we do not store your full payment card or M-Pesa credentials ourselves.
• Usage & analytics data — on our public marketing pages, we use privacy-preserving, cookie-free analytics to understand traffic. See our Cookie Policy for detail. We do not run this kind of tracking inside the candidate or recruiter dashboards.

We use personal data to:

• Operate the hiring pipeline a Client has set up — receiving, screening, and moving applications through stages such as shortlisting, assessment, interview, compliance and offer.
• Generate AI-assisted compatibility scoring and summaries to help a Client’s recruiters review applications more efficiently (see Section 5).
• Send transactional notifications — application confirmations, interview invitations, assessment links, offer letters, and status updates.
• Detect and prevent fraud, abuse, and platform misuse.
• Meet legal and regulatory obligations, including maintaining an audit trail of hiring decisions.
• Improve SchemaHR’s reliability and features.

We do not sell personal data, and we do not use candidate CVs or application content to train any third-party AI model.

SchemaHR uses AI to extract structured information from CVs (such as experience and skills) and to produce a compatibility score and summary against a Client’s job requirements. This is intended as decision support for a human recruiter, not a final hiring decision on its own.

A small number of clearly rule-based, low-relevance applications (for example, a blank document, or an expected salary far outside the role’s stated range) may be filtered automatically before a human review. Where this happens, the reason is recorded and a Client’s recruiter can override it and reinstate the application. We keep a record of automated evaluations and any human override, consistent with the automated decision-making provisions of the Kenya Data Protection Act, 2019.

If you believe an automated step has affected you unfairly, you can ask the hiring organisation (the Client) to have a human review your application, or contact us using the details in Section 15.

Where a Client’s hiring process includes a compliance step, SchemaHR performs document completeness and consistency checks — for example, confirming a document was uploaded in the expected format, that names are consistent across documents, and that stated expiry dates have not passed.

This is not government-authenticated verification. SchemaHR does not connect to government databases or third-party registries to confirm that a document is genuine. Organisations that require certified authentication of a candidate’s documents should engage an accredited background verification provider in addition to using SchemaHR.

Raw uploaded documents (CVs, compliance documents) and the text extracted from them are retained while the role you applied for is still open, and for a limited period after it closes — by default 21 days — after which they are permanently deleted. An overall maximum applies from the date a document was processed, so documents are never kept indefinitely even where a role is left open. A Client may configure a shorter period, either across their account or for an individual role, where their own legal or operational requirements call for it.

A durable summary of the outcome (the compatibility score, extracted structured fields, and pipeline history) is kept for as long as the Client maintains an active account, or as required to meet our own legal, audit, and accounting obligations, after which it is deleted or anonymised.

Every deletion is logged so a Client can demonstrate, on request, when a given candidate’s documents were removed.

We share personal data with a limited set of service providers who help us run SchemaHR, each bound by a data processing agreement and only permitted to use data to provide their service to us:

• Cloud hosting & storage — to run the platform and store uploaded documents securely.
• AI infrastructure — during our current pilot phase, CV analysis is processed using Microsoft Azure’s AI infrastructure, which does not use client data to train its models. We are working toward processing this entirely on infrastructure we control as we grow.
• Email & messaging providers — to deliver transactional emails, SMS and WhatsApp notifications related to your application.
• Payment processors — including M-Pesa (Safaricom) and PayPal, to process subscription and invoice payments made by Clients.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, property or safety of SchemaHR, our Clients, or others.

Some of the providers listed in Section 8 may process data outside Kenya. Where personal data is transferred outside Kenya, we take steps intended to ensure it receives a level of protection consistent with the Kenya Data Protection Act, 2019 — including using providers with recognised international security and compliance certifications, and entering into data processing terms with them.

We use industry-standard technical and organisational measures to protect personal data, including encryption of sensitive data at rest and in transit, access controls based on role and need-to-know, and audit logging of actions taken on candidate records. No system is completely secure, and we continually work to improve these protections.

Under the Kenya Data Protection Act, 2019, and equivalent laws in other jurisdictions we may operate in, you generally have the right to:

• Know what personal data we hold about you and why.
• Request a copy of your data.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to any legal retention requirements.
• Object to or restrict certain processing, including automated decision-making described in Section 5.
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya), or the equivalent authority in your country.

If you applied for a role through a Client’s SchemaHR careers page, the fastest route for most requests is to contact that organisation directly, as they control the hiring process. You can also contact us directly using the details in Section 15, and we will coordinate with the relevant Client where needed.

SchemaHR is intended for use by individuals who are old enough to lawfully enter employment in their jurisdiction. We do not knowingly collect personal data from children below that age.

SchemaHR is currently offered to organisations operating in Kenya. As we expand to serve organisations in other African markets, we will apply the data protection standards described in this policy as a baseline everywhere we operate, and will publish jurisdiction-specific additions or a locally required equivalent where a country’s law requires terms beyond what is set out here.

We may update this policy from time to time as our practices, or the law, change. We will post the updated version here with a new “last updated” date, and, for material changes, take reasonable steps to notify Client administrators.

For questions about this policy, or to make a request about your personal data, contact us at privacy@schemahr.com.

Ackberry Technologies · Nairobi, Kenya