Privacy Policy

This policy explains what personal information HechaR collects, why, and the choices you have. It covers hechar.com and the HechaR app. HechaR is a product of Serftre Monterra, and “we” and “HechaR” in this policy mean Serftre Monterra.

1. Who is responsible

When a business uses HechaR, that business decides what information about its people goes in and why. It is the data controller for employee records, and HechaR processes them on its behalf. For our own account, billing and website information, HechaR is the data controller. If you are an employee with a question about your records, contact your employer first.

2. What we collect

• Account details: name, email address, password (stored only as a secure hash) and the companies and roles you belong to.
• Business details: organisation and company names, countries, departments, locations and settings.
• Employee records: what your employer adds, such as contact details, job title, start date, manager, emergency contacts, dependants, photos and documents.
• Work activity: time off requests and balances, schedules, punches and breaks, approvals and a history of changes.
• Location and network: only when your employer turns on punch checks, your device location and IP address at the moment you punch in or out.
• Billing: payment amounts, dates and references. Card and mobile money details are handled by our payment provider and never stored by us.
• Technical data: browser, device and IP address in server logs, used for security and to fix problems.

3. How we use it

• to provide HechaR: sign-in, showing each person the right information, approvals and reports;
• to send the emails the product needs, such as invites, password resets, approvals and receipts;
• to take payments and keep financial records;
• to keep the service secure, prevent abuse and fix faults;
• to meet our legal obligations.

We do not sell personal information and we do not use it for advertising.

4. Who we share it with

We share information only with the service providers that help us run HechaR, such as hosting, email delivery and payments, under agreements that protect it.

We may also disclose information when the law requires it, or to protect the rights and safety of our users.

5. Where it is stored

HechaR is hosted in the United Kingdom, and that is where your data is stored. If you are outside the UK, this means it is processed outside your country. Where that happens we rely on appropriate safeguards as required by data protection law, including Kenya’s Data Protection Act, 2019.

6. How long we keep it

Business data is kept while the organisation has an account, including when it is read-only after a trial or paid period ends, except uploaded documents, which are deleted 3 days after a trial ends without a plan. When an Admin asks us to close the organisation, we delete its data within 30 days, except billing records we must keep by law. Server logs are kept for a short period for security.

7. Security

Connections are encrypted, passwords are hashed, sign-in sessions expire and can be revoked, and access within a company follows each person’s role. Documents and photos are only available to signed-in users allowed to see them.

8. Browser storage and analytics

HechaR stores your sign-in session and chosen company in your browser so you stay signed in. We do not use advertising cookies.

On our public website pages (such as the home page, this policy and our terms) we use Google Analytics, through Google Tag Manager, to understand how visitors find and use the site. It sets cookies and sends Google information such as the pages you visit, your browser and device, and an approximate location from your IP address. It does not run inside the HechaR app once you sign in, and it never sees employee records. You can block these cookies in your browser settings.

9. Your rights

Depending on where you live, you can ask to see, correct, delete or move your personal information, or object to how it is used. For employee records, your employer handles these requests and we help them. For anything else, write to [email protected] and we will reply within 30 days. You can also complain to your data protection authority, which in Kenya is the Office of the Data Protection Commissioner.

10. Children

HechaR is a workplace tool and is not meant for children.

11. Changes

We may update this policy. The date at the top shows the latest version, and we will tell Admins by email about significant changes. See also our Terms of Service.

12. Contact

Privacy questions: [email protected].