Privacy Policy

ERP Tohama Ltd, of Britam Towers, 24th Floor, Hospital Road, Upper Hill, P.O. Box 12295-00100, Nairobi, Kenya is the data controller for personal data processed through Contractor in Kenya.

ERP TOHAMA LIMITED is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC), Kenya, under the Data Protection Act 2019. Registration identification: 498-204F-305C. Certificate serial no.: 26545. Valid from 14 September 2026 to 14 September 2028.

Where another ERP TOHAMA Group company processes the same record, it does so as a processor, on the controller's instructions and under a written agreement.

This notice covers the Contractor platform and this website. It does not cover a company's or an agency's own handling of your data once they have lawfully received it; each of them is a separate controller for their own purposes and answerable for it.

Where you are represented by an agency, both Contractor and that agency hold data about you, for different reasons, and you have rights against each of them.

The table below sets out every category the platform is designed to hold, why it exists, and who can see it. It is drawn from the product's actual access model rather than from a template, which is why the access columns match the ones published on the homepage.

Each category is held for the purpose named beside it and for no other, and is visible only to the parties shown.

Access columns mirror the model published on the homepage.

A face check is part of identity verification. Under the Data Protection Act 2019, data resulting from processing that uniquely identifies a person by their physical characteristics is sensitive personal data, and it attracts a higher standard than the rest of this notice.

A face check is used only to confirm that you are who you say you are. What is recorded against your profile is the result of that check, not the check itself.

The design principle is that each party sees the least it needs. Identity documents are never released to a company or an agency; only the status of the check is. Your day rate is yours. An agency's margin is the agency's. Referee details are not published on your profile.

The full item-by-item split is in the table above, and it is the same table the product shows you before you decide to share anything.

An agency can only see the parts of your record you have agreed to release to it, for the opportunity it is representing you for. Representation is visible on your own record so that you can see who is acting for you.

Withdrawing agreement to be represented stops future sharing. It does not undo sharing that has already lawfully happened, and the agency remains responsible for what it holds.

ERP TOHAMA Group operates delivery entities in Japan, the United States and Kenya. If your data is accessible from or transferred to any of them, that is a cross-border transfer and the Act requires a lawful basis for it.

Where such a transfer happens it is made on one of the bases the Act allows, and it does not reduce the rights you hold over your data.

Where a third party processes personal data on our behalf, it does so only on our instructions and under a written processing agreement entered into before it touches that data.

While your account is open, your record is kept. When you close it, your personal profile data is deleted or anonymised within 90 days, unless the law requires us to keep it for longer.

Contracts, invoices and financial records are kept for the periods that accounting, tax and other statutory obligations require, which can outlast the account.

Verification information is kept only for as long as the verification purpose or a legal obligation requires. Security and dispute records are kept for documented, proportionate periods.

Under the Data Protection Act 2019 you have the right to be informed how your data is used, to access it, to have inaccurate data corrected, to have data deleted where there is no lawful reason to keep it, to object to processing, to restrict processing while a dispute is resolved, and to receive your data in a portable form.

Where processing relies on your consent, you can withdraw it. Withdrawing consent does not make earlier processing unlawful, and where a check was a condition of a verified status, withdrawing it may mean that status can no longer be shown.

You can complain to the Office of the Data Protection Commissioner in Kenya at any time, and you do not have to come to us first.

Send your request to info@erptohama.co.jp. We will ask for enough information to be satisfied that the request is yours before acting on it, and no more than that.

The Data Protection Act 2019 sets the deadlines we have to answer within.

The service is for professionals aged 18 and over. It is not directed at children and accounts are not knowingly created for them. If you believe a child's data is held, tell us and it will be deleted.

Access is scoped so that each party sees only its part of the record, which limits what any single compromise exposes.

Where the Act requires a personal data breach to be notified, it is notified within the period the Act sets.

Material changes will be notified before they take effect, and the version and date will be shown at the top of this page. Where a change widens what data is used for, that needs a fresh basis rather than a new paragraph.

Raise it with us first if you want to, but you are not obliged to. The Office of the Data Protection Commissioner in Kenya supervises compliance and accepts complaints directly, at odpc.go.ke.