Privacy notice
What we collect, why we need it, and what you can ask us to do with it.
On this page
1. Who is responsible
WorkOnlineJob is the data controller for the information described here. You can reach us at [SUPPORT EMAIL], or write to [COMPANY ADDRESS]. Our data protection contact is [DATA PROTECTION CONTACT].
2. What we collect
You give us
- Your name, email address and phone number.
- Your password, stored only as a one-way hash — we cannot read it.
- Whether you are a worker or an employer.
- The work you submit, and the jobs and instructions you post.
- Anything you send to support.
We record as you use the site
- Tasks you accept, submit, approve, send back for changes or reject, with timestamps and any note or reason given.
- Wallet movements: amounts in, amounts out, escrow holds and releases, and the service fee withheld on each approval.
- M-Pesa transaction references and the status Safaricom returns.
- Basic technical logs — IP address, browser, pages requested — for security and debugging.
We never ask for your M-Pesa PIN, and we never need it. We do not see or store your PIN, and we do not hold card numbers. Anyone asking you for a PIN is not us.
3. Why we collect it
- To run your account — log you in, show your tasks and your wallet.
- To pay you — your phone number is how M-Pesa reaches you. We cannot pay you without it.
- To hold money in escrow correctly — every hold and release is tied to a job and a user.
- To settle disputes — the job instructions and submission are the evidence.
- To stop fraud and duplicate accounts, which protects honest workers' access to tasks.
- To meet legal duties — financial records, tax, and lawful requests.
Our legal grounds are: performing our contract with you (your account and payments), our legitimate interest (fraud prevention and security), and legal obligation (financial records). We only send marketing messages if you ask for them.
4. Who else sees it
- Employers you work for see your name and the work you submit. They do not see your phone number, email or wallet balance.
- Workers see the employer's job and instructions, not the employer's phone number or email.
- Safaricom (M-Pesa) receives the phone number and amount needed to make or take a payment.
- Our hosting and database providers store the data on our behalf: [HOSTING PROVIDER].
- Authorities, where we are legally required to disclose.
We do not sell your personal data, and we do not share it for other companies' advertising.
Some of our providers may store data outside Kenya. Where they do, we require them to protect it to a standard at least equivalent to Kenyan law.
5. How long we keep it
- Account details — while your account is open, then up to 12 months after you close it, in case of a dispute or a payment query.
- Payment and escrow records — 7 years, as financial records usually must be kept.
- Submitted work — while the job is open and for a reasonable dispute window afterwards.
- Technical logs — a short period, typically under 90 days.
6. How we protect it
- Traffic to the site is encrypted in transit.
- Passwords are stored hashed, never in readable form.
- Access to the live database is limited to the people who need it to operate the service.
- Sessions are cookie-based and signed; we never put your password in a cookie.
No system is perfectly secure. If a breach affects you, we will tell you and the regulator as the law requires.
7. Your rights
Under the Data Protection Act 2019 you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything wrong — you can edit most of it yourself in your account;
- delete your data, where we are not required to keep it (financial records, for example, we must keep);
- stop using it for a particular purpose, or object to that use;
- export it in a portable form.
Email [SUPPORT EMAIL] and we will respond within 30 days. If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner of Kenya.
8. Cookies
We use one essential cookie to keep you logged in. That is it — no advertising cookies, no third-party trackers, no analytics pixels. Blocking the login cookie means you cannot stay signed in.
The only third party the site loads is Google Fonts, which serves the typeface.
9. Children
WorkOnlineJob is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has an account, tell us and we will remove it.
10. Changes
If we change how we handle your data in a way that matters, we will tell you before it takes effect.