Privacy Policy

This Privacy Policy applies to:

• Website visitors
• HR administrators
• Employees and contractors
• Customers and organization users
• Users of integrated third-party services

This policy applies to all services provided through the OnTap platform and associated integrations.

We may collect the following categories of information:

OnTap’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where you choose to connect Google services such as Google Workspace, Gmail, Google Calendar, or Google Sign-In, we may access limited Google user data strictly necessary to provide requested functionality.

Google user data is only accessed with your explicit authorization and is processed securely in accordance with applicable privacy laws.

We use collected information for the following purposes:

• Service Delivery: To provide HR, payroll, attendance, task management, and related services.
• Account Management: To authenticate users, manage access permissions, and secure accounts.
• Legal & Regulatory Compliance To comply with tax, payroll, employment, and regulatory obligations.
• Customer Support: To respond to inquiries, troubleshoot issues, and improve user experience.
• Security & Fraud Prevention: To detect unauthorized access, prevent fraud, and maintain platform security.
• Platform Improvement: To analyze usage trends and improve platform functionality and performance.

Where applicable under GDPR and other privacy laws, we process personal data based on:

• Contractual necessity
• Legal obligations
• Legitimate interests
• User consent

We may share information with trusted third parties only where necessary, including:

• Service Providers: Such as: Cloud hosting providers, Payment processors, Email delivery services, Security and analytics providers
• Government & Regulatory Authorities: Where required by law or statutory obligations.
• Third-Party Integrations Only where users explicitly authorize integrations with services such as: Google Workspace, Microsoft 365, Accounting platforms

All third-party processors are contractually required to maintain appropriate confidentiality and security measures.

We retain personal information only for as long as necessary to provide services and comply with legal obligations.

After the applicable retention period, data is securely deleted or anonymized.

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of your data
• Restrict certain processing activities
• Object to processing
• Request data portability
• Withdraw consent at any time

To exercise your rights, contact us at: info@ontapke.com. We aim to respond within 30 days.

We may use cookies and similar technologies to:

• Maintain secure sessions
• Improve functionality
• Analyze platform usage
• Remember user preferences

You may manage cookies through your browser settings.

We implement industry-standard technical and organizational security measures, including:

• AES-256 encryption at rest
• TLS encryption in transit
• Multi-factor authentication (MFA)
• Role-based access control
• Security monitoring and logging
• Regular vulnerability assessments
• Employee confidentiality controls

Despite our efforts, no system can guarantee absolute security.

Your information may be processed and stored in countries outside your jurisdiction, including through trusted cloud infrastructure providers.

Where required, we implement appropriate safeguards for international data transfers.

OnTap is not intended for individuals under the age of 18.

We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time.

Any material changes will be communicated through our website or platform notifications.

Continued use of OnTap after updates constitutes acceptance of the revised policy.

For questions, privacy requests, or legal inquiries, contact:

OnTap is committed to compliance with applicable data protection laws, including:

• Kenya Data Protection Act, 2019
• General Data Protection Regulation (GDPR), where applicable
• Google API Services User Data Policy

For more information regarding Google API policies, please visit: Google API Services User Data Policy