Privacy Policy
Effective date: 1 October 2026. StadiPlus (stadiplus.com) is run by BrigeTech Business Solutions Limited (registration number PVT-Q7U7R9DB), Muthiga Heights, Waithaka Street, Kinoo, Kiambu County, P.O. Box 53412, City Square, Kenya ("StadiPlus", "we"). We are the data controller for the personal data described here. Contact our Data Protection Officer at privacy@stadiplus.com.
When an employer uses StadiPlus to recruit or train its own staff, the employer decides how it uses candidate and employee data it receives. For that data the employer is the controller and StadiPlus processes it on the employer's instructions.
1. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, phone number, password (stored hashed), country | You |
| Profile and CV | Work history, education, skills, CV files, photo, salary expectations | You, or a CV you upload |
| Applications | Jobs applied for, cover letters, stage in each employer's process, interview notes and ratings | You and employers |
| Tests and assessments | Answers, scores, IQ and psychometric results, time taken | You, when you take a test |
| Camera proctoring | Webcam snapshots or recordings during a test, and flags such as "second face detected" | Your camera, only when you switch it on or the test owner requires it |
| Interviews | Video interview recordings and recorded answers | You and the employer |
| Salary reports | Job title, employer, pay, benefits, location | You, when you add a salary |
| Payments | Amount, M-Pesa, MTN MoMo or Airtel Money reference, invoice details. We do not store full card numbers. | You and our payment providers |
| Points and tokens | Points earned and spent, tokens bought and used | Our records |
| Support | Chat messages and tickets | You |
| Device and usage | IP address, approximate country, browser, pages viewed, cookies | Your device |
| Social accounts | Page IDs and access tokens when an employer connects LinkedIn, Facebook or Instagram | The employer, via those platforms |
2. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Create and run your account, apply to jobs, deliver tests, courses and interviews | Performance of our contract with you |
| Share your application and results with the employers you apply to | Performance of contract, at your request |
| Show your IQ result or Verified badge on your profile to employers | Your consent (you choose in privacy settings and can turn it off) |
| Camera proctoring and Verified badges | Your explicit consent (see section 3) |
| AI features: CV polish, job matching, job descriptions, the support assistant | Performance of contract; for CV polish, the service you pay for |
| Payments, invoices and tax records (KRA eTIMS, URA EFRIS) | Legal obligation |
| Salary index (published only as anonymous totals) | Your consent when you submit a salary |
| Security, fraud prevention, preventing fake jobs | Our legitimate interests |
| Product emails and job alerts | Consent; you can unsubscribe in one click |
| Improving StadiPlus with usage statistics | Legitimate interests |
3. Sensitive data and camera proctoring
Webcam images used to confirm who is taking a test can be biometric data, which both laws treat as sensitive. We collect them only when you choose a Verified attempt, or when a test owner requires proctoring and you agree before you start. If you decline a required proctored test, you cannot take that test, but your account is not affected.
Proctoring media is used only to check that the right person took the test. It is reviewed by StadiPlus staff or the test owner, kept for 90 days after the result is final, then deleted. We do not use it to train AI models or for any other purpose.
We do not ask for health, religion, ethnicity or political views. Please do not include them in your CV.
4. AI and automated decisions
We use AI to suggest matches, give employers a first review of each application (a fit score with strengths and gaps, based only on job-related details in the profile or CV you chose to send), write job adverts, polish CVs and answer support questions. A person at the employer makes every hiring decision. You can ask us to explain how a match or ranking was produced, and to have a person review it. Text sent to our AI providers is not used to train their models.
5. Who we share data with
- Employers you apply to, or who invite you to an interview or test.
- Service providers that host or process data for us: hosting, email and SMS, payment providers (Safaricom M-Pesa, MTN, Airtel), AI providers, video and analytics. Each is bound by a data processing agreement.
- Social platforms (LinkedIn, Meta) receive job posts when an employer chooses to publish there. We never post on your personal accounts.
- Authorities such as KRA, URA, the ODPC or the courts, when the law requires it.
- A buyer of our business, under the same protections.
We do not sell personal data.
6. Transfers outside Kenya and Uganda
Some providers are outside Kenya and Uganda. We transfer data only where the provider gives safeguards the law accepts, such as contract terms requiring equal protection, and we record each transfer.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | While your account is open; deleted within 30 days of closing it |
| Applications | 24 months after the job closes, unless you delete them sooner |
| Test results | While your account is open |
| Proctoring snapshots and recordings | 90 days after the result is final |
| Interview recordings | 12 months, or sooner if the employer deletes them |
| Payment and tax records | 7 years (tax law) |
| Salary reports | Kept only as anonymous totals once you delete your account |
| Support chats | 24 months |
8. Your rights
Under both laws you can ask to be told how we use your data, see a copy of it, correct it, delete it, object to its use, withdraw consent, and move it to another service. Most of this is in Settings → Privacy. Otherwise email privacy@stadiplus.com and we will reply within 30 days.
If you are unhappy with our answer you can complain to:
- Kenya: the Office of the Data Protection Commissioner (odpc.go.ke)
- Uganda: the Personal Data Protection Office (pdpo.go.ug)
9. Security
Data is encrypted in transit and at rest, access is limited to staff who need it, and every employer's data is kept separate. If a breach puts you at risk, we notify the Kenyan Data Commissioner within 72 hours, the Ugandan PDPO immediately, and you without undue delay.
10. Cookies
We use essential cookies to keep you signed in, remember your country and keep your support chat open. Analytics cookies are used only if you accept them in the cookie banner.
11. Children
StadiPlus is for people aged 18 and over. We delete accounts we find belong to someone younger.
12. Registration and changes
BrigeTech Business Solutions Limited is registering as a data controller with the Office of the Data Protection Commissioner (Kenya) and the Personal Data Protection Office (Uganda). We will publish our registration numbers here once issued. We will email you before any important change to this policy takes effect.