Xora HR — Privacy Policy

Effective date: 6 August 2026  •  Last updated: 6 August 2026

Xora HR ("the App", "we", "us", or "our") is a human-resource and workforce-management application provided by Leysco to employer organizations ("your Employer") and their staff. This Privacy Policy explains what information the App collects, how we use it, how it is shared, and the choices and rights you have.

Xora HR is an enterprise application used in an employment context. In most cases your Employer is the data controller of your personal information and Leysco processes that information on the Employer's behalf as a data processor. If you have questions about how your Employer uses your data, please contact your Employer's HR or IT department in addition to us.

By installing and using the App, you agree to the practices described in this Policy.

1. Information we collect

1.1 Account and HR information

Provided by you or by your Employer to operate HR services:

• Identity and contact details: name, employee ID, email address, phone number, photograph.
• Employment details: job title, department, branch, shift, manager, employment status.
• HR records created in the App: attendance, timesheets, leave, payroll and salary statements, loans, expenses, tickets/support requests, and job applications.

1.2 Location data (GPS) — used for attendance geofencing

This is central to how the App works and is described in detail in Section 3.

• When you clock in or clock out, the App collects your device's precise GPS location (latitude, longitude, and accuracy).
• This location is compared against your Employer's configured geofence (an approved work location and radius) to record whether the action occurred inside or outside the permitted area (allowed, warned, flagged, blocked, or bypassed).
• The location coordinates and geofence decision are stored with the corresponding attendance record.
• Location is collected only at the moment of an attendance action (and, where enabled, a brief pre-check immediately before it). The App does not track your location continuously or in the background.

1.3 Biometric authentication

• The App can use your device's fingerprint or face unlock to secure sign-in and authorize sensitive actions.
• This check is performed entirely by your device's operating system (Android BiometricPrompt). Your biometric data never leaves your device and is never collected, transmitted, or stored by Xora HR or Leysco. The App only receives a success/failure result.

1.4 Camera, photos, and files

With your permission, the App accesses your camera and photo/file storage so you can add a profile photo and attach documents or images (for example expense receipts and job-application attachments). Files you choose to attach are uploaded to and stored on our secure cloud storage (see Section 6). The App only accesses the specific media you select.

1.5 Contacts

Where a feature requires it, the App may request access to your device contacts (for example to help populate a referral or contact field). We access contacts only when you use such a feature, and only the contact information needed for that action. We do not upload your entire address book.

1.6 Bluetooth

The App may use Bluetooth (scan/connect) to support proximity-based attendance or to communicate with supported workplace devices where your Employer has enabled this.

1.7 Device and technical information

Standard technical data needed to operate and secure the service: device model, operating-system version, app version, language, and diagnostic/error information.

We do not knowingly collect payment-card data through the App, and we do not sell your personal information.

2. How we use your information

• Authenticate you and keep your account secure.
• Record and manage attendance, including validating clock-in/clock-out against your Employer's geofence.
• Process HR functions: timesheets, payroll and salary statements, leave, loans, expenses, tickets, and recruitment.
• Provide, maintain, troubleshoot, and improve the App.
• Comply with legal, tax, and employment-record obligations, and enforce our terms.

3. Location data and geofencing (detailed)

• What is collected: latitude, longitude, and accuracy at the time of an attendance action, plus the resulting geofence decision.
• When: only when you initiate an attendance action, and (if enabled) a short pre-check immediately before it. There is no continuous or background tracking.
• Why: to confirm attendance is recorded from an approved work location, per your Employer's attendance policy.
• Employer controls: your Employer configures whether geofencing is enabled, the location(s) and radius, the accuracy threshold, and the strictness (whether an out-of-area clock-in is warned/flagged or blocked).
• Storage: coordinates are stored with the attendance record for record-keeping, payroll accuracy, and dispute resolution.
• Your control: location uses Android runtime permissions. You can decline or revoke the permission in device settings; if you do, attendance features that depend on location may not function, and your Employer's policy determines how such attendance is handled.

4. Android permissions we use

Permission	Why the App uses it
Precise & approximate location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION)	Geofenced attendance clock-in/clock-out (Section 3)
Biometric / fingerprint (USE_BIOMETRIC, USE_FINGERPRINT)	Secure device-local sign-in and action authorization (Section 1.3)
Camera & storage (READ/WRITE_EXTERNAL_STORAGE)	Capture/attach profile photos, receipts, and documents (Section 1.4)
Contacts (READ_CONTACTS, WRITE_CONTACTS)	Optional contact-related features when you use them (Section 1.5)
Bluetooth (BLUETOOTH_SCAN, BLUETOOTH_CONNECT)	Proximity-based attendance / supported workplace devices (Section 1.6)
Internet (INTERNET)	Communicate securely with our servers

5. How we share information

• With your Employer — the controller of your HR records, who can access the data you submit through the App.
• With service providers (processors) who host and support the App under contract, including cloud infrastructure and file-storage providers (for example Amazon Web Services) and Google Play services for app distribution and integrity.
• For legal reasons — where required by law, regulation, legal process, or to protect rights, safety, and security.

We do not sell your personal information and we do not use it for third-party advertising.

6. Data storage and security

Your data is stored on servers and cloud storage operated for Leysco/your Employer. Media files are stored on secure cloud object storage. We use technical and organizational measures — including encrypted transport (HTTPS/TLS), access controls, and authentication — to protect your information. No method of transmission or storage is 100% secure, but we work to protect your data.

7. Data retention

We retain personal information for as long as your account is active and as needed to provide the service, and thereafter as required to meet your Employer's legal, tax, payroll, and employment record-keeping obligations. Retention periods are primarily determined by your Employer and applicable law.

8. Your rights

Subject to applicable law and your Employer's policies, you may request to access, correct, update, or delete your personal information, or object to or restrict certain processing. Because your Employer controls your HR records, please direct such requests to your Employer's HR/IT team; we will assist your Employer in responding.

9. Children

Xora HR is a workplace application intended for use by employed adults. It is not directed to children and we do not knowingly collect personal information from children under the age required by applicable law.

10. International use

The App may be used in, and data may be processed in, different countries depending on where your Employer and our service providers operate. We take steps to protect your information consistent with this Policy wherever it is processed.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice through the App or your Employer.

12. Contact us

Leysco — Xora HR
Email: privacy@leysco.co.ke
Nairobi, Kenya

For questions about how your specific Employer uses your data, please also contact your Employer's HR or IT department.