Privacy Policy


This recruitment privacy notice describes how MSF EA (“we” or “us”) collects, holds and processes personal and sensitive data about job applicants, potential employees and interns, people that participate in our recruitment events or potential candidates for partnership or consultancy – referred to as ‘you’ below. MSF EA is a Data Controller in terms of the Data Protection Act of Kenya 2019. with registered office at Pitman House, 3rd Floor, Jakaya Kikwete Road P.O. Box 60204-00200 Nairobi/Kenya. We maintain information about you (your personal and sensitive data) in paper and electronic form. This is managed by the Human Resources Team. For certain actions such as application review and interviews, we share this information with other parts of MSF EA and with external partners who provide HR services on our behalf, for example recruitment software on Odoo and database hosting with Sybyl.

By submitting your application and providing your personal data to us, you acknowledge that:

  1.  You consent to the collection, use, disclosure, and retention of your information by MSF EA in accordance with this Privacy notice and as otherwise permitted by applicable law. 

  2. You are free not to provide any requested information to us and may withdraw any prior given consent at any time by sending an email to  [email protected] We may not be able to continue your candidacy if you do not provide us with your information as pertaining to the job for which you have applied.

  3. We use data analytics and automated processes to help us assess certain issues such as on demographic data or to review candidate applications to enable us to get a better fit for the jobs we advertise. Hiring decisions are however not based on automated processing such as for candidate profiling. 

You have read and understood this Privacy Notice and agree to the use of your personal data as set out herein. Should you have any queries regarding this policy or data protection in general, the Organization’s Data Protection Officer can be contacted by email on [email protected]

Data Protection Principles

As your prospective employer, MSF EA and data controller, will comply with data protection law. This requires that the Personal Data we hold about you must be:

  • Used lawfully, fairly and in a transparent way.

  • Collected only for legitimate valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.

  • Relevant to the purposes we have told you about and limited only to those purposes. 

  • Accurate and kept up to date. 

  • Kept only as long as necessary for the purposes we have informed you about.

  • Kept securely with adequate data protection safeguards in place.  

How we collect your personal information

Typically, we receive candidate Data in several ways: 

  • Directly from you: When you apply for a job with us through the online application process and follow-up communications and/or through alternative channels (e.g., via professional recruiting firms). We may also collect and process your personal data should we engage in due diligence related to a posted job position with MSF EA

  • Indirectly from you: We may also collect personal data about you online if you have made it publicly available such as from professional social media websites such as LinkedIn.

  • From third-parties: We may also collect similar personal data about you from third parties, such as professional recruiting firms, government agencies, other organizations, other MSF Entities, your references and previous employers. If you receive an offer from us, we may then conduct a background check and, to the extent permitted by applicable law, we may also collect data related to criminal offences and proceedings. 

What personal data we collect and why

The types of personal data that we request from you is determined by the requirements of the advertising MSF entity and the requirements of the country in which the role is based. The type of personal information we collect about you includes your name, postal address, country, contact information, photographs and videos, work and educational history, achievements, identity documents and a certificate of good conduct/police record check where applicable. We may also collect sensitive personal data to the extent that a candidate chooses to voluntarily disclose without being asked to.

We use the information that you provide for us through your job application to:

  • Evaluate your suitability for potential employment with current and future roles that may become available;

  • Ensure we comply with legal employment requirements;

  • Create and retain records in relation to recruiting and hiring;

  • Carry out background checks to the extent authorized and permitted by law; 

  • Protect our legal rights to the extent authorized or permitted by law; or

  • Protect your health in emergency situations.

  • Share promotional material on vacancies and future positions, where applicable

If there is a requirement in the future to process your data for a purpose other than for which it was collected, we will always provide you with notice and the information on that purpose and any other relevant information. You have the right to withdraw consent at any time by sending an email to [email protected]

Lawful grounds for processing

Our processing of your personal data for the purposes mentioned above is based in part on:

  • Our legitimate business interest in evaluating your application to manage our relationship with you, to ensure that we recruit appropriate employees, and to evaluate and maintain the efficacy of our recruiting process more generally;

  • Our performing pre-contractual measures relating to our potential employment relationship with you;

    Our complying with applicable law with regard to personal data necessary to satisfy our legal or regulatory obligations;

  • Your consent, if we offer you the opportunity to participate in our optional recruiting programs or if we collect sensitive personal data, to the extent permitted by applicable law.

When we need your consent

If you receive and accept an offer of employment with us, we may ask your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us.

If you are not successful in your application, we may want to remain in contact with you and consider you for future employment opportunities and will seek your consent to do so. Participation in our recruiting programs is entirely optional.

We may seek your consent where we use data analytics and automated processes to help us review candidate applications to enable us to get the best fit for the jobs we advertise. We, however, use these in conjunction with human judgement and do not leave the decisions purely to automated processing and you have a right to object to purely automated processing.

How to keep your data secure

MSF EA takes information security very seriously, particularly in relation to personal and sensitive data. We undertake regular audits and checks of personal data management and failure of our staff to comply with our Data Protection Policy is a disciplinary offence.

External Disclosure 

Sometimes we will pass information about you to third parties, where the law allows it We do not give or sell your information to other organizations.

Your personal data may be transferred and processed by other MSF entities internationally for onward processing of your candidacy for the advertised job, including in some countries that may not provide the same level of data protection as in Kenya.

With regards to the risks relating to the transfer of your data to countries which do not have data protection regulations, we inform you that in such a case, you may be prevented from exercising, in such countries, the rights that the Kenya Data Protection Act gives you, or you may be prevented from the opportunity to file a privacy protection related complaint or legal action in such countries.

Due to the international nature of our organization, your personal data may be transferred to recruiters and interviewers working in the particular MSF entity and country where the position you are applying for is based or from where it is controlled.  By accepting this Privacy Notice, you expressly agree that MSF EA shares your personal data to the MSF entity that offers you the job. Your failure to express consent to our transfer of your data to the other MSF entities, will automatically exclude your application from the recruitment process and you will not be able to access certain positions offered by MSF at an international level.

Only trained staff within MSF that are necessary to support the recruitment process have controlled access to your information. 

We use third-party service providers to provide our recruiting software and sometimes use third party vendors to help us in the recruitment process. We have put controls in place to ensure that any third party that we associate with for the purposes outlined in this notice also protect your data in line with the requirements of the data protection laws and regulations.

Where we have the requirement to use an intermediary, we will ensure that they meet DPA requirements before engaging with them. Should MSF EA make other disclosures of personal data in the future, we will inform you accordingly. 

For further information on the guarantees for your privacy, you may contact the Data Protection Officer by sending an email to [email protected]

Record Keeping and data retention periods  

We will maintain clear and accessible records of all data processing activities.

If you receive and accept an offer of employment with us, the personal data collected during your pre-employment period becomes part of your employee records and will be retained in accordance with the requisite legal requirements. Data will only be kept for as long as is necessary to fulfil the purpose identified or as required by law. All employment records will be retained for a period of 10 years or for the duration of time stipulated by the laws of the country in which the MSF position you are applying for is based. Any data collected on unsuccessful applicants will be destroyed and no longer retained. Data collected on the top 3 applicants will be retained for a period of time, based on our legitimate interest of making such future recruitment processes more agile, without infringing on your rights since you have provided them voluntarily until it is confirmed that the position is no longer available. This is without prejudice to you exercising your right of objection and the rights which are explained in the section below on “Your Rights”. We operate within the confines of you as the data subject being granted the highest degree of autonomy possible with respect to control over your personal data.

Where the data is required to defend a potential claim, the data will be retained for the required period of time. 

Your Rights 

Under the Kenya Data Protection Act of 2019 you have a number of rights with regards to your personal data.  You have the right to request from us access to and rectification of your data as well as for it to be erased and to restrict processing of your data in certain circumstances. You have a right to see all the information that we keep about you.

If you have provided consent for the processing of your data you have the right to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent has been withdrawn. You can do this by email on [email protected]

To exercise your rights to access, rectification, erasure, amendments, portability, restriction and/or objection to the processing of your data, you can email us at [email protected] Responses to requests sent to this email address will be provided within 30 days.

You also have the right to lodge a complaint with the Data Commissioner if you feel that we have not complied with DPA requirements regarding your personal data through the Office of the Data Protection Commissioner official website.

In summary, data subjects, will have the:

  • Right to be informed about the processing of your personal data

  • Right to rectification if your personal data is inaccurate or incomplete 

  • Right of access to your personal data and supplementary information, and the right to confirmation that your personal data is being processed

  • Right to be forgotten by having your personal data deleted or removed on request where there is no compelling reason for an organization to continue to process it again 

  • Right to restrict processing of your personal data, for example, if you consider that processing is unlawful, or the data is inaccurate

  • Right to data portability of your own personal data for your own purposes (you will be allowed to obtain and reuse your data)

  • Right to object to the processing of your personal data for direct marketing, scientific or historical purposes

  • Right to withdraw consent at any time (where relevant)