Privacy Policy

Version: 2026-10-02 · Effective from: 23 October 2026 · What changed

Controllers: African Wood Inc. (United States & Kenya), African Wood Limited (United Kingdom & Wales), and Dhamana Technologies Limited, acting as joint controllers for the Digital Competency Exchange.

This platform handles some of the most sensitive information a person has — passport images, a facial biometric, immunization and tuberculosis screening records. This policy says plainly what we hold, why, and what you can do about it.

What We Collect

Identity. Name, date of birth, nationality, country and city of residence, passport or national identity document, and a selfie.

Biometric data. A facial template derived from your selfie and the portrait in your identity document, used once to confirm they are the same person. This is special-category data.

Health data. Immunization records, tuberculosis screening, and any fitness-to-practise statement. This is special-category data.

Professional data. Degree and transcript, NCLEX and TruMerit results, home nursing licence, English test results, clinical experience, and professional references.

Account and technical data. Email, phone number, password hash, sign-in times, IP address, and the audit record of actions taken in the platform.

Employers and partners. Organization details, the name and title of the person signing an attestation, payment records, and payout destinations.

Why We Process It, and On What Basis

We do not use your data for advertising. We do not sell it. We do not make decisions producing legal effects about you by automated means alone — the identity check is automated, but a person reviews the outcome and a failed check never rejects you on its own.

You may withdraw consent at any time, including for the biometric check, by contacting an administrator through the portal. Withdrawal does not affect processing already carried out. Where consent is withdrawn for verification data, your profile cannot remain on the marketplace.

Who Sees What

Employers see a verified profile. Before they pay, identity is masked to initials. After they unlock a portfolio they see your name and a rendered summary of what we verified — never your underlying documents, and never a link to them. Referees' contact details are never included; a verified reference is not permission to approach the referee.

Your training or recruiting partner, where a college or agency sponsors you, sees your verification progress by phase and can open the documents in your file while that sponsorship is live — that is how they vouch for a transcript they issued. They cannot see your identity check result. Every document they open is recorded and shown to you by name, and asking us to end the sponsorship closes their access immediately, before anybody processes the request.

An enrolment agent you have authorised — a computer centre or cyber café that helps you enrol — sees your verification progress, the names of the items you still owe, and, from the moment you authorise it and for as long as that authorisation stands, the documents in your file. It can upload documents for you, correct your profile, and send your file for checking. It can never open, upload or replace the documents that say who you are — your identity document, your identity selfie, your birth certificate, or a marriage certificate or deed poll showing a change of name — and it can never run your identity check. Those are yours, you do them from your own account, and the refusal is written into the database's own row rules as well as into our code, so it does not rest on one check somebody could forget. It never receives your password and never signs in as you: it acts under its own login, and every act is recorded against the person at the keyboard.

You authorise it by a code we send to your own phone and inbox — with the list of what you are and are not agreeing to in the same message — or from your own account. Every document it opens is recorded and shown to you by name, and everything else it does in your name is listed for you to read. You can withdraw the authorisation at any moment, without giving a reason, and it takes effect on the centre's next click. Filling in the forms and uploading your documents is work you can do yourself for nothing; if you would rather pay a centre to do it for you, it charges you its ordinary posted rates for typing, scanning, printing and computer time, the same rates it charges anybody at its counter. It may never charge you for the placement itself or for reaching us — no enrolment or registration fee, no success fee, no share of what you are paid later, no fee for acting as your agent.

A law firm your employer retains for your visa or work permit sees only the document types you release to it, one type at a time, and only while its case is open. It is not your lawyer — it acts for the hospital, and you are told so before you can release anything to it. You can withdraw any release at any moment, without giving a reason, and it takes effect on the firm's next click. Documents about your family are never held here at all: you send those to the firm directly and we record only that it was asked for and that you say you sent it.

The communication board is where you can write to us, and to your sponsor while it sponsors you. Your conversation with us is read by you and by our staff. Your conversation with your sponsor is read by you and by your sponsor — and by us: we can read your conversations with your sponsor, because we are responsible to you for how a college or an enrolment agent treats you, and we cannot be responsible for what we are not allowed to see. We do not write in that conversation; we write to you on our own. Your sponsor loses the conversation the moment it stops being your sponsor — when you ask to end the sponsorship, or withdraw an enrolment agent's authorisation — and you keep it. No employer and no law firm can ever see your conversations on the board. Organisations also use the board to write to us, and a conversation between organisations may be about you; an organisation can see one only while it has a part in your placement — your sponsor while it sponsors you, a facility while you are in the directory or placed with it, a law firm handling your immigration case — and your name is never copied into it. We cannot read what a facility and its immigration lawyers write to each other there: that is privileged correspondence, and we have built the board so that we are not in the room. Messages are text only, cannot be edited or deleted once sent, and a notice that you have a new one never contains the message itself.

Our verification staff see your full file, and every document opened is recorded against the individual who opened it.

You can see which employers have opened your portfolio, and every document any partner or law firm has opened, at any time, in your dashboard. The same screen lists every document an enrolment agent has opened and everything else it has done in your name.

What We Send You, and Where

Almost everything happens in the portal. You see what you need when you sign in, and a notice here never depends on an inbox.

We send email for eight things and no others, and the list is kept in step with the code rather than written once and left:

1. Reaching somebody who has never signed in to an account their organisation holds. 2. Reaching somebody who has stopped. 3. Telling you that something you started here is not finished. 4. Confirming that an email address belongs to whoever is using it to register. 5. Inviting somebody we have approached to create an account — a facility, a college, a law firm, or a nurse. 6. Telling an organisation its account has been opened. 7. Telling a nurse that her practice licence has lapsed and needs renewing with her own council. 8. Telling you that a message is waiting for you on the communication board, when we could not tell you by WhatsApp or you have not read it some hours after we did.

The first three exist for one reason: they are the things we cannot tell you in the portal, because the portal is the thing you are not currently visiting.

The fourth is the opposite. Before anybody can create an account, we send a short code to the address they gave and they have to type it back. Nothing is created until they do. We added this because an automated account was registered here on 28 July 2026 — no harm was done, the account has been deleted, and the address it used never belonged to a person who wanted an account with us. A code sent this way signs you in to nothing, because at the point we send it there is nothing to sign in to.

The fifth is why a nurse may hear from us before she has an account. Somebody here may have met her, or been given her details by her college. The message says we invited her and carries a link that can create an account and nothing else. It holds nothing about her professional record, because at that point we hold nothing about her professional record. If it reaches the wrong person, what they can do with it is make an account in their own name, which they could already do.

The seventh is about your licence and nothing else. If the council that registered you shows your practice licence as expired, we tell you, because a facility cannot be shown a nurse whose licence is not current. Renewing it is between you and your council — we cannot do it for you and we will never ask you to pay us for it.

Once you hold an account, we write to you about your own unfinished profile, your licence, and a message waiting for you on the board, and about nothing else. The other five are about accounts, doors and addresses; none of them is about your professional record.

The eighth says that something is waiting, and nothing more. It never contains the message, its subject, who wrote it, a nurse's name, an organisation's name or anything about a case — only a sentence and a link to sign in. We send it at most once for a conversation until you have opened that conversation, however many messages arrive in it meanwhile.

WhatsApp, only if you turn it on. A nurse, and the people of a college or an enrolment agent, can ask us to send a WhatsApp message instead when something new is waiting. It is off until you switch it on, on your profile or your account settings, by ticking a box that says exactly what you are agreeing to and shows the number it will go to; switching it off is one press on the same card, at any time, and no reason is asked. We keep the words you agreed to, the number, the language you chose (English or Kiswahili), and when you agreed and when you stopped. The message is a fixed one approved by WhatsApp — it says there is a new reply in one of your conversations and that it is only shown after you sign in, with a link — and it never says what the message is about, because WhatsApp shows it on your lock screen and phones are shared. It names the conversation by a short code made from the conversation's own reference and nothing else, the same code you see at the top of that conversation when you sign in. It goes only to the number you agreed for: if the number on your account changes, we stop until you agree again for the new one. If it cannot be delivered, or it was delivered and the conversation is still unread a few hours later, we send the email instead — in Kiswahili if that is the language you chose. If WhatsApp tells us you have opened the message, we do not send the email. Facilities and law firms are written to by email only. Replying STOP to the WhatsApp message does not reach a person yet; switch it off on the same card instead.

We will never send you a password, a sign-in code, a document, or a link that signs you in. An inbox is long-lived, widely synchronised and frequently breached; anything we put in one has to be worth nothing to whoever else reads it. If you receive a message claiming to be from us that contains any of those things, it is not from us.

We send one-time passcodes by SMS and by no other route. We keep a record of the fact that a message was sent, to whom and of what kind — never its contents.

Ask us to stop writing to an address and we will, and we keep a list of addresses we must not write to so that it stays stopped.

Every email we send ends with our postal address and a link that stops us writing to that address. The link needs no account and no reply to anybody, and it goes on working however long the message sits in a mailbox. It leads to a single button — opening the page alone changes nothing, so software that checks links on your behalf cannot opt you out by accident — and the button puts the address on that list, and an address on that list is never invited again.

Processors We Use

partners. Candidates never transact, so candidates have no payment data.

authorising an enrolment agent to act on your file. Both are codes you asked for. Nothing else is sent by SMS, and no notice from the platform reaches you by text message. Twilio also carries the WhatsApp alerts you can switch on (above): it receives your number and the link, and tells us whether the message was delivered.

switch them on. WhatsApp receives your number and the fixed, approved message with its link, and nothing about what is waiting for you.

• Smile Identity — identity document reading and biometric comparison.
• Amazon Web Services — hosting, storage, and encryption key management.
• Stripe, PayPal, Pesapal — payments from employers and payouts to
• Twilio — SMS one-time passcodes, and the code that confirms you are
• WhatsApp (Meta) — the channel those alerts travel on, only if you
• Amazon Simple Email Service — the small number of emails we send.

Each is bound by a data processing agreement and acts only on our instructions.

A law firm is not one of these. A firm your employer retains decides for itself what it does with what you release — it answers to its own regulator and its own duties, not to our instructions — so it is a recipient in its own right rather than a processor acting for us. That is why the release is yours to give and yours to withdraw, rather than something we arrange on your behalf.

International Transfers

Candidate data originates largely in Kenya and is processed on infrastructure in the United States, and is disclosed to employers in the United States and Canada. Transfers out of the United Kingdom and the European Economic Area rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses. Transfers out of Kenya are made under the Data Protection Act 2019 on the basis of your consent and the contractual necessity of the placement you are seeking.

How Long We Keep It

withdrawal happened is retained for the audit trail.

employment law require.

append-only by design and is the record of what was done to your data.

• Active candidate profile — while your account is open.
• Withdrawn documents — the file is deleted immediately; the record that a
• Closed accounts — verification records for 24 months, then deletion.
• Placement contracts and financial records — 7 years, as tax and
• Immutable audit ledger — retained for the life of the platform. It is

Your Rights

You may request access to your data, correction of it, deletion of it, restriction of its processing, a portable copy of it, and you may object to processing. You may withdraw consent as described above.

To exercise any of these, contact an administrator in the portal, or write to the address in Contact below if you do not hold an account. We respond within 30 days.

You may complain to a supervisory authority: the Office of the Data Protection Commissioner in Kenya, or the Information Commissioner's Office in the United Kingdom.

Security

See Data Security.

Contact

African Wood Inc., 274 Liborio Dr., Middletown, Delaware 19709, United States | P O Box 1229-50200, Bungoma, Kenya. Data protection enquiries reach us through the portal, or by email to client.services@amakobe.com. You do not need an account with us to write to that address, and you do not need one to exercise any of the rights above — a person whose data we hold may never have signed in here at all.