Data & cookies

When you apply for a role, we collect what you give us:

• Your name, email address and phone number
• Your CV, if you attach one
• Your cover letter, if you write one
• The role you applied for and when

If you create an account, we also store what you choose to add to your profile — a headline, a short bio, skills, your county or town, a LinkedIn link, and a CV kept on file so you do not have to attach it each time. Roles you save are stored against your account.

We do not ask for, and do not want, your national ID number, date of birth, marital status, religion, ethnicity, health information or a photograph. If your CV happens to contain any of that, it is in the file you sent us and we do not extract or index it.

PAC Africa ran an earlier version of this job board. Applications made through it were carried across, so we may already hold an application you submitted before you ever visited this site, including the CV attached to it.

If you create an account with the same email address you applied with, you can claim those records and see your own history. Nobody else can see them, and claiming requires you to confirm your email address first — which is precisely so that somebody who merely knows your address cannot claim your history.

• PAC Africa staff, who review applications as part of placing candidates.
• The employer for the specific role you applied to — your name, contact details, cover letter and CV. They cannot see applications you made to other roles.
• Nobody else. Your CV is never public, is never listed in a search engine, and is only ever reachable through a private link that expires after five minutes.

Employers do not see applications to other employers' roles, and other applicants never see yours. Access is enforced by the database itself rather than by the interface, so it holds even if somebody queries our API directly.

We use three providers. Two of them mean your data leaves Kenya, and you should know that:

• Supabase — the database holding your application and profile. Hosted in Ireland (eu-west-1).
• Cloudflare R2 — where CV files are stored. Private, and only reachable through a short-lived signed link.
• Vercel — serves the website itself.

Because the database is in Ireland, your personal data is transferred outside Kenya. Under the Data Protection Act 2019 you are entitled to know that, which is why it is stated plainly here rather than buried. Ireland is subject to the EU GDPR, which sets a standard of protection comparable to Kenya's.

We do not use tracking or advertising cookies, and there is nothing here to consent to. Browsing this site anonymously sets no cookies at all.

If you sign in, we set one session cookie so you stay signed in between pages. It is strictly necessary — without it, signing in would not work — and it holds no advertising identifier. Your theme preference is kept in your own browser's local storage and never reaches us.

We measure page views with Vercel Web Analytics, which is cookieless and does not build a profile of you. We deliberately strip the query string from every recorded URL and record nothing at all for staff pages, so a search typed into an internal screen never leaves the product.

Applications are kept so that employers can review them and so you can see your own history. Our records currently go back to 2023.

Under review: PAC Africa is setting a defined retention period for applications and CVs. Until then, records are kept indefinitely and you can ask us to delete yours at any time using the contact address above.

Under the Data Protection Act 2019 you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your data, including your CV.
• Stop using it for a particular purpose.
• Hand it to you in a portable form.

Email it@pac.africa and we will respond within 30 days. Deleting your account removes your profile and CV; where an employer has already received an application, we will tell you what has been shared and with whom.

If you are unhappy with how we have handled your data, you can complain to the Office of the Data Protection Commissioner of Kenya.

CVs are held in private storage and are never publicly addressable — each view generates a link that stops working after five minutes. Access to applications is enforced in the database, so a role you did not post is not readable by you even through our API. Passwords are handled by our authentication provider and are never visible to us.

The earlier version of this site was compromised in August 2026. The application data was recovered intact and this rebuild exists in part to remove the weaknesses that allowed it. If we ever believe your data has been exposed, we will tell you.