STAFF PLATFORM SUBSCRIBER AGREEMENT
Version: 2026-10-02.1
Provider: CN Holdings Ltd
Correspondence: P.O. Box 28995-00100, Nairobi, Kenya

1. Parties and acceptance
This agreement governs Staff Platform between CN Holdings Ltd (we/us) and the organisation named in the registration request (you/subscriber). The person accepting confirms authority to act for that organisation. Read these terms, correct your registration details and retain a copy before submitting. If you disagree, do not submit. Acceptance governs your request and subsequent authorised use; it does not itself confirm payment or activate a paid account. The checkout order or issued payment document identifies your package, allowance, billing term, currency and charges. Any individually signed variation takes priority over conflicting standard terms; mandatory law always prevails.

2. Service and permitted use
We provide access to the available workforce, leave, payroll, reporting, document and attendance tools within your package and permissions. You receive a non-exclusive, non-transferable right to use the service for your organisation during valid access. You must not resell access, access another organisation’s records, circumvent employee limits or approval controls, upload malicious or unlawful material, probe security without permission, or infringe another person’s rights. Your staff must use their own authorised accounts. You remain responsible for their authorised use and for promptly removing access when duties or employment change.

3. Your responsibilities as employer
You remain the employer and decision-maker. You are responsible for lawful employment policies, accurate employee details and imported information, statutory registrations, appropriate permissions, lawful deductions, salary and advance payments, tax filings and remittances, and meeting deadlines. Review calculations, reports and statutory settings before approving or relying on them. Selecting single-authoriser payroll mode is your governance decision and reduces separation of duties. Software outputs and the public calculator are assistance, not legal, accounting or tax advice, a tax filing, a payment instruction to a bank, or a guarantee of regulatory compliance. Report suspected errors promptly and take reasonable steps to limit avoidable loss. This allocation does not excuse our failure to perform our own obligations.

4. Our responsibilities and service limitations
We will provide the contracted service with reasonable care and skill, maintain reasonable technical and organisational security measures, and address reported service defects within a reasonable period according to severity. We do not promise uninterrupted or error-free service, a particular business outcome, or a fixed uptime or recovery time unless separately agreed in writing. Maintenance, connectivity, hosting and third-party failures can affect availability. We will use reasonable efforts to communicate material interruptions and restore service. Keep copies of important exported records and contingency arrangements for payroll deadlines; this does not transfer our security responsibilities to you.

5. Fees, VAT and activation
The checkout order and any issued quotation show the applicable currency, charges and VAT separately and the total payable. PayPal orders use fixed USD prices: Bronze USD 28, Silver USD 58 and Gold USD 120 per month, plus USD 3 per additional employee per month, excluding 16% VAT. The Per Employee option starts at four employees and charges USD 3 per month for every employee, including the first three, plus 16% VAT; Free remains available for up to three employees. Annual terms charge 11 months for 12 months of access, including extras. These USD prices are not conversions of KES prices; PayPal or your funding provider may apply exchange rates and conversion fees. You review the final USD total before approving a one-time PayPal payment. Online payment must be verified with the payment provider before activation. Alternative payment requests are reviewed by our team, who supply payment instructions privately. Pay the full order or issued quotation total through the chosen payment channel; a quotation or enquiry is not a tax invoice, receipt or proof of payment. Paid access or additional capacity follows payment verification. Monthly and six-month terms use the stated period charges; annual billing covers 12 months for the price of 11, including annual extra-employee charges. Additional employee capacity is charged as quoted and, during a paid term, prorated for the remaining period. Free access is limited to three active employees. A larger allowance requires a paid package or per-employee plan charging all employees. No automatic debit is authorised by this agreement.

6. Trial, renewal, cancellation and refunds
A trial lasts 30 days and access ends at expiry unless an eligible package is selected and activated. Paid subscriptions have a 14-day access grace period after expiry before operational access is locked if unpaid. Renewal reminders are assistance; you remain responsible for renewal dates even if a message is not received. You may decline renewal and may cancel an unpaid quotation through available controls. Contact us for cancellation of an active subscription. Subject to mandatory rights, prepaid fees are not refundable merely because you stop using the service during the purchased term. Duplicate or erroneous payments will be investigated and corrected. If we terminate for reasons other than your breach, we will refund the unused prepaid service period. Statutory cancellation, refund and other remedies are preserved. Price changes apply prospectively to a new quotation or renewal, not retrospectively to an already paid term.

7. Personal data and processing instructions
For employee data you determine why and how the records are used and ordinarily act as data controller; we process it on your documented instructions to provide and secure the service. We separately determine processing needed for our own subscriber administration, billing, security and legal obligations. You must establish an appropriate lawful basis, provide employee notices, collect only necessary information and meet applicable registration obligations. This agreement is not employee consent and does not authorise unrestricted monitoring or use of biometric data.
Processing for service delivery includes receiving, organising, storing, calculating, retrieving, transmitting on authorised instructions and deleting or returning workforce data. Records may include employee and dependant identities, contacts, employment, financial and statutory details, leave, attendance, uploaded documents and, when enabled, location or other sensitive information. Processing lasts for the service and any necessary, lawful retention period. We will restrict access to authorised personnel under confidentiality duties, assist reasonably with data-subject requests, impact assessments and compliance enquiries, and inform you if an instruction appears unlawful. We will not sell employee data or use it for unrelated advertising.
We will use subprocessors only under written obligations protecting the data and remain responsible for their contracted processing. We will disclose relevant subprocessors and processing locations before production processing, give notice of material changes and a reasonable opportunity to object on data-protection grounds. Transfers outside Kenya require the safeguards required by applicable law. We will provide reasonable compliance information and cooperate with proportionate audits subject to confidentiality and protection of other customers’ data. The parties must agree any additional processing schedule needed before sensitive integrations go live.

8. Security incidents, attendance and integrations
Notify us promptly of suspected compromised accounts or data exposure using the support contact supplied for your service, or our correspondence address. We will notify an affected client of a personal-data breach without delay and, where reasonably practicable, within 48 hours of awareness, and cooperate with investigation and legally required notifications. Each party remains responsible for its own statutory reporting duties. Do not assume that notifying the other party discharges them.
Browser location and approved-device checks assist attendance verification but cannot guarantee physical presence or prevent all impersonation. You must provide staff notices, assess proportionality and any required impact assessment, and provide a suitable alternative for legitimate access problems. Biometric device compatibility, hardware, connectivity and supplier licences must be verified separately. No device or external integration is guaranteed compatible unless confirmed in writing. Do not upload biometric templates without an agreed lawful processing arrangement.

9. Confidentiality and ownership
Each party must protect the other’s non-public business information, use it only for this relationship and disclose it only to authorised recipients or as legally required. This does not cover information already lawfully public or independently obtained without a confidentiality breach. You retain rights in your data; we retain rights in Staff Platform, its software and documentation. You grant only the rights needed for authorised service delivery. Confidentiality and relevant data-protection duties continue after termination.

10. Suspension, termination and data return
We may restrict access where reasonably necessary for non-payment, material misuse, security threats or legal requirements. Where practicable we will explain the reason and give a reasonable opportunity to remedy it; urgent protection may require immediate action. Either party may end the agreement for a material breach not corrected within 30 days after written notice, or immediately where continued performance would be unlawful. Subscription expiry restricts access but does not itself represent deletion of your records.
On termination, contact us promptly to arrange return or deletion of client data. We will provide a reasonable opportunity for an authorised export and agree a secure return/deletion timetable, subject to applicable retention duties and legal holds. Data retained for such duties will be restricted to that purpose; backup copies will be removed through the applicable retention cycle. You are responsible for retaining employer records required by law. We will not retain employee information indefinitely merely because access has expired.

11. Liability and allocation of risk
To the extent permitted by law, neither party is liable to the other for indirect or consequential loss, lost profits or lost business opportunities arising from this agreement. Subject to the exceptions below, our aggregate contractual liability for claims connected with the service is limited to the subscription fees paid by you for the service in the 12 months preceding the event giving rise to the claim. Related events are treated as one claim for this limit.
These exclusions and limits do not apply to fraud, deliberate misconduct, gross negligence, breach of confidentiality or data-protection obligations, or any liability or remedy that applicable law does not allow to be excluded or limited. Neither party is responsible for loss to the extent caused by the other’s unlawful acts, materially inaccurate instructions or failure to take reasonable mitigation steps. You remain responsible for third-party claims to the extent caused by your unlawful content, unauthorised processing or deliberate misuse; this does not make you responsible for our own acts or omissions. No clause removes employee or data-subject rights or a regulator’s powers.

12. Events beyond reasonable control
Neither party is liable for delay caused by an event genuinely beyond its reasonable control, provided it takes reasonable steps to minimise the effect and resumes performance promptly. This does not excuse avoidable security failures, obligations already due, data-protection duties or payment for service already supplied. For a prolonged interruption the parties will discuss a fair continuation, credit or termination arrangement, subject to mandatory remedies.

13. Changes, notices and disputes
We will identify revised terms by a new version and notify you of material changes before they apply. Changes do not retrospectively replace the version you accepted; material changes require fresh acceptance or a written agreement as appropriate. Keep your authorised contact details current. Formal notices to us may be sent to CN Holdings Ltd, P.O. Box 28995-00100, Nairobi, Kenya. We may send service notices to your registered contact email.
Kenyan law governs this agreement. First raise a dispute in writing with enough detail to investigate; the parties should attempt a good-faith resolution within 30 days, without preventing urgent relief, statutory complaints or compliance with filing deadlines. Kenyan courts have jurisdiction subject to mandatory applicable law. Nothing prevents a complaint to the Office of the Data Protection Commissioner or another competent authority. If a provision is unenforceable, the remainder continues to the extent lawful. A delay in enforcing a right is not a waiver.