Privacy Policy

YES Employment Solutions (“YES”, “we”, “us”) is an employer-of-record and HR services company based in Addis Ababa, Ethiopia. Client companies engage us to employ people on their behalf; we handle the employment contract, payroll, statutory contributions, leave and related administration.

YES HRIS is the internal system our staff use to do that work. We are the data controller for the personal data described in this policy. You can reach us at hr@yes.et or at Bethlehem Plaza, Megenagna, Addis Ababa, Ethiopia.

This policy applies to:

• Staff users — YES employees who sign in to YES HRIS to manage clients, employees and payroll.
• Employees — people YES employs on behalf of a client, whose employment and payroll records are kept in the system and who receive payslips from it.
• Client contacts — the people at client companies we deal with for invoicing, approvals and reporting.

Employees and client contacts do not sign in to YES HRIS; their data is entered and maintained by YES staff under our agreements with them and with the client.

Staff accounts. Name, work email address, role, and sign-in details. If you sign in with Google, we receive your name, email address and profile picture from your Google Account (see Google user data).

Employee records. The information needed to employ and pay someone lawfully in Ethiopia: name (including in Amharic), contact details, personal and work email addresses, date of birth, gender, national ID or passport details, Tax Identification Number (TIN), pension ID, bank account details, position, department, start and end dates, salary and allowances, overtime, deductions, loans and advances, benefits, leave entitlements and requests, contracts and supporting documents, and emergency contact details.

Payroll and payslip records. Calculated pay, tax and pension amounts, bank payment files, and, when a payslip is emailed, a record of the address it went to, when it was sent, the identifier of the message, and a copy of the PDF that was sent.

Client records. Company details, contacts, contracts, invoices and payments.

Technical and audit data. Server logs and an audit trail of significant actions in the system (who changed what and when), used for security and accountability.

We use personal data to:

• perform employment contracts: onboarding, payroll, leave, benefits and end-of-employment settlements;
• meet legal obligations in Ethiopia, including income tax withholding and pension contributions, and keep the records those obligations require;
• invoice clients and report to them on the employees they engage through us;
• send employees their payslips and other employment-related communications;
• keep the system secure and maintain an audit trail of changes.

We rely on the employment contract, our legal obligations, and our legitimate interest in running our business securely as the basis for this processing. We do not use personal data for advertising, profiling or automated decisions with legal effect, and we do not sell it.

YES HRIS uses Google services in two limited ways. This section describes precisely what data we receive from Google, how we use it, and how to withdraw access.

YES HRIS includes an assistant that helps staff work through payroll and look up HR information. When a member of staff uses it, the text they type and the records the assistant retrieves to answer are processed by Google’s Gemini API on our behalf. The assistant can only act within the permissions of the signed-in staff member, and any change it makes is confirmed by that person and recorded in the audit trail. We do not use this data to train models.

We share personal data only where necessary to do our work:

• Clients — the client that engages an employee through us receives the employment and payroll information needed for invoicing, approvals and reporting on that employee.
• Banks and authorities — to pay salaries and to file income tax and pension contributions with the Ethiopian authorities, as the law requires.
• Service providers — companies that host and run the system for us under contract: Supabase (database, authentication and file storage), Vercel (application hosting), and Google (sign-in, Gmail sending and the Gemini API, as described above). They process data only on our instructions.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access inside YES HRIS is role-based, every account is individually authenticated, and significant actions are written to an audit trail. Credentials that grant access to external services, such as the Gmail authorisation, are stored encrypted and are never exposed to the browser.

We keep employment and payroll records, including payslip delivery records, for as long as an employment relationship lasts and afterwards for as long as Ethiopian tax, pension and labour regulations and our contractual obligations require. Staff accounts are removed when a member of staff leaves YES. Where data is no longer needed, we delete or anonymise it.

YES HRIS uses only the cookies and browser storage it needs to work:

• a session cookie that keeps a signed-in member of staff signed in;
• a short-lived cookie that protects the Google connection step against forgery;
• local browser storage for your preferences (such as light or dark theme) and for unsaved drafts and review marks in payroll screens, which stay on your device.

We do not use advertising or third-party analytics cookies.

Subject to applicable Ethiopian law, including the Personal Data Protection Proclamation (No. 1321/2024), you may ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is inaccurate or incomplete;
• delete data we no longer have a lawful reason to keep;
• restrict or object to processing in certain circumstances.

Employees can also choose which of their email addresses (personal or work) receives their payslips by telling HR. To exercise any of these rights, contact us using the details below. We may need to verify your identity first, and we will respond within the period the law allows.

We may update this policy when the system or the law changes. The effective date and version at the top of this page always show the current version, and material changes will be communicated to staff and, where they affect employees, through HR.

Questions, requests or concerns about personal data: