1. Introduction

Waithaka & Associates Advocates ("we", "us", "our" or "the Firm") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit our website, engage us for legal services, or otherwise interact with us.

We process personal data in accordance with Article 31 of the Constitution of Kenya, 2010, the Data Protection Act, 2019 (the "Act"), the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, and the guidance issued from time to time by the Office of the Data Protection Commissioner ("ODPC").

By using our website or providing us with your personal data, you acknowledge that you have read and understood this Privacy Policy. Where the law requires your consent, we will ask for it separately.

2. Who We Are (Data Controller)

Waithaka & Associates Advocates is a law firm registered in Kenya, with its offices at 2nd Floor, All Africa Conference of Churches, Waiyaki Way, Nairobi. For the purposes of the Act, the Firm is the data controller in respect of the personal data it collects and determines the purpose and means of processing.

Questions about this policy or our data protection practices may be directed to us using the contact details in Section 20 below.

3. Scope of This Policy

This Privacy Policy applies to personal data we collect through:

• Our website and its online forms, including the contact and appointment booking forms;
• Communications with us by email, telephone, in person or by other means;
• Instructions you give us to provide legal services, and information generated in the course of a legal matter;
• Our relationships with suppliers, service providers and professional partners; and
• Recruitment, including applications and enquiries from prospective employees or interns.

This policy does not apply to third-party websites or services that we do not control, even where they are linked from our website.

4. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data: name, identification or passport number, KRA PIN, date of birth and nationality;
• Contact data: postal address, email address and telephone numbers;
• Matter and client data: information you provide in relation to a legal matter, including case facts, documents, correspondence and information relating to other parties;
• Financial data: billing details, payment information and bank account details;
• Recruitment data: curriculum vitae, references, qualifications and employment history;
• Technical and usage data: IP address, browser type, device information, pages visited and time spent, collected through cookies and similar technologies; and
• Communications data: emails, telephone calls, messages and notes of meetings.

Sensitive (special category) personal data

In the course of providing legal services we may process sensitive personal data, such as health data or details of family and private life. Where we do so, we rely on your explicit consent and/or on the establishment, exercise or defence of legal claims, as permitted under section 44 of the Act.

5. How We Collect Personal Data

• Directly from you: when you fill in a form on our website, email or call us, or meet with us in person;
• From third parties: for example referrals, opposing parties, courts and registries, and your other professional advisers; and
• Automatically: through cookies, server logs and similar technologies when you use our website, as described in Section 14.

6. Lawful Basis for Processing

Under section 30 of the Act, we process personal data only where at least one of the following lawful bases applies:

• You have given us consent for one or more specific purposes;
• Processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract;
• Processing is necessary for compliance with a legal obligation to which we are subject;
• Processing is necessary to protect your vital interests or those of another person;
• Processing is necessary for the performance of a task carried out in the public interest or the exercise of official authority; or
• Processing is necessary for our legitimate interests or those of a third party, provided your rights and freedoms do not override those interests.

Where we rely on legitimate interests, we carry out a balancing exercise and put in place safeguards to protect your personal data.

7. How We Use Your Personal Data

We use personal data for the following purposes:

• To respond to enquiries and provide legal advice and representation;
• To administer and manage our relationship with you, including conflict-of-interest and Know Your Client (KYC) checks;
• To comply with legal, regulatory and professional obligations, including those of the Law Society of Kenya and applicable anti-money laundering legislation;
• To manage billing, invoicing and payments;
• To operate, maintain and improve our website and our services;
• To send you legal updates, newsletters and event invitations where you have opted in;
• To establish, exercise or defend legal claims; and
• To recruit, manage and administer our staff and interns.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose.

8. Legal Professional Privilege

Information you share with us for the purpose of obtaining legal advice is protected by legal professional privilege and the Advocates Act. Nothing in this Privacy Policy requires us to disclose privileged or confidential information except where you instruct us to, where you have waived privilege, or where disclosure is required or permitted by law.

9. Sharing & Disclosure of Personal Data

We do not sell or rent your personal data. We may share it with the following categories of recipients, only where necessary and subject to appropriate safeguards:

• Other advocates, counsel, experts and consultants instructed on your matter, with your authority;
• Courts, tribunals, government registries and regulators, where required or authorised by law;
• Professional advisers and service providers (including auditors, insurers and IT, cloud hosting and communication providers) who process personal data on our behalf as data processors under written contracts that comply with section 42 of the Act; and
• Law enforcement agencies or other public authorities where we are required by law to do so.

Where we appoint data processors, we take reasonable steps to ensure they implement appropriate security measures and process personal data only on our documented instructions.

10. International Transfers

Our firm is based in Kenya. Where personal data is transferred outside Kenya, we ensure that the transfer complies with section 48 of the Act and the Data Protection (General) Regulations, 2021. This may include transferring personal data to a jurisdiction that has adequate data protection laws, putting in place appropriate safeguards such as contractual clauses, or obtaining your consent where required.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These measures include access controls, encryption where appropriate, secure servers, staff confidentiality obligations and due diligence on the service providers we use.

While no method of transmission over the internet is completely secure, we take reasonable steps to protect your personal data and review our security practices regularly.

12. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to establish, exercise or defend legal claims.

As a general rule, client matter files and related records are retained for a minimum of seven (7) years after the conclusion of a matter, or for such longer period as may be required by law, professional rules or the nature of the matter. When personal data is no longer required, we securely destroy or anonymise it in a manner that prevents reconstruction.

13. Your Rights as a Data Subject

Subject to the conditions and limitations set out in the Act, you have the following rights as a data subject:

• To be informed of the use to which your personal data is to be put;
• To access a copy of the personal data we hold about you;
• To request the rectification or correction of inaccurate, misleading or incomplete personal data;
• To request the erasure or deletion of personal data that is no longer necessary;
• To request the restriction of processing;
• To object to the processing of your personal data;
• To data portability, by receiving your personal data in a structured, commonly used and machine-readable format;
• Not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects; and
• To withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us using the details in Section 20. We may need to verify your identity before acting on your request and may charge a prescribed fee for access requests where permitted by law. We will respond within the timelines set out in the Act.

14. Cookies & Website Analytics

Our website uses cookies and similar technologies to make the site work, remember your preferences and understand how visitors use the site. A cookie is a small text file placed on your device that allows the website to recognise your browser.

You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. However, if you disable cookies, some parts of the website may not function properly. Third-party tools (such as analytics or booking services) may set their own cookies; please refer to the relevant third party privacy notices for more information.

15. Direct Marketing

We may send you newsletters, legal alerts and invitations to events where you have consented, or where we have a legitimate interest and you have not opted out. You can unsubscribe at any time by using the link included in our emails or by contacting us using the details in Section 20. We will honour your request promptly.

16. Children's Personal Data

Our website and services are not directed at children. We do not knowingly collect personal data of children (persons under the age of 18) except where necessary in the course of a legal matter and, where required, with the consent of a parent or guardian as provided under section 33 of the Act. If you believe we have collected a child’s personal data without the required consent, please contact us so that we can take appropriate action.

17. Third-Party Links

Our website may contain links to third-party websites, plugins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

18. Data Breach Notification

In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner within seventy-two (72) hours of becoming aware of the breach, where it poses a risk to your rights and freedoms, in line with section 43 of the Act.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, together with a description of the nature of the breach and the measures we have taken or propose to take to address it and mitigate its possible adverse effects.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, regulatory guidance or our practices. The “Last Updated” date at the top of this page shows when the policy was last revised, and material changes will be posted on this page. We encourage you to review this page periodically.

20. How to Contact Us & Complaints

If you have any questions, requests or complaints about this Privacy Policy or the way in which we handle your personal data, please contact us using the details below:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the supervisory authority established under the Act:

We would appreciate the opportunity to address your concerns before you approach the ODPC, and we will work with you to resolve any issue promptly.