1) Who We Are and How to Contact Us

KMK Advocates is a legal practice in Kenya providing a full range of legal services to individuals, businesses, and organizations.

2) Scope

This Policy applies to personal data processed when you browse our website, submit a contact enquiry, call or email us, or otherwise interact with our firm in connection with legal services. This Policy does not apply to third-party websites linked from our site; those are governed by their own privacy notices.

3) Personal Data We Collect

• Contact and identification data such as name, email address, phone number, and postal address provided via our contact channels.
• Matter information you choose to share about your legal enquiry (for example, practice area, documents, timelines).
• Device and usage data such as IP address, browser/user-agent, pages viewed, and timestamps collected to operate and secure the website.
• Communications content and metadata when you email or call us, necessary to respond and maintain records consistent with legal and regulatory obligations.

Please do not include highly sensitive information in initial website messages. We will advise secure channels where necessary.

4) How We Use Personal Data

• To respond to enquiries, schedule consultations, and provide legal services you request.
• To manage client relationships, billing, and administrative operations.
• To maintain the security, availability, and performance of our website and IT systems.
• To comply with professional, legal, tax, and regulatory obligations and to establish or defend legal claims.
• With your consent where required by law, for specific purposes explained at the time of collection.

5) Legal Bases

Depending on the context, our processing relies on one or more of the following legal bases:

• Contract where processing is necessary to enter into or perform a retainer or provide requested services.
• Legitimate interests in operating a secure website, communicating with you, and running our practice, balanced against your rights.
• Legal obligation for record-keeping, anti-money laundering/know-your-client, and other regulatory requirements.
• Consent where required by law (you may withdraw consent at any time, without affecting prior lawful processing).

We align this Policy with the Kenya Data Protection Act, 2019 and, where applicable, the EU/UK GDPR for visitors from those jurisdictions.

6) Sharing and Disclosure

We disclose personal data only as necessary for the purposes above, including to:

• Professional service providers such as counsel, experts, couriers, or process servers engaged in your matter.
• IT and site operations providers that host or support our systems under contractual confidentiality and security obligations.
• Regulators, courts, law enforcement, or counterparties where required by law, court order, or to establish, exercise, or defend legal claims.
• Other parties with your authorisation.

We do not sell personal data.

7) International Transfers

Where data is transferred outside Kenya (or, where applicable, outside the EEA/UK), we implement appropriate safeguards such as contractual protections or rely on other lawful transfer mechanisms as permitted by applicable law.

8) Data Retention

We retain personal data for as long as necessary for the purpose collected, to meet legal, regulatory, tax, and accounting requirements, and to establish or defend legal claims. Retention periods vary by matter type and our professional obligations.

9) Data Security

We use administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. No system is perfectly secure; we encourage you to contact us before sending sensitive information electronically.

10) Your Privacy Rights

Subject to applicable law and certain exemptions, you may have rights to:

• Request access to, or a copy of, your personal data.
• Request correction or deletion of inaccurate data.
• Object to or restrict certain processing, or withdraw consent where we rely on consent.
• Request data portability (where applicable).
• Lodge a complaint with a supervisory authority (for Kenya, the Office of the Data Protection Commissioner; for EU/UK visitors, your local authority).

To exercise these rights, contact us using the details below. We may need to verify your identity before fulfilling your request.

11) Cookies and Similar Technologies

Our website may use essential cookies necessary for basic functionality and security, and may use optional analytics or performance cookies to help us understand site usage and improve our services. You can manage cookies through your browser settings. If we deploy non-essential cookies, we will present appropriate notice and choices.

12) Children’s Privacy

Our services are intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can take appropriate action.

13) Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top indicates the most recent revision. Material changes will be highlighted on this page.

14) How to Contact Us

For questions about this Policy or to exercise your rights, contact: