PRIVACY POLICY

01. WHO WE ARE (DATA CONTROLLER)

Maranga Nyang'ute & Co. Advocates ("we", "us", "our")

Kanha House, 2nd Floor, Lower Kabete Road, Westlands, Nairobi
P.O. Box 4017–00100, Nairobi, Kenya
Tel: +254 113 773 568
Email: data@maranganyanputeadvocates.com

We process personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and the Data Protection (General) Regulations, 2021.

02. WHAT THIS POLICY COVERS

This policy explains how we collect, use, disclose, transfer, and safeguard personal data when you

• visit our website or social media pages,
• contact us by phone, email, WhatsApp, or through our forms,
• engage us to provide legal services,
• apply for a role with us or attend our offices.

03. PERSONAL DATA WE COLLECT

Information you provide directly

• Identity and contact details (name, ID/passport no., email, phone, address).
• Matter details and documents (including sensitive data where relevant to your case).
• Employment and corporate details (employer, directorships, KRA PIN, company info).
• Records of communications (emails, messages, call notes, meeting notes).
• Recruitment data (CV, qualifications, references) if you apply to work with us.

Information we collect automatically (website)

• Technical data: IP address, device/browser type, pages visited, timestamps.
• Cookies and similar technologies (see Section 9).

Information from third parties

• Referrals, counterparties, regulators, credit reference agencies, public records and registries (e.g., eCitizen, BRS, land registry, IP registries), and service providers assisting on your matter.

04. LAWFUL BASES FOR PROCESSING

We process personal data on the following bases under the DPA:

• Consent (e.g., newsletter sign-ups, optional cookies).
• Contract (to take steps at your request before entering into, or to perform, an engagement).
• Legal obligation (KYC/AML, tax, statutory filings, court directives).
• Legitimate interests (to run and secure our practice, manage client relationships, prevent fraud, improve our services), balanced against your rights.
• Public interest / exercise of legal claims (establishment, exercise or defence of legal claims and legal professional privilege).

Where we rely on consent, you can withdraw it at any time (see Section 12).

05. HOW WE USE YOUR DATA

• To provide and manage legal services, advice, and representation.
• To verify identity, conduct conflicts and AML/KYC checks where applicable.
• To communicate with you, schedule meetings, and manage your account/matter.
• To manage billing, payments, and accounting (where applicable).
• To improve our website, services, and user experience.
• To meet regulatory, professional, and court obligations.
• With your consent, to send service updates or invitations to events.
• We do not sell personal data.

06. SHARING YOUR DATA

We may share data, on a need-to-know basis, with:

• Our partners, advocates, and authorised staff.
• Service providers (IT hosting, email, document management, call or SMS tools, couriers) under written confidentiality and data-processing agreements.
• Counsel, experts, mediators, arbitrators, translators, investigators where relevant to your matter.
• Opposing counsel, courts, tribunals, regulators, law enforcement, or authorities where legally required or necessary for your case.
• Your appointed agents or other recipients at your instruction.

07. INTERNATIONAL TRANSFERS

Your data may be transferred or stored outside Kenya when using cloud services or communicating with foreign counsel/parties. Where we do so, we implement appropriate safeguards (e.g., contractual clauses, processor due diligence, encryption) consistent with the DPA. You may contact us for details.

08. RETENTION

We retain personal data only as long as necessary for the purposes above, including:

• Client matter files: generally, 7 years after closure (or longer if required by law, professional rules, or potential claims).
• KYC/AML records: as required by law.
• Recruitment records: typically, 12 months for unsuccessful candidates.

We will securely delete or anonymise data when retention periods expire.

09. COOKIES & ANALYTICS (WEBSITE)

We may use essential cookies to make the site work and optional cookies (e.g., analytics) to understand usage and improve performance.

• You can manage cookies via your browser settings and, where presented, our cookie banner.
• If we use third-party analytics (e.g., aggregated, pseudonymised statistics), those providers act as processors under contract.

10. SECURITY

We implement technical and organisational measures appropriate to risk, including controlled access, encryption in transit where feasible, secure storage, staff confidentiality undertakings, and vendor due diligence. While no system is completely secure, we work to prevent unauthorised access, alteration, disclosure, or loss.

11. CHILDREN'S DATA

Our services are generally directed to adults. Where matters involve minors (e.g., family, succession), we process their data only as necessary and in line with the law, typically through a parent/guardian or court-appointed representative.

12. YOUR RIGHTS

Subject to legal and professional obligations (including privilege), you may have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase data ("right to be forgotten") where applicable.
• Restrict or object to certain processing (including direct marketing).
• Data portability where technically applicable.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact info@maranganyanputeadvocates.com. We may need to verify your identity and the scope of your request.

13. LEGAL PROFESSIONAL PRIVILEGE & CONFIDENTIALITY

Many of our activities are covered by advocate-client confidentiality and legal professional privilege. These obligations may limit what we can disclose, including in response to certain rights requests.

14. THIRD-PARTY LINKS

Our website may contain links to third-party sites. We are not responsible for their privacy practices or content. Review their policies before providing personal data.

15. WHATSAPP, CALLS & MESSAGING

If you contact us via phone, SMS, or WhatsApp, we will process the information you share (including caller ID and message content) to respond to your enquiry and manage your matter. Messaging platforms may process your data under their own terms.

16. CHANGES TO THIS POLICY

We may update this policy from time to time. The "Last updated" date will change accordingly. Your continued use of our website or services after changes indicates your acknowledgement of the updated policy.

17. HOW TO CONTACT US & COMPLAINTS

Questions or requests: data@maranganyanputeadvocates.com
Tel: +254 113 773 568

If you believe your data protection rights have been infringed, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya. We encourage you to contact us first so we can address your concerns.