Privacy Policy
Last updated: 10th November 2025
Company: Keega & Company Advocates LLP
Website: https://keegalegal.com
Contact: info@keegalegal.com
1. Introduction & Controller Information
At Keega & Company Advocates LLP, we are committed to protecting your privacy and handling your personal data with care and in accordance with the law. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.
Data Controller: Keega & Company Advocates LLP, a law firm registered in Kenya, is the data controller responsible for your personal data.
Contact: For any data protection inquiries, please contact our designated Data Protection Officer at info@keegalegal.com or Westpark Suites, Suite 204, Ojijo Close.
We process personal data in compliance with the Kenya Data Protection Act, 2019, and its associated regulations.
At Keega & Company Advocates LLP, we are committed to protecting your privacy and handling your personal data with care and in accordance with the law. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.
Data Controller: Keega & Company Advocates LLP, a law firm registered in Kenya, is the data controller responsible for your personal data.
Contact: For any data protection inquiries, please contact our designated Data Protection Officer at info@keegalegal.com or Westpark Suites, Suite 204, Ojijo Close.
We process personal data in compliance with the Kenya Data Protection Act, 2019, and its associated regulations.
2. Information We Collect
We may collect, use, store, and transfer different kinds of personal data, which we have grouped as follows:
• Identity & Contact Data: Name, title, passport/national ID number, address, email, telephone number.
• Financial Data: Bank account, payment card details, income, and other financial information for billing and financial assessments.
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Usage Data: Information about how you use our website and services.
• Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.
• Matter-Specific Data: Information necessary for providing legal services, which may include highly Sensitive Personal Data such as:
• Details of race or ethnicity, religious or philosophical beliefs, sex life, or sexual orientation.
• Information about health, genetic, or biometric data
• Information about criminal convictions and offences or related security measures.
We may collect, use, store, and transfer different kinds of personal data, which we have grouped as follows:
• Identity & Contact Data: Name, title, passport/national ID number, address, email, telephone number.
• Financial Data: Bank account, payment card details, income, and other financial information for billing and financial assessments.
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Usage Data: Information about how you use our website and services.
• Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.
• Matter-Specific Data: Information necessary for providing legal services, which may include highly Sensitive Personal Data such as:
• Details of race or ethnicity, religious or philosophical beliefs, sex life, or sexual orientation.
• Information about health, genetic, or biometric data
• Information about criminal convictions and offences or related security measures.
3. How We Collect Your Data
We use different methods to collect data from and about you, including:
• Automated Technologies or Interactions: As you interact with our website, we may automatically collect Technical and Usage Data. We collect this personal data by using cookies, server logs, and other similar technologies.
• Direct Interactions: You may give us your Identity, Contact, Financial, and Matter-Specific Data by filling in forms or by corresponding with us by post, phone, email, or in person. This includes personal data you provide when you:
• Instruct us to provide legal services;
• Subscribe to our publications or newsletters;
• Request marketing to be sent to you;
• Or give us feedback.
• Third Parties or Publicly Available Sources: We may receive personal data about you from various third parties and public sources, such as:
• Opposing parties, courts, and tribunals in the context of your legal matter;
• Government agencies or public registers;
• Analytics providers (such as Google).
We use different methods to collect data from and about you, including:
• Automated Technologies or Interactions: As you interact with our website, we may automatically collect Technical and Usage Data. We collect this personal data by using cookies, server logs, and other similar technologies.
• Direct Interactions: You may give us your Identity, Contact, Financial, and Matter-Specific Data by filling in forms or by corresponding with us by post, phone, email, or in person. This includes personal data you provide when you:
• Instruct us to provide legal services;
• Subscribe to our publications or newsletters;
• Request marketing to be sent to you;
• Or give us feedback.
• Third Parties or Publicly Available Sources: We may receive personal data about you from various third parties and public sources, such as:
• Opposing parties, courts, and tribunals in the context of your legal matter;
• Government agencies or public registers;
• Analytics providers (such as Google).
4. How We Use Your Data (Purposes of Processing)
We will only use your personal data when the law allows us to. Our primary legal bases for processing are:
• Performance of a Contract: Providing our legal services to you as per our engagement agreement.
• Legal Obligation: Complying with our legal and regulatory duties (e.g., anti-money laundering and counter-terrorism financing checks).
• Legitimate Interests: Pursuing our legitimate business interests (e.g., administrative functions, business development, network security), provided your interests and fundamental rights do not override those interests.
• Vital Interests: Protecting someone's life.
• Establishment, Exercise, or Defense of Legal Claims: Processing necessary for the purpose of legal proceedings, obtaining legal advice, or otherwise establishing, exercising, or defending legal rights.
• Consent: In specific situations where we have sought and you have provided clear, explicit consent.
We will only use your personal data when the law allows us to. Our primary legal bases for processing are:
• Performance of a Contract: Providing our legal services to you as per our engagement agreement.
• Legal Obligation: Complying with our legal and regulatory duties (e.g., anti-money laundering and counter-terrorism financing checks).
• Legitimate Interests: Pursuing our legitimate business interests (e.g., administrative functions, business development, network security), provided your interests and fundamental rights do not override those interests.
• Vital Interests: Protecting someone's life.
• Establishment, Exercise, or Defense of Legal Claims: Processing necessary for the purpose of legal proceedings, obtaining legal advice, or otherwise establishing, exercising, or defending legal rights.
• Consent: In specific situations where we have sought and you have provided clear, explicit consent.
| Purpose/Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| To register you as a new client and conduct conflict checks | Identity & Contact | Performance of a Contract, Legal Obligation |
| To provide and collect payments | Identity, Contact & Financial | Performance of a Contract, Legal Obligation |
| To manage our relationship and inform you of changes | Identity, Contact & Marketing | Performance of a Contract, Legal Obligation & Legitimate Interests |
| To administer and protect our businesses and website | Identity, Contact, Usage & Technical | Legitimate interests (for running our business, network security) |
| To deliver relevant website content and measure effectiveness | Identity, Contact, Usage & Marketing | Consent, Legitimate Interests (to study how clients use our services) |
| To make suggestions and recommendations about services that may be of interest | Identity, Contact, Technical, Usage & Marketing | Legitimate Interests (to develop our services and grow our business) or Consent |
5. Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and whether we can achieve those purposes through other means.
In particular, we are required to retain certain client information and matter files for a minimum period as prescribed by law and our professional indemnity insurers (typically seven (7) years from the conclusion of a matter, or longer for certain legal matters). After this period, we will securely destroy or anonymize your personal data.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and whether we can achieve those purposes through other means.
In particular, we are required to retain certain client information and matter files for a minimum period as prescribed by law and our professional indemnity insurers (typically seven (7) years from the conclusion of a matter, or longer for certain legal matters). After this period, we will securely destroy or anonymize your personal data.
6. Data Subject Rights
Under the Data Protection Act, you have the right to:
• Access: Request copies of your personal data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (not an absolute right).
• Restriction: Request suspension of processing of your personal data.
• Portability: Request transfer of your data to another organization.
• Object: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent at any time where we rely on consent to process your data.
To exercise any of these rights, please contact us using the details in Section 13. We will respond to your particular Data Subject Request within the prescribed timeline provided by Kenyan law. We may need to verify your identity before proceeding.
Under the Data Protection Act, you have the right to:
• Access: Request copies of your personal data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (not an absolute right).
• Restriction: Request suspension of processing of your personal data.
• Portability: Request transfer of your data to another organization.
• Object: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent at any time where we rely on consent to process your data.
To exercise any of these rights, please contact us using the details in Section 13. We will respond to your particular Data Subject Request within the prescribed timeline provided by Kenyan law. We may need to verify your identity before proceeding.
7. Data Security
We have implemented appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. These include encryption, access controls, secure storage facilities, and confidentiality obligations for our staff.
We have implemented appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. These include encryption, access controls, secure storage facilities, and confidentiality obligations for our staff.
8. Data Sharing and International Transfers
We may share your personal data with:
Service Providers: IT and cloud storage providers, administrative support services.
Legal and Regulatory Bodies: Courts, tribunals, opposing counsel, barristers, expert witnesses, and government agencies as required for your matter or by law.
Other Third Parties: As necessary for the purposes outlined in this policy.
We require all third parties to respect the security of your data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes.
Your data may be transferred outside Kenya. When we do so, we use one of these safeguards:
• Transferring to countries with an Adequacy Decision from the Data Commissioner.
• Using Standard Contractual Clauses approved for use in Kenya.
• Where the transfer is necessary for the establishment, exercise, or defense of legal claims.
We may share your personal data with:
Service Providers: IT and cloud storage providers, administrative support services.
Legal and Regulatory Bodies: Courts, tribunals, opposing counsel, barristers, expert witnesses, and government agencies as required for your matter or by law.
Other Third Parties: As necessary for the purposes outlined in this policy.
We require all third parties to respect the security of your data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes.
Your data may be transferred outside Kenya. When we do so, we use one of these safeguards:
• Transferring to countries with an Adequacy Decision from the Data Commissioner.
• Using Standard Contractual Clauses approved for use in Kenya.
• Where the transfer is necessary for the establishment, exercise, or defense of legal claims.
9. Use of Cookies
Our website uses cookies to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.
Our website uses cookies to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.
10. Changes to this Privacy Policy
We keep this policy under regular review. The date of the last update is at the top of this page. We may update this policy and will notify you of significant changes via email or a notice on our website.
We keep this policy under regular review. The date of the last update is at the top of this page. We may update this policy and will notify you of significant changes via email or a notice on our website.
11. Complaints
You have the right to make a complaint at any time to the Office of the Data Protection Commissioner (ODPC) in Kenya. We would, however, appreciate the chance to deal with your concerns before you approach the ODPC, so please contact us in the first instance.
You have the right to make a complaint at any time to the Office of the Data Protection Commissioner (ODPC) in Kenya. We would, however, appreciate the chance to deal with your concerns before you approach the ODPC, so please contact us in the first instance.
12. Contact Information
For any questions about this Privacy Policy or to exercise your data protection rights, please contact us at:
Keega & Company Advocates LLP
Westpark Suites, Suite 204
Ojijo Close
NAIROBI
Email: info@keegalegal.com
Phone: +254 713 451 503
For any questions about this Privacy Policy or to exercise your data protection rights, please contact us at:
Keega & Company Advocates LLP
Westpark Suites, Suite 204
Ojijo Close
NAIROBI
Email: info@keegalegal.com
Phone: +254 713 451 503