Privacy Policy

Anyega Osiemo & Co. Advocates (“the Firm”, “we”, “us”) is committed to protecting your privacy. This policy explains how we collect, use, store and protect personal data when you use this website or engage our services.

We process personal data in accordance with the Constitution of Kenya 2010 (Article 31), the Data Protection Act, 2019 and its regulations, and — where applicable to diaspora clients comparable foreign frameworks such as the EU GDPR.

Depending on how you interact with us, we may collect:

• Identity data: Name, title and (for client engagements) identification documents;
• Contact data: Email address, phone/WhatsApp number and postal address;
• Enquiry data: Information you include in the contact form, newsletter sign-up or WhatsApp messages;
• Technical data: IP address, browser type and pages visited, collected through cookies and similar technologies (see our Cookie Policy);
• Client matter data: Information necessary to provide legal services, collected under our professional duty of confidentiality.

We use personal data to:

• Respond to enquiries and provide legal services;
• Send the newsletter you subscribed to (you may unsubscribe at any time);
• Administer, secure and improve the website;
• Comply with legal, regulatory and professional obligations, including anti-money-laundering requirements;
• Establish, exercise or defend legal claims.

We process personal data only where a lawful basis exists under section 30 of the Data Protection Act, 2019: your consent; performance of a contract with you; compliance with a legal obligation; protection of your vital interests; or our legitimate interests, which do not override your rights and freedoms.

We do not sell personal data. We share it only with:

• Service providers who process data on our instructions (e.g. email newsletter delivery via Brevo, website hosting via Netlify, security services via Cloudflare), under appropriate safeguards;
• Courts, regulators and counterparties where required in the conduct of your matter or by law;
• Professional advisers and insurers, under confidentiality obligations.

Some of our service providers store data outside Kenya. Where personal data is transferred outside Kenya, we ensure the transfer complies with sections 48-49 of the Data Protection Act, 2019 including transfers to jurisdictions with adequate protection or subject to appropriate safeguards.

We apply appropriate technical and organisational measures encryption in transit, access controls and confidentiality undertakings to protect personal data against unauthorised access, loss or disclosure.

We retain personal data only as long as necessary for the purposes collected, subject to the Limitation of Actions Act and the Law Society of Kenya's file-retention guidance for client matters.

Under the Data Protection Act, 2019 you have the right to:

• Be informed about how your data is used;
• Access personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of data we have no lawful basis to retain;
• Object to or restrict processing, including for direct marketing;
• Data portability, where processing is automated and based on consent or contract.

To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke).

This website uses cookies and similar technologies. For details of the categories we use and how to manage your preferences, see our Cookie Policy.

Questions, requests or complaints about this policy and our data practices may be directed to info@anyegaosiemo.com or +254 741 480 122, or by post to Bruce House, 10th Floor, Nairobi, Kenya.

We may update this policy from time to time; the “Last updated” date reflects the latest version.