lelo advocates

Privacy Policy

Last Updated: Tue 15th September, 2026

1. Introduction

Lelo Advocates (“the Firm”, “we”, “us” or “our”) is a sole proprietorship law practice providing legal advisory and advocacy services in Kenya. We are committed to protecting the privacy of clients, prospective clients, website visitors and other individuals who interact with us.

This Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it. It is issued in compliance with the Data Protection Act, No. 24 of 2019 (“the Act”), its Regulations, and Article 31 of the Constitution of Kenya, 2010.

2. Who We Are

Lelo Advocates is a sole proprietorship registered in Kenya, with its place of business at 1st Floor, Uptown Mall, along Ngong’ – Embulbul Road, Kenya. For purposes of the Act, the Firm is a data controller and, in some instances, a data processor.

3. Personal Data We Collect

Depending on our relationship with you, we may collect:

Identification details – name, ID/passport number, KRA PIN, address, phone, email
Matter and client information – instructions, documents and correspondence relevant to your case
Financial information – billing, payment and “know-your-client” details
Website data – IP address, browser type and usage data via cookies
Sensitive personal data – e.g. health, family or criminal-record details, only where relevant to a matter and handled with extra care

We collect data directly from you, from your representatives, from public sources (e.g. court and company registries), from relevant third parties, and automatically through our website.

4. Why We Use Your Personal Data

We process personal data to: provide legal advice and representation; conduct conflict and anti-money-laundering checks; prepare and file documents on your behalf; bill and collect fees; comply with legal and professional obligations (including under the Advocates Act); manage recruitment and supplier relationships; operate and secure our website; and, where you consent, send legal updates or event invitations.

5. Legal Basis for Processing

In line with section 30 of the Act, we process personal data on the basis of: your consent; performance of a client engagement or contract; compliance with a legal obligation; protection of vital interests; the public interest; or our legitimate interests, balanced against your rights. Sensitive personal data is processed only where a further condition under the Act is met, such as explicit consent or the establishment of a legal claim.

6. Sharing of Personal Data

All client information is treated as confidential in line with our professional obligations. We do not sell personal data. We may share it with courts and regulators, opposing counsel or co-counsel where necessary, service providers (e.g. IT, cloud storage, accounting), financial institutions for payment processing, or any other party with your consent or as required by law. Third parties handling your data on our behalf are bound by confidentiality and security obligations.

7. Cross-Border Transfers

Where personal data must be transferred outside Kenya – for example, to correspondent counsel or a cloud provider – we do so in accordance with Part VI of the Act and its Regulations, including verifying adequate safeguards or obtaining consent where required.

8. Retention and Security

We retain personal data only as long as necessary for the purpose collected, and as required by law or professional conduct rules, after which it is securely destroyed or anonymised. We apply appropriate technical and organisational safeguards – including access controls and secure storage – to protect your data, and will notify the Office of the Data Protection Commissioner (“ODPC”) and affected individuals of any reportable data breach as required by the Act.

9. Cookies

Our website may use cookies to improve your browsing experience and website security. You may disable cookies through your browser settings, though some website features may not function properly as a result.

10. Your Rights

Under section 26 of the Act, you have the right to: be informed of how your data is used; access your personal data; request correction of inaccurate data; object to processing; request data portability; be informed of and challenge automated decision-making; request deletion of unlawfully held data; and withdraw consent at any time. Some requests may be limited where information is subject to legal privilege or a legal retention obligation. To exercise these rights, contact us using the details in clause 12.

11. Marketing and Children’s Data

You may opt out of marketing communications at any time by contacting us or using the “unsubscribe” link provided. We do not knowingly collect data from children except where necessary for legal representation (e.g. succession or family law matters), in which case additional safeguards under section 33 of the Act apply, including parental or guardian consent.

12. Contact Us and Complaints

For questions about this Policy or to exercise your rights, contact our Data Protection point of contact at: [name] – [email address] – [telephone number].

If you are not satisfied with our response, you may lodge a complaint with:

Office of the Data Protection Commissioner, Britam Towers, Hospital Road, Upper Hill, Nairobi | P.O. Box 30231-00100, Nairobi | info@odpc.go.ke | www.odpc.go.ke

13. Changes to This Policy and Governing Law

We may update this Policy from time to time; changes will be posted here with a revised “Last updated” date. This Policy is governed by the laws of Kenya, and any dispute shall be subject to the exclusive jurisdiction of the Kenyan courts.

This Policy does not form part of, or vary, any engagement letter between the Firm and its clients, and does not affect any privilege or confidentiality attaching to client communications.