Privacy Policy

1. Who We Are

For the purposes of applicable data protection law, the data controller in respect of personal data collected through the Site is:

Mweresa Trevor & Co. Advocates Advocates of the High Court of Kenya Registered address: Kileleville Cidatel, 1st Floor, Ruaka Email: info@trevormweresa.com

Where we act as a data processor on behalf of a client, for example in the course of a legal automation or compliance engagement, a separate engagement letter or data processing agreement governs that processing. This Policy applies only to our processing of Site visitors' personal data.

2. Scope of This Policy

This Policy applies to personal data we collect through the Site, including through contact and enquiry forms, newsletter sign-ups, booking or consultation requests, and general browsing activity captured through cookies and similar technologies. It does not apply to information you provide to us directly in the course of an active client engagement, which is instead governed by our engagement terms, advocate-client privilege, and our internal confidentiality obligations.

3. Information We Collect

We collect the following categories of information:

• Identity and contact information you provide, such as your name, email address, phone number, company name, and job title.
• Enquiry content, such as the details you share when describing your legal or compliance matter through a contact or booking form.
• Technical and usage data, such as your IP address, browser type, device information, pages visited, and referral source, collected automatically through cookies and analytics tools.
• Communications data, such as records of correspondence between you and the Firm.
• We do not knowingly collect sensitive personal data through the Site unless you voluntarily provide it as part of describing your matter. In that case, we process it strictly in accordance with Section 44 of the Data Protection Act, 2019 and only for the purpose you provided it.

4. How We Use Your Information

We use the information we collect to:

• Respond to enquiries and schedule consultations.
• Assess potential engagements and conduct conflict checks.
• Send newsletters or updates you have subscribed to.
• Maintain, secure, and improve the Site's functionality and content.
• Comply with our legal, regulatory, and professional obligations, including those under the Law Society of Kenya's rules of professional conduct.
• Detect, investigate, and prevent misuse of the Site.

5. Legal Basis for Processing

Under Section 30 of the Data Protection Act, 2019 and, for visitors in the EU or UK, Article 6 of the GDPR, we rely on the following legal bases:

• Consent, where you voluntarily submit a form or subscribe to communications.
• Contract, where processing is necessary to take steps at your request before a potential engagement.
• Legitimate interests, where processing is necessary for the security, administration, and improvement of the Site, provided this does not override your fundamental rights.
• Legal obligation, where processing is required to comply with professional, regulatory, or statutory duties.

6. Cookies and Similar Technologies

The Site may use cookies and similar tracking technologies to recognise repeat visitors, understand how the Site is used, and improve user experience. You can control or disable cookies through your browser settings; disabling cookies may affect certain features of the Site. Where required by applicable law, we will request your consent before placing non-essential cookies and will provide a mechanism to manage your preferences.

7. How We Share Your Information

We do not sell personal data. We may share information with:

• Service providers who support the Site's hosting, analytics, email delivery, or booking functionality, under confidentiality and data processing terms.
• Professional advisers, co-counsel, or regulators, where necessary in connection with a specific matter and subject to advocate-client privilege and confidentiality obligations.
• Regulatory or governmental authorities, where disclosure is required by law or court order.
• A successor entity, in the event of a merger, acquisition, or restructuring of the Firm's practice, subject to equivalent confidentiality protections.

8. International Data Transfers

Because the Site is accessible worldwide, information may be processed or stored on servers located outside Kenya, including through third-party hosting or analytics providers. Where personal data is transferred outside Kenya, we take the steps required under Section 48 of the Data Protection Act to ensure the recipient jurisdiction has appropriate data protection safeguards or that appropriate contractual protections are in place, consistent with the Act's cross-border transfer requirements and, where applicable, GDPR Chapter V.

9. Data Retention

We retain personal data collected through the Site only for as long as necessary to fulfil the purposes described in this Policy, comply with our legal and professional obligations, including record-keeping obligations under Law Society of Kenya rules and tax and regulatory law, or resolve disputes. We then securely delete or anonymise it.

10. Your Rights

Subject to applicable law, you have the right to:

• Be informed of how your personal data is used.
• Access the personal data we hold about you.
• Request correction of inaccurate or outdated data.
• Request deletion of your data, subject to our legal and professional retention obligations.
• Object to or restrict certain processing, including direct marketing.
• Request data portability, where technically feasible.
• Withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
• Kenyan residents may lodge a complaint with the Office of the Data Protection Commissioner if they believe their rights under the Data Protection Act have been infringed. Visitors in the European Economic Area or United Kingdom may lodge a complaint with their local supervisory authority. California residents may have additional rights under the CCPA; we do not sell personal information as defined under the CCPA.
• To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframes required by applicable law.

11. Data Security

We implement appropriate technical and organisational measures, including access controls, encryption in transit, and confidentiality obligations for personnel, to protect personal data against unauthorised access, loss, misuse, or alteration, in line with Section 41 of the Data Protection Act. No system is entirely secure, and we encourage you to avoid submitting highly sensitive information through unsecured forms before establishing a formal, secure engagement channel.

12. Children's Privacy

The Site is not directed at children, and we do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

13. Third-Party Links

The Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites, and we encourage you to review their respective privacy policies.

14. Contact Us

If you have questions about this Policy, wish to exercise your data protection rights, or wish to raise a concern, please contact us at: Email: info@trevormweresa.com Phone: +254 701 606 880 Postal Address: 27402-00100

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. The Last Updated date at the top of this Policy indicates when it was last revised. Material changes will be communicated through the Site or by other appropriate means.