01
Who controls your data
Gatama & Associates LLP is the data controller for the personal data described in this policy.
- Westlands Office Park, Baobab House, Ground Floor, Wing A, Nairobi
- P.O. Box 608-00623, Nairobi, Kenya
- info@gatamalaw.com · +254 727 767 827
This policy explains how we handle personal data in accordance with the Data Protection Act, 2019 and the regulations made under it. It covers visitors to this website, people who make enquiries, clients and their personnel, and other individuals whose data reaches us in the course of a matter.
02
What we collect
When you make an enquiry. Your name, organisation, email address, telephone number, the type of matter you select and whatever you write in the outline. The form transmits this to our mail delivery provider, which sends it to us as an email; we receive it in our own mailbox and it is retained there. If that service is unavailable the form falls back to opening your own email client instead, in which case the message reaches us directly and no third party handles it.
When you become a client. Identification and verification documents, contact and billing details, and information about the matter itself. Depending on the work, that can include financial records, corporate records, title documents, employment records and correspondence. Where the matter concerns a dispute, succession or employment, it may include data about health, family circumstances or alleged offences.
About other people. Matters routinely involve people who are not our client: counterparties, directors, shareholders, beneficial owners, employees, witnesses and beneficiaries. We receive their data from our client, from public registers, or from the other side.
Automatically. Our web host records standard server log data, including IP address, browser type and the pages requested, for security and diagnostic purposes.
03
Why we hold it
- To run conflict of interest checks before we accept instructions
- To meet our client due diligence obligations under anti-money laundering law
- To provide legal services and conduct the matter you have instructed us on
- To correspond with you, with the other side, with counsel and with regulators
- To raise fee notes, collect payment and keep accounting records
- To maintain the file and comply with our professional record-keeping obligations
- To respond to enquiries and, where you have asked us to, keep you informed about the firm
- To secure our systems and defend legal claims
We do not sell personal data. We do not use it for automated decision-making or profiling.
04
Our lawful bases
Performance of a contract. Acting on a matter under our letter of engagement, and billing for it.
Legal obligation. Client due diligence and reporting under the Proceeds of Crime and Anti-Money Laundering Act, tax and accounting record-keeping, and obligations under the Advocates Act and the rules made under it.
Legitimate interests. Running conflict checks, securing our systems, recovering fees and defending claims, and responding to enquiries that do not become instructions. We balance those interests against your rights and interests before relying on this basis.
Consent. Where you have asked to receive updates from us. You can withdraw consent at any time, and withdrawal does not affect anything done before you withdrew it.
Legal claims and the administration of justice. Where we process sensitive personal data in the course of litigation, succession, employment or regulatory work, we do so because it is necessary for the establishment, exercise or defence of a legal claim.
05
Who we share it with
We disclose personal data only where it is necessary for the matter or required of us. That can include:
- Counsel, advocates in other jurisdictions, arbitrators and experts instructed on the matter
- Courts, tribunals and the parties to proceedings
- Registries and regulators, including the Companies Registry, land registries, the Competition Authority of Kenya and sector regulators
- Banks, lenders and their advisers where the transaction requires it
- The other side and their advisers, in the ordinary conduct of a matter
- Our auditors, insurers, bankers and professional advisers
- Service providers who host our systems or support our practice, under written terms that restrict their use of the data
- Our website host (Vercel), the delivery provider for enquiries submitted through this site (Resend), and Cloudflare, which screens that form for automated abuse
- Law enforcement and reporting authorities, where we are required to report
Our duty of confidentiality to clients, and legal professional privilege, continue to apply and are not displaced by this policy.
06
Transfers outside Kenya
Our practice includes cross-border work in South Sudan, Somalia, Somaliland and further afield, and some of our service providers host data outside Kenya. Where personal data leaves Kenya we satisfy ourselves that the transfer meets the requirements of the Data Protection Act, whether through appropriate safeguards, your consent, or because the transfer is necessary for the performance of a contract or for a legal claim.
07
How long we keep it
We keep a client file for as long as the matter is live, and afterwards for the period our professional, statutory and insurance obligations require. That is ordinarily at least seven years from the conclusion of the matter, and longer where the file concerns land, a trust, a minor, or an arrangement that continues to have effect.
Enquiries that do not become instructions are kept only as long as needed to run a conflict check and respond, and are then deleted. Accounting records are kept for the period tax law requires.
08
How we protect it
We apply technical and organisational measures appropriate to the sensitivity of the data: access controls, encrypted transmission, secure storage of physical files, backups, and confidentiality obligations on everyone at the firm and on our suppliers.
No system is perfectly secure. If a breach occurs that is likely to result in a real risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and, where required, you.
09
Cookies and this website
This website sets no advertising or analytics cookies, and embeds no social media tracking.
It is a static site. Nothing you do here is profiled, and no behavioural data is collected. Three third parties are involved, each for one narrow purpose:
- Google Fonts serves the typefaces. Your browser requests those files from Google, which sees your IP address in the ordinary course of serving them.
- Cloudflare Turnstile protects the enquiry form from automated abuse. It loads only on the contact page, checks that the submission comes from a person rather than a bot, and may store a short-lived token in your browser for that purpose. It is designed not to track individuals across sites and does not build an advertising profile.
- Resend delivers submitted enquiries to our mailbox. It processes the contents of your enquiry solely to transmit it, under a contract that restricts any other use.
- Google Maps shows the location of our office on the contact page. It loads only if you press "Show the map"; until you do, nothing on this site contacts Google Maps. If you would rather not, the address is written out in full beside it and the "Open in Google Maps instead" link leaves this site entirely.
Our web host keeps standard server logs, as described above. If we introduce analytics or any other cookie in future, we will ask for your consent first and update this policy.
10
Your rights
Under the Data Protection Act, 2019 you have the right to:
- Be informed of the use to which your personal data is put
- Access the personal data we hold about you
- Have inaccurate or misleading data corrected
- Have data deleted where we no longer have a lawful reason to hold it
- Object to processing, including processing for direct marketing
- Request that we restrict processing while a question about it is resolved
- Receive data you gave us in a portable form, where that right applies
To exercise a right, write to info@gatamalaw.com marked for the attention of the Managing Partner. We may ask you to verify your identity. We will respond within the period the Act allows.
Note These rights are not absolute. We may be unable to delete or restrict data we are required to keep, and legal professional privilege and our duty of confidentiality to a client may prevent us disclosing material to a third party who requests it, including a counterparty in a matter.
11
Complaints
If you are unhappy with how we have handled your personal data, raise it with us first at info@gatamalaw.com so that we can put it right.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, which supervises compliance with the Data Protection Act, 2019 in Kenya.
12
Changes to this policy
We review this policy periodically and update it when our practice or the law changes. The version published on this page is the version that applies, and it takes effect from the date it is posted.
