Version Date: September 27, 2026
Introduction
We at OK Law Advocates LLP (“OK Law”, “we”, “us” or “our”) respect your right to privacy.
Where we refer to “personal information”, it means “personal data” as defined in the Data Protection Act No. 24 of 2019 (“DPA”) and in the Data Protection (General) Regulations, 2021 (the “DPGR”), the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. Personal information includes any information about a person that can be used to identify a person directly or indirectly. It includes information like a name, an identification number, location information, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. The DPA protects the personal data of natural persons. Where our client is a company, firm or other organisation, we will protect the personal information of its directors, officers, employees and other representatives in the same manner as any other person’s personal information.
Where applicable, this privacy policy applies in addition to any other agreement that you enter into with us, including the letter of engagement that you agree to when you become our client.
For any comments or queries relating to this policy, please contact us at legal@oklawllp.com.
Who we are
OK Law Advocates LLP is a limited liability partnership of advocates practising in Kenya, with its offices at Golden Ivy Plaza, 2nd Floor, Karen Road, Nairobi. We are the data controller in respect of the personal information described in this policy. You may contact us about this policy, or about the personal information we hold about you, at legal@oklawllp.com or on +254 701 633 009.
The personal information we collect
The personal information we collect includes:
- Personal details, such as your name, email address or telephone number;
- Billing information, such as relevant payment information and VAT registration number; and
- Legally required information, which includes any additional information that the law requires from us to verify your identity. This may include a copy of your national identity card or passport, your KRA PIN certificate and information about the source of funds, which we are required to obtain before acting for you.
How we collect personal information
We collect personal information in the following ways:
- Directly from you when you use our website or any of our services or if we request it from you;
- In limited instances, we collect personal information from third parties. We will only collect personal information this way where such information is publicly available or where we have a lawful basis for collecting it; and
- Through the use of cookies, which will mainly be used to identify visitors that return to our website. You can prevent us from doing this through a setting on your browser. Cookies only store information from your browser and cannot access data on your computer. We will ask for your consent before placing any cookie that is not strictly necessary for the operation of our website.
Use of your personal information
We may use your personal information for any legitimate business purposes relating to our services and/or business activities. Some of the purposes for which we use your personal information include:
- Responding to your queries posted on our website or emailed to us;
- Onboarding you as a client and verifying your identity (as required by law);
- Providing you with our services;
- Referring you to other service providers with your consent;
- Improving our website and services by analysing certain information collected, including cookies and other related information;
- Sending you information (in the form of our newsletter) and inviting you to events; and/or
- Complying with our regulatory or other obligations.
Our lawful basis for processing
We process your personal information only where the law permits us to do so. Depending on the purpose, we rely on one or more of the grounds set out in section 30 of the DPA, namely: your consent; the performance of a contract to which you are a party, or steps taken at your request before entering into a contract; compliance with a legal obligation to which we are subject; the protection of your vital interests; the exercise, by any person, of a claim under the law; or the legitimate interests pursued by us or by a third party, where those interests are not overridden by your rights and freedoms.
Marketing
When you become a client, we will ask whether you would like to be added to our mailing list, and we will add you to it only with your express consent. We use this mailing list to send you important information about our business, the services we offer, legal developments, news and event invitations. You can also add yourself to our mailing list on our website.
You may unsubscribe from our mailing list at any time, after which we will stop sending you marketing communications. Every marketing communication we send contains an unsubscribe link, and you may also email us to ask us to remove you from the list.
If you unsubscribe from our mailing list, we may still contact you in other instances, such as in the course of providing you with services or to collect outstanding fees. In these instances, the relevant practitioner will contact you directly and not through the mailing list.
Sharing your personal information
We will only share your personal information for purposes of providing services to you or any other legitimate business purpose relating to our business activities, including, but not limited to, the protection of our rights or yours, complaints, marketing, or enforcing any agreement between us.
Where required for our business operations, we may share your personal information with our service providers. We only share information with service providers after we enter into an agreement with the service provider to regulate the way in which the personal information will be secured.
Where the law requires us to do so, we may also share your personal information with third-party service providers, agents, contractors, law enforcement agencies or business affiliates. We will only share your personal information in these instances where it is necessary for us to do so and only to the extent that your personal information is needed for such third parties to perform their services or obligations.
Transfer of your personal information outside Kenya
We may transfer your information cross-border for our legitimate business purposes, such as for cloud storage and for our billing practices. All information transfers will comply with the applicable laws. Where we transfer personal information outside Kenya, we will do so only on one of the grounds permitted by Part VI of the DPA, and only where we are satisfied that appropriate safeguards are in place for its security and protection.
Security
We will take all reasonable steps to ensure that your personal information is protected. We protect and manage personal information that we hold about you by using electronic and computer safeguards like firewalls, data encryption, and physical and electronic access control to our buildings. We only authorise access to personal information to those employees who require it to fulfil their designated responsibilities.
Links on our website
We may include links to other third-party websites which do not fall under our supervision. We cannot accept any responsibility for your privacy or the content of these websites, but we display these links to make it easier for you to find information about specific subjects.
Your rights
Under the DPA, you have the right to be informed of the use to which your personal information is put; to access the personal information we hold about you; to object to its processing; to have false or misleading information about you corrected or deleted; and, under section 38 of the DPA, to receive the personal information you have given us in a structured, commonly used and machine-readable format and to have it transmitted to another data controller. Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of anything we did before you withdrew it. The sections below explain how to exercise these rights.
Right to object
You may, on reasonable grounds, object to us using your personal information. If you object, we will stop using your personal information, except where the law permits or requires us to continue using it.
Lodging a complaint
If you believe we are using your personal information unlawfully, please let us know first (on legal@oklawllp.com or +254 701 633 009). If you are not satisfied with our response, you have the right to lodge a complaint with the Data Commissioner under section 56 of the DPA.
Children’s personal information and sensitive personal data
We do not intentionally collect or use personal information of children (persons under the age of 18 years), unless the consent of a parent or guardian has been given and the processing is carried out in a manner that protects and advances the rights and best interests of the child, as required by section 33 of the DPA, or the law otherwise allows or requires us to process such personal information. We do not ordinarily collect sensitive personal data as defined in the DPA unless it is necessary for the legal services we are instructed to provide, in which case we process it only on the grounds permitted by the DPA.
Quality and access to your personal information
We want to ensure that your personal information is accurate and up to date. You may ask us to correct any personal information that you think is inaccurate or request us to remove your information by sending an email to legal@oklawllp.com. We may be unable to delete personal information that we are required by law, or by the rules governing our profession, to retain; where that is the case we will tell you.
You have the right to request us to provide you with personal information that we hold about you. You must contact us directly to do so or send an email to legal@oklawllp.com.
Retention of information
We retain personal information in accordance with the required retention periods in law or for legitimate business purposes. We may keep personal information indefinitely in a de-identified format for statistical purposes. This privacy policy also applies when we retain your personal information.
Security breach
We will report any security breach to the Data Commissioner within seventy-two hours of becoming aware of it, and communicate it to the affected data subjects within a reasonably practicable period, in accordance with section 43 of the DPA. If you want to report any concerns about our privacy practices or if you suspect any breach regarding your personal information, kindly notify us by sending an email to legal@oklawllp.com.
Changes to this policy
We may update this privacy policy from time to time. The version published on our website is the current version, and the date on which it was last updated appears at the top of this policy.
Disclaimer
The information displayed on our website is provided for general information purposes only and should not be construed as legal advice from any lawyer or representative of our firm.
Professional advice should therefore be sought before any action is taken based on the information displayed on this website.
OK Law Advocates LLP disclaims any responsibility for positions taken without due consultation and no person shall have any claim of any nature whatsoever arising out of, or in connection with, the contents of this website against OK Law Advocates LLP and/or any of its partners, employees and/or agents.