Privacy Policy

Mwengi Mutuse & Company Advocates ("the Firm", "we", "us") is a law firm registered in Kenya, with offices at Applewood Building, 10th Floor, Office No. 1005, Ngong Road, Nairobi, Kenya. We are a data controller under Kenya's Data Protection Act 2019 ("DPA") and, where applicable, under the EU General Data Protection Regulation ("GDPR") for data subjects in the European Economic Area.

Our designated Data Protection Officer can be reached at: dpo@mwengimutuse.co.ke

When you use the contact form on our website, we collect the following categories of personal data:

• Full name
• Email address
• Phone number (if provided)
• Company or organisation name (if provided)
• The content of your enquiry message
• Technical data: IP address, browser type, device type, pages visited (via analytics cookies, if consented)

We do not collect sensitive personal data (as defined in Section 2 of the DPA) through our website contact form. If your legal matter requires disclosure of sensitive data, that will be handled under a separate engagement agreement with appropriate safeguards.

We collect personal data through:

• The website contact/enquiry form
• Direct email or telephone communications
• Business cards or in-person introductions at events
• Third-party referrals (e.g. from existing clients or partner firms)

We process your personal data for the following purposes, each supported by a lawful basis under Section 30 of the DPA and Article 6 of the GDPR:

Enquiries submitted through our contact form are transmitted via EmailJS (EmailJS Ltd), a third-party email delivery service. EmailJS processes the message content and the sender's contact details solely for the purpose of delivering the message to our inbox. We have a data processing agreement in place with EmailJS in accordance with GDPR Article 28.

We may share your personal data with:

• EmailJS — for contact form message delivery
• Our internal legal team — for handling your enquiry
• Regulatory bodies — where required by law (e.g. the Law Society of Kenya, courts)
• Counsel or correspondents — where engaged on your matter with your knowledge

We do not sell your personal data to third parties. We do not transfer your data outside Kenya or the EEA except as described above, and only with appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

We retain your personal data for the following periods:

• Enquiries that do not result in a retainer: deleted or anonymised within 12 months
• Active client files: retained for the duration of the engagement plus 7 years (in accordance with the Limitation of Actions Act, Cap. 22)
• Anti-Money Laundering records: minimum 5 years from end of business relationship (Proceeds of Crime and Anti-Money Laundering Act)
• Marketing consent records: until consent is withdrawn, plus 3 years

Under the DPA 2019 and, where applicable, the GDPR, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of your personal data we hold
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to have your data deleted in certain circumstances
• Right to object — to processing based on legitimate interests
• Right to restrict processing — in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, email us at privacy@mwengimutuse.co.ke. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or with your local data protection authority if you are located in the EEA.

Our website uses essential cookies required for basic site functionality. Where we use analytics cookies, we will request your consent before setting them. You may withdraw cookie consent at any time by clearing your browser cookies or using the consent management tool on our site.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include TLS encryption in transit, access controls, and regular security reviews. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ODPC within 72 hours and affected individuals without undue delay.

We may update this Privacy Policy from time to time. Material changes will be notified via a notice on our website and, where appropriate, by direct communication. The date at the top of this page reflects the most recent revision.

For any questions about this Privacy Policy or our data practices, contact us at: