Privacy Policy

1. Introduction

MJM Advocates (Mwaura J.M. Advocates) ("MJM Advocates", "the Firm", "we", "us" or "our") is committed to protecting the privacy and security of personal data belonging to visitors to our website (mjmadvocates.com), our clients, prospective clients, and other individuals who interact with us.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, store, share and protect it, and the rights available to you under the Data Protection Act, No. 24 of 2019 (the "Data Protection Act" or "the Act") and its subsidiary regulations, as enforced by the Office of the Data Protection Commissioner ("ODPC").

By accessing or using our website, or by engaging MJM Advocates for legal services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, please do not use our website or provide us with your personal data.

This Policy applies to personal data processed by MJM Advocates in its capacity as a data controller, and, where applicable, as a data processor acting on the instructions of a client.

2. Data We Collect

We may collect and process the following categories of personal data, depending on the nature of your interaction with us:

• Identification and contact data — such as your full name, national ID or passport number, KRA PIN, postal and physical address, email address and telephone number;
• Engagement and instruction data — information you provide when you instruct us or make an enquiry, including the nature of your legal matter, related correspondence, and documents you share with us;
• Client due diligence data — information collected to comply with our obligations under the Proceeds of Crime and Anti-Money Laundering Act, the Law Society of Kenya’s practice rules, and related "Know Your Client" requirements, including verification of identity and source of funds;
• Website and technical data — IP address, browser type, device information, pages visited, and other data collected automatically through cookies and similar technologies (see Section 8 below);
• Communications data — records of correspondence, calls, meeting notes and enquiries made through our website contact form, email or WhatsApp Business messaging;
• Recruitment data — where you apply for a position with the Firm, your CV, cover letter, references and related application materials; and
• Special categories of data — in limited circumstances relevant to a specific instruction, we may process sensitive personal data (for example, health information in a personal injury or employment matter) strictly to the extent necessary to provide legal services and in accordance with the Act.

We collect personal data directly from you, from publicly available sources, from third parties acting on your behalf (such as agents or co-counsel), and automatically through your use of our website.

3. How We Use Your Data

We process personal data only where we have a lawful basis to do so under Section 30 of the Data Protection Act, including where processing is necessary to:

• provide legal advice and representation and otherwise perform our contract with you as a client;
• respond to enquiries submitted through our website or by telephone, email or WhatsApp;
• comply with our legal and regulatory obligations, including client due diligence, conflict checks, anti-money laundering checks and record-keeping requirements imposed by the Law Society of Kenya and other regulators;
• protect the legitimate interests of the Firm, our clients and third parties, including the administration and management of our practice, billing, and the defence of legal claims;
• send marketing communications, legal updates and event invitations, where you have consented to receive these or where permitted by law, and always with an option to opt out at any time;
• manage recruitment and employment applications; and
• improve and maintain the functionality, security and performance of our website.

We do not use your personal data for any purpose incompatible with the purposes above without notifying you and, where required, obtaining your consent.

4. Data Protection Officer Contact

In accordance with Section 24 of the Data Protection Act, MJM Advocates has designated a Data Protection Officer ("DPO") responsible for overseeing our compliance with this Policy and the Act.

Data Protection Officer: MJM Advocates Data Protection Office
Email: info@mjmadvocates.com
Postal address: 6th Floor, Rainbow Tower, Muthithi Road, Westlands, P.O. Box 28749-00100, Nairobi, Kenya

You may contact our DPO with any question, concern or request relating to the processing of your personal data, including to exercise any of the rights described in Section 7 below.

5. Data Sharing & Third Parties

We treat client and personal data as confidential and do not sell personal data. We may, however, share personal data with:

• co-counsel, correspondent firms, and other advocates instructed jointly with us or on your behalf in relation to a specific matter;
• courts, tribunals, regulators, arbitral institutions and government agencies, where necessary to progress a matter or comply with a legal obligation;
• service providers who support our practice, such as IT and cloud storage providers, professional indemnity insurers, accountants, translators, and process servers, under appropriate confidentiality and data processing arrangements;
• our professional advisers, including auditors and external counsel, where necessary;
• any party to a transaction where disclosure is required to complete that transaction, such as opposing counsel or a counterparty’s advocates, strictly to the extent necessary; and
• any person to whom we are required to disclose data by law, court order or a competent regulatory authority, including the ODPC.

Where personal data is transferred outside Kenya (for example, to a cloud service provider with servers located abroad, or to correspondent counsel in another jurisdiction), we will only do so in compliance with Section 48 of the Data Protection Act — that is, where the recipient jurisdiction has adequate data protection safeguards, where appropriate contractual safeguards are in place, or where you have given your consent to the transfer.

6. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory or professional conduct requirements. As a general guide:

• client file data is retained for a minimum of seven (7) years following the conclusion of a matter, in line with standard Kenyan legal practice and applicable limitation periods, save where a longer period is required (for example, for matters involving minors, trusts, or ongoing obligations);
• website enquiry and marketing data is retained for as long as you remain subscribed or engaged with the Firm, and is deleted or anonymised within a reasonable period after you unsubscribe or after a period of inactivity; and
• recruitment data is retained for twelve (12) months after the conclusion of a recruitment process, unless you consent to your data being retained for future opportunities.

At the end of the applicable retention period, we securely delete or anonymise personal data, unless we are required to retain it for longer by law.

7. Your Rights Under the Data Protection Act, 2019

As a data subject, you have the following rights under the Data Protection Act:

• the right to be informed of the use to which your personal data is to be put;
• the right to access your personal data held by us;
• the right to request correction or rectification of inaccurate or misleading data;
• the right to object to, or restrict, the processing of your personal data;
• the right to request deletion of false or misleading data about you;
• the right to data portability, where technically feasible;
• the right not to be subject to a decision based solely on automated processing that significantly affects you; and
• the right to lodge a complaint with the Office of the Data Protection Commissioner if you believe your rights have been infringed.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 4. We will respond to verified requests within the timeframes prescribed by the Act (generally within seven (7) days for access requests, and within fourteen (14) days for rectification requests), save where an extension is permitted by law.

The Office of the Data Protection Commissioner can be contacted at:

Website: www.odpc.go.ke
Email: info@odpc.go.ke
Address: Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi, Kenya (P.O. Box 30920-00100 GPO, Nairobi)

8. Cookies

Our website uses cookies and similar tracking technologies to improve functionality, analyse site usage, and enhance your browsing experience. Cookies are small text files stored on your device. We use the following categories of cookies:

• strictly necessary cookies — required for the website to function and cannot be switched off;
• performance and analytics cookies — help us understand how visitors use our website (for example, via Google Analytics or a similar tool), so that we can improve its content and performance; and
• functionality cookies — remember your preferences to provide a more personalised experience.

You can control or delete cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. We do not use cookies to collect sensitive personal data or for third-party advertising purposes.

9. Contact for Privacy Queries

If you have any questions, concerns or complaints about this Privacy Policy or how we handle your personal data, please contact us:

MJM Advocates (Mwaura J.M. Advocates)
6th Floor, Rainbow Tower, Muthithi Road, Westlands, Nairobi, Kenya
Telephone: +254 712 122 528
Email: info@mjmadvocates.com

We will endeavour to resolve any concerns promptly. You also retain the right to lodge a complaint directly with the Office of the Data Protection Commissioner at any time.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. Any changes will be posted on this page with a revised "Last Updated" date. We encourage you to review this Policy periodically. Where changes are material, we will take reasonable steps to notify you, such as by way of a notice on our website.

Last updated: 14 August 2026