Last Updated: February 13, 2025

Registered Address:

Applewood Adams, 2nd Floor,

Suite 205, Ngong Road,
P.O. Box 14155-00400,
Nairobi, Kenya
Email: mail@ooc-advocates.co.ke

Who We Are

Okara & Onuko Company Advocates is a law firm registered and practising in Kenya under the Laws of Kenya and registered by the Law Society of Kenya. In this privacy policy, references to “OOC Advocates” or "the firm" mean Okara & Onuko Company Advocates and its affiliated entities.

Data Collection and Usage

We collect personal data necessary for our legal practice and business operations. This includes your contact information, business details, and information obtained from public sources. When you interact with our services, we gather technical data such as IP addresses and browser information. We maintain attendance records for security purposes and collect supplier information for business operations.

Your Communications With Us

Your communications with us are handled with utmost confidentiality. Please note that unsolicited emails from non-clients do not establish an attorney-client relationship and may not be privileged. We use your communications to provide legal services, manage our relationship, and ensure effective service delivery.

Legal Bases for Processing

We process your personal data under the following legal grounds:

Your explicit consent
Compliance with legal obligations under Kenyan law
Legitimate business interests
Necessity for contract performance

Legitimate Interests

Our legitimate interests include providing legal services, managing client relationships, ensuring security, and developing our practice. We carefully balance these interests against your privacy rights in accordance with the Data Protection Act.

Processing of Sensitive Data

We handle sensitive personal data with additional care and only process it when:

You provide explicit consent
It’s necessary for legal claims
It’s required by law
It’s vital to protect your interests

Data Sharing

We share your information with other members within OOC Advocates for internal administrative operations, client relationship management, and service delivery. When sharing your personal data with third parties, we may disclose information to:

Partner law firms for collaborative cases
Regulatory bodies and law enforcement, when legally required
Service providers who support our operations
Emergency services when necessary

We prioritise the security and confidentiality of your information when sharing it with third parties. We implement stringent measures to ensure these parties comply with strict data protection standards and handle your data according to our instructions.

Our third-party selection process involves careful evaluation of service providers, business partners, and other recipients of your personal data. We establish contractual agreements that impose specific obligations for data protection and restrict information use to specified purposes. These agreements require the implementation of appropriate technical and organisational measures to prevent unauthorised access, disclosure, alteration, or destruction of your personal data.

Third-Party Data

When you provide us with personal data about others, you must ensure you have their consent and have informed them about this policy. We treat such information with the same level of care as all personal data we handle.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

Providing legal services
Complying with legal and regulatory obligations
Handling potential disputes or claims
Meeting business operational requirements

Retention periods vary depending on the type of data and applicable legal requirements. We regularly review our retention periods and securely delete or anonymise personal data that is no longer needed.

Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including encryption, access controls, and regular security audits in compliance with the Data Protection Act.

International Data Transfers

As a Kenyan law firm, we primarily process and store your personal data within Kenya. However, in some cases, we may need to transfer your data internationally for specific purposes, including storage on cloud services provided by third parties. When we do so, we ensure:

Transfers comply with Kenya’s Data Protection Act
Appropriate safeguards are in place through contractual arrangements
Data protection standards are maintained
Necessary approvals from the Office of the Data Commissioner are obtained
Your rights and interests are protected
Cloud service providers meet required security standards

We implement additional security measures for international transfers, including data transfer agreements and encryption protocols to maintain data security during transmission and storage.

Your Rights

Under Kenya's Data Protection Act, you have several important rights regarding your personal data. These rights will only apply in certain circumstances, and their applicability may depend on our legal basis for processing your data. Your rights include:

Right to Access: You can request confirmation if we are processing your data and obtain a copy of your personal data in our possession. You may also request information about how we use your data and who we share it with.

Right to Correction: You have the right to request correction of any incomplete or inaccurate personal data we hold about you. We encourage you to help us maintain accurate records.

Right to Erasure: In certain circumstances, you can request the deletion of your personal data. However, this right may be limited where data retention is necessary for legal compliance or in connection with legal claims.

Right to Restrict Processing: You may request that we suspend processing of specific aspects of your personal data, particularly if you contest its accuracy or object to its processing.

Right to Data Portability: Where technically feasible, you can request the transfer of your personal data to another service provider in a structured, commonly used format.

Right to Object: You can object to the processing of your personal data based on legitimate interests, particularly for direct marketing purposes. We will honour such requests unless we have compelling, legitimate grounds to continue processing.

Right to Withdraw Consent: Where we process data based on consent, you have the right to withdraw that consent at any time. This won't affect the lawfulness of processing before consent withdrawal.

Right to Complain: You can lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer using the details provided at the top of this notice. We will respond to your request within the timeframe prescribed by law. Please note that we may need to verify your identity before processing certain requests.

Direct Marketing

We respect your marketing preferences. You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly.

Cookie Policy

Our website uses cookies to enhance your browsing experience. For detailed information about the cookies we use, please refer to our Cookie Policy on our website.

Links to Third-Party Websites

Our website may contain links to third-party websites. The personal data you provide through these external websites is not subject to this privacy notice, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of these third-party websites before providing any personal information to them.

Children

We do not knowingly collect data from children under 18 years, in accordance with Kenyan law. If we discover we have collected such data, we will delete it promptly.

Policy Updates

We may update this policy periodically. Significant changes will be highlighted at the top of this notice with the revision date.

Contact Us

For privacy-related inquiries, please contact our Data Protection Officer using the details provided at the top of this notice.

Last Updated: February 13, 2025

Privacy Policy