Last Updated: February 20, 2026

1. Introduction and Institutional Identity

Okara & Onuko Company Advocates (hereinafter referred to as "OOC Advocates" or "The Firm") is a boutique legal practice registered and practising under the Laws of the Republic of Kenya and regulated by the Law Society of Kenya (LSK). This Privacy Policy establishes the legal framework under which The Firm collects, processes, retains, and discloses personal data in connection with this website and the Firm's digital communications channels. It is designed to ensure full transparency and strict respect for the privacy rights of all individuals who interact with The Firm's online presence.

2. Scope of this Policy and Relationship to the Firm's Data Protection Policy

This Privacy Policy applies exclusively to personal data collected through The Firm's website and digital communications channels, including the website's integrated contact and enquiry forms. It governs what data is collected from individuals who visit or interact with this website, why it is collected, how it is handled, and what rights those individuals hold in respect of it.

This Policy does not govern the comprehensive processing of personal data undertaken in the course of legal representation, client onboarding, KYC, and AML/CFT compliance, financial record-keeping, or any other activity arising from a formal retainer agreement. Those matters are governed exclusively by the Firm's internal Data Protection Policy and the Privacy Notice issued to Instructing Clients at that point of engagement. Any queries in respect of client data should be directed to the Data Protection Officer at dpo@ooc-advocates.com.

3. Who This Policy Applies To

This Policy applies to the following categories of data subjects:

Website Visitor(s): Individuals who navigate, browse, or interact with the Firm's digital interface without executing a formal legal retainer. Data collected from Website Visitors is primarily technical and navigational in natureand is substantially governed by the third-party hosting mechanism described in Section 5 below.

Instructing Clients - individuals, corporate entities, or organisations that have formally engaged The Firm under a signed retainer agreement - are not covered by this Policy. Their data is processed under separate instruments issued at the point of engagement. The existence of this website and the submission of an enquiry form do not constitute the commencement of a retaineror the creation of any advocate-client relationship.

4. No Advocate-Client Relationship via This Website

IMPORTANT NOTICE: The operation and maintenance of this website does not constitute an offer to represent any individual or entity. The transmission of information to the Firm via unsolicited emails, digital contact forms, or any third-party web interface does not constitute legal advice. Website Visitors are explicitly cautioned against submitting highly confidential, sensitive, or privileged information through the website. A formal advocate-client relationship is established only upon the explicit execution of a written retainer agreement signed by an authorised partner of OOC Advocates.

5. Website Infrastructure

The OOC Advocates website is exclusively built, hosted, and maintained by a third-party platform, WebWave, operated by WebWave Sp. z o.o., headquartered at Postepu 14A, 02-676 Warsaw, Poland. Website Visitors must be aware of the following material technical and legal realities:

Independent Processing Operations: WebWave acts as a Data Processor in respect of the website's technical infrastructure and, in certain specific contexts, as an independent Data Controller. WebWave independently collects technical navigational data, sets foundational cookies, and monitors baseline website activity to ensure platform security, prevent attacks, and optimise content delivery.
Absence of Backend Administrative Control: OOC Advocates operates as a tenant on the WebWave platform and does not have direct backend technical control over WebWave's server data storage methodologies, baseline analytic script injections, or infrastructure cookie deployments.
Third-Party Privacy Framework: Digital footprints, IP addresses, and device telemetry left by Website Visitors on this domain are subject to WebWave's own data processing agreements and privacy frameworks. Website Visitors are strongly encouraged to review the WebWave Privacy Policy at https://webwave.me/privacy-policy for comprehensive details on platform-level data handling.

6. Personal Data Collected Through This Website

The Firm processes only the following categories of personal data in connection with this website, in strict alignment with the principle of data minimisation:

Technical and Navigational Data: When a Website Visitor accesses this domain, technical data, including Internet Protocol (IP) addresses, browser types, time zone settings, operating systems, and device identifiers, is automatically collected. This data is collected, processed, and stored by WebWave as part of the underlying website infrastructure. The Firm does not directly control this collection.
Digital Communication Data: Information voluntarily submitted through the website's integrated enquiry forms, including names, email addresses, telephone numbers, and the preliminary contents of the enquiry. This data transits through WebWave servers before being delivered to the Firm. Website Visitors are reminded that submitting an enquiry form does not create an advocate-client relationship or confer legal privilege on the communication.

8. Lawful Bases for Processing Website Data

In respect of personal data collected through this website, The Firm relies upon the following lawful bases:

Legitimate Interests: The Firm has a legitimate interest in operating a secure and functional website, protecting its digital infrastructure against unauthorised access, and receiving and responding to professional enquiries submitted through the website's contact forms. This basis is applied only where it does not override the Website Visitor's fundamental privacy rights.
Explicit Consent: Where optional, non-essential tracking technologies or cookies are deployed through the WebWave platform, the lawful basis is the Website Visitor's consent. Website Visitors retain the right to withdraw consent at any time, as further described in this Policy's Cookie Policy annex. Withdrawal of consent does not affect the lawfulness of any processing that occurred before withdrawal.

9. Third-Party Disclosures

OOC Advocates does not share, sell, or commercialise personal data collected through its website for marketing or analytical purposes. The sole third-party disclosure relevant to this website is the following:

WebWave Sp. z o.o. (Hosting Infrastructure Processor): As the website's hosting provider, WebWave processes technical and navigational data from the Website Visitors as described in Section 5. This processing occurs under a formal Data Processing Agreement between The Firm and WebWave, which legally binds WebWave to applicable data protection standards. WebWave is headquartered in Warsaw, Poland, within the European Union.

9. International Data Transfers

Personal data collected through this website is transferred to and stored on servers located within the European Union, specifically at data centres maintained by WebWave Sp. z o.o. in Warsaw, Poland. The European Union operates under the General Data Protection Regulation (GDPR), a framework recognised as providing a robust and adequate level of data protection. The transfer of website data to WebWave's Polish servers therefore meets the adequacy requirements and cross-border data flow standards applicable under Kenyan data protection law, as maintained by the Office of the Data Protection Commissioner (ODPC) of Kenya.

10. Data Retention

The Firm retains personal data collected through this website only for the period strictly necessary to fulfil the purpose for which it was collected:

Website Navigational and Technical Data: Collected and retained transiently by WebWavein accordance with their own infrastructural retention schedules and applicable European data protection requirements. The Firm does not store this data independently.
Digital Communication Data (Enquiry Form Submissions): Retained by The Firm only for as long as is necessary to respond to the enquiry and determine whether a formal retainer relationship will be established. Where no retainer is executed, this data will be securely deleted within a reasonable period following the conclusion of the enquiry process.

11. Your Rights

In respect of personal data collected through this website, you have the following legally enforceable rights. The Firm will respond to valid requests within the timeframes prescribed by law:

Right of Access: The right to request confirmation of whether The Firm holds personal data about you collected through this website, and to receive a copy of that data. The Firm aims to fulfil access requests within seven (7) days where practicable.
Right to Rectification: The right to request the correction of any inaccurate or incomplete personal data held by The Firm in connection with your website interaction.
Right of Erasure: The right to request the deletion of personal data collected through this website. The Firm endeavours to process valid erasure requests within fourteen (14) days. This right may be subject to limited exceptions where retention is required by law.
Right to Restrict Processing: The right to request a temporary suspension of processing where you contest the accuracy of the data or the lawfulness of the processing.
Right to Object: The right to object to the processing of your personal data where that processing is based on legitimate interests.
Right to Data Portability: The right to receive personal data you have provided through this website in a structured, commonly used, and machine-readable format, where technically feasible.
Right to Withdraw Consent: Where processing is based on your consent, in particular, consent to cookies or tracking technologies, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights in respect of your website data, please contact the Data Protection Officer at dpo@ooc-advoactes.com. The Firm may need to verify your identity before processing certain requests.

13. Minors

This website and The Firm's legal services are not directed toward, nor intended for, individuals under the age of eighteen (18) years. The Firm does not intentionally collect personal data from minors through this website. Given the technical architecture of the WebWave hosting platform, The Firm does not possess the means to independently verify the age of Website Visitors. Any personal data inadvertently collected from a minor via this website will be deleted promptly upon notification and verification.

14. Data Protection Officer and Complaints

OOC Advocates has designated a formal point of contact for all data protection matters arising in connection with this website:

Designated Authority: Data Protection Officer (DPO), OOC Advocates
Email: dpo@ooc-advocates.com

If you believe The Firm has failed to handle your personal data in accordance with its legal obligations under this Policy, you have the right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC) of Kenya.

15. Cookies

This website uses cookies and similar technologies deployed through the WebWave hosting platform. Due to the third-party infrastructure arrangement specified in Section 5, the Firm does not have direct backend control over all cookies set on this domain. Full details of the cookies deployed, their categories, their provenance, and how Website Visitors can manage them at the browser level are set out in The Firm's Cookie Policy, which forms a technical annex to this Privacy Policy and is available on this website.

16. Updates to This Policy

OOC Advocates reserves the right to amend this Privacy Policy at any time to reflect changes in WebWave's infrastructure, new guidance from the ODPC, or developments in Kenyan data protection law. All updates take effect upon publication to this domain. The 'Last Updated' date at the top of this document will be revised to reflect any changes. Website Visitors are encouraged to review this Policy periodically.