Privacy Policy

This policy explains how Isoe & Associates Advocates LLP ("we", "us") handles personal data collected through this website. We are bound by the Data Protection Act, 2019 of Kenya and its regulations, and we have written this in plain language so that you can see what happens to your information.

Who is responsible for your data

We are the data controller for the personal data described here.

This policy covers visitors to the website. It does not describe how we handle the files of clients we act for; that information is governed by our duty of confidentiality as advocates and by the terms of our engagement letters.

What we collect, and why

Contact form

When you send us a message we collect your name, email address, subject, the text of your message and, if you choose to give it, your telephone number. We also record the date and time you agreed to this policy, and a one-way, keyed hash of your IP address that we use to spot abuse. We cannot turn that hash back into your IP address.

We use this to read and answer your enquiry and to decide whether we are able to act for you. Our lawful basis is your consent, which you give by ticking the box on the form, and, once you have asked us a question, our legitimate interest in replying to it. You can withdraw consent at any time.

Newsletter

If you subscribe to our newsletter we collect your email address and, once you confirm your subscription through the link we email you, we send you occasional articles and firm news. Our lawful basis is your consent. Every email contains an unsubscribe link, and unsubscribing stops further emails straight away.

Cookies

We set only the cookies the site needs to function, plus one that remembers your cookie choice. We do not use analytics or advertising cookies. The Cookie Policy lists each one.

Server logs

Like most websites, our web server records technical details of each request: IP address, date and time, the page requested, and the browser and device type reported to us. We use these records to keep the site secure and working, and our lawful basis is our legitimate interest in doing so. Logs are kept for a short operational period and are not used to build profiles of visitors.

Who we share it with

We do not sell personal data and we do not use it for marketing other than the newsletter you opted in to. We use a small number of service providers who handle data on our behalf and only on our instructions: our web hosting provider, our email delivery provider, and Cloudflare, whose Turnstile service checks that a form is being submitted by a person and not a robot. When the Turnstile check runs, your browser connects to Cloudflare and Cloudflare receives your IP address and some browser details. We may also disclose information where the law requires it, for example to a court or a regulator.

Some of these providers may process data outside Kenya. Where they do, we rely on contractual safeguards and, where applicable, the conditions for cross-border transfers in the Data Protection Act.

How long we keep it

• Contact messages: 24 months from the date you sent them. If we go on to act for you, the correspondence becomes part of your client file and is kept in line with our professional record-keeping obligations.
• Newsletter subscriptions: until you unsubscribe. We then keep only the minimum needed to make sure we do not email you again.
• Server logs: a short operational period, normally no more than 90 days.
• Cookie choice: 180 days, then the banner asks again.

How we protect it

The site is served over an encrypted connection. Access to the administration area is restricted to authorised staff and protected by individual accounts and two-step verification. We keep only the data described above and limit who can read it. No online system is perfectly secure, so please do not send confidential documents through the contact form; wait until we have confirmed that we can act for you and told you how to send them safely.

Your rights

Under the Data Protection Act you have the right to:

• be told whether we hold personal data about you and to receive a copy of it;
• ask us to correct data that is wrong or out of date;
• ask us to delete data we no longer need or have no lawful basis to keep;
• object to us processing your data, including for direct marketing;
• withdraw consent at any time, without affecting what we did before you withdrew it; and
• ask for your data in a structured, commonly used format where that applies.

To use any of these rights, email info@isoeandassociates.co.ke or write to us at the address above, and say which right you want to use. We may need to confirm who you are first. We will respond within the time the Act allows, and we will tell you if we cannot do what you ask and why.

Complaints

We would like the chance to put things right, so please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya, which regulates data protection under the Act. Its current contact details are on its website, www.odpc.go.ke.

Children

This website is meant for adults. We do not knowingly collect personal data from anyone under 18 through it. If you believe a child has sent us their details, tell us and we will delete them.

Changes to this policy

We will update this page when what we do with data changes, and we will change the date below. If a change affects something you consented to, we will ask for your consent again.

Draft version of October 2026.