This privacy policy aims to give you information on how we collect and process your personal data.

This privacy policy will apply when:

• you retain us to provide you with legal services.
• you request information from us or provide information to us.
• you visit our website.
• you join our mailing list to receive our publications and other communication via email.
• you give us feedback by filling any forms available on our website or contact us via email or phone.
• you request information from us or provide information to us in relation to a job opening or other opportunity with us.
• you attend any events hosted by us.
• we collect personal data from publicly available sources, that is, personal data deliberately made public by you or is data that is contained in a public record.

We do not knowingly collect data from anyone under the age of eighteen (18), unless we receive consent from the child’s parent or guardian. If you are under the age of eighteen (18) years, you may not submit any personal data to us.

It is important that you read this privacy policy together with any other privacy notices or statements we may provide on specific occasions when we are collecting or processing personal data about you, so that you are thoroughly informed of our use of your data. This privacy policy supplements other privacy notices and statements and is not intended to override them.

If you have any questions about this privacy policy or our privacy practices, please contact us using any of the following ways:

T: +254 20 444 0891/2

E: info@cfllegal.com

8th Floor

Sifa Towers

Lenana Road

Kilimani 

Nairobi

P.O Box 23555-00100

We keep our privacy policy under regular review and may from time to time update this privacy policy by posting an updated version of the privacy policy on our website. It is important that the personal data we hold about you is accurate and up to date. Please keep us informed of any changes to your personal data in the course of your relationship with us.

Our website may contain links to external websites that are not operated by us. Clicking or enabling those links and connections may allow third parties to collect or share your personal data. Please note that we have no control over the content and privacy practices of such websites and can therefore not accept responsibility or liability for their respective privacy policies and practices. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Personal data means any information relating to an identified or identifiable natural person. It does not include anonymous data, that is, where a person’s identity has been removed such that the data can no longer identify the person.

We may collect, use, and store different kinds of personal data about you with your knowledge and consent, which we have grouped together as follows:

• identity data including your name, preferred title, gender and date of birth.
• contact data including your billing address, personal or office address, email address and telephone numbers.
• business data including information about you and your business that is provided to us when you engage our legal services. this information may personally identify you.
• financial data including bank account and payment card details.
• transaction data including details about payments to and from you and other details of services we have agreed to provide.
• technical data including your internet protocol (aka IP) address, browser type and version, location and time zone settings, and other technology on the devices you use to access our website.
• profile data including legal services requested by you, your interests, preferences, feedback and survey response.
• website activity data including information about which website feature you frequently use when you visit our website.
• marketing and communications data including your preferences in receiving information from us and your communication preferences.

We also collect, use and share analytical data such as statistical data for various purposes such as compiling reports on website activity. Such data may be derived from your personal data but is not considered personal data as the data does not identity you either directly or indirectly (anonymous data). For example, we may collect website activity data to calculate the percentage of people accessing a particular website feature. However, if we associate analytical Data with your personal data so that it can directly or indirectly identify you, we treat such data as personal data which will be subject to this privacy policy and applicable law.

We do not process any sensitive personal data or special category data relating to you (including details revealing your race or ethnic social origin, conscience, belief, sexual orientation, political opinions, health data, genetic data, and biometric data) unless such processing is permitted under applicable law. We may only collect information about your criminal convictions and offences in certain circumstances including when you apply for an employment position in our firm.

Where the law requires us to collect your personal data, or we require such data for the performance of a contract between us and you fail or refuse to provide that data as requested, we may be unable to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a requested service but we will notify you if this is the case at the time.

We use different ways to collect necessary data about you including through:

• direct interactions. You may provide us with your name or other identifier, contact and financial Data by filling in forms provided by us or by contacting us via post, telephone, email or otherwise. This includes personal data you provide when you:
• retain our legal services.
• request information from us or provide information to us.
• join our mailing list.
• apply for a job on our website or request for information about employment positions through our website.
• give us feedback or contact us.
• automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your devices’ technologies such as your browser type and version, your preferences and your usage of our website. We may collect such data through the cookies, and other similar technology. Please see the section on Cookies below for further details on how we use cookies to improve your experience on our website.
• third parties or publicly available sources. We may receive personal data about you where such data is contained in a public record, deliberately made public by you, or where you consent to the collection of such data from another source.
• technical data from analytics providers and search information providers such as Bing, Google and Squarespace.
• contact, financial and transaction data from providers of technical, payment and delivery services such as banks and mobile money service providers.

We will only use your personal data in accordance with this privacy policy, supplementary policy statements and notices issued to you by us, as well as applicable law. Generally, we will use your personal data to:

• perform the contract we have with you or are about to enter into with you.
• protect our legitimate interests or those of a third party where necessary, and your fundamental rights or interests do not override those legitimate interests. For example, in defending a legal claim instituted by you against us. Legitimate Interest means our firm’s interest in carrying out our business to enable us give you the best and most secure service and experience. We consider and assess any potential positive or negative impact on you and your rights prior to using your personal data for our legitimate interests. We do not use your personal data where your interests override our interests, unless permitted or required under applicable law or where we have obtained your consent. You can contact us for more information on how we evaluate our legitimate interests against yours under special circumstances.
• comply with a legal obligation.

Note that we may process your personal data for more than one of the lawful grounds as provided for under applicable law. This will depend on the specific purpose for which we are processing your data. We will get your consent before sending any communications (including our publications) to you via email. You may contact us at any time to withdraw your consent to such communications.

We will only use your personal data for the purposes for which we collect it including, but not limited to:

• registering you as a new client.
• processing and delivering legal services.
• observing our Know Your Client obligations under any laws that require us to verify your identity.
• managing your relationship with us.
• improving your customer experience, our website as well as the services we offer to you.
• sending you our publications, event invitations and any legal updates.
• recommending services which may be of interest to you.
• processing any inquiries or complaints received by you.
• recruitment, where you express interest in working with us.

You may ask us to stop sending you any information at any time by contacting us at any time. Where you opt out of receiving such information, this will not apply to personal data provided to us as a result of a service request or other transactions between us. We may be unable to provide some services to you where you withdraw your consent. We will inform you of this position at the time you withdraw your consent.

Cookies are small data files downloaded onto your device when you visit various websites. Cookies store some information about you and enable our website to remember your preferences when you subsequently visit our website.

Additionally, we may use Google Analytics to provide us with information about how you use our website. We may use this information to compile statistical data and to help us improve your experience with us. Google LLC uses cookies as part of this process to collect anonymous information, such as the number of visitors to our website, the location from which you access our website from, the website features you frequently use as well as the length of time you spend on our website.

You can set your browser to refuse cookies, or to alert you when a website sets or accesses cookies. If you disable or refuse cookies, please note that you may be unable to access some parts of our website.

By using our website, you consent to the processing of your data by use of cookies as set out above.

We will only use your personal data for purposes which are lawful, specific and explicitly defined. We may also use your personal data for reasons that do not conflict with the original purpose for which we collected such data for. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where it is required or permitted under applicable law.

We do not share any of your personal data publicly or with third parties, except when required to by law, on a business need to know basis with employees, agents, contractors and other third parties, in relation to the provision of our services or when you request or consent to us sharing such data.

We require all employees, agents, contractors and other third parties to respect the security of your personal data and to treat it in accordance with the law. We only allow such third-parties to process your personal data for lawful and specified purposes and in accordance with applicable law and this policy.

We will only transfer your personal data outside our jurisdiction where the transfer is necessary:

• to implement pre-contractual measures taken at your request or for the performance of a contract between us.
• for the conclusion of a contract between us and a third party which is beneficial to you.
• for any matter of public interest.
• for the institution or defence of a legal claim.
• in order to protect your vital interests or of those of third parties, in case you are physically or legally incapable of providing your consent.
• for the purpose of compelling legitimate interests pursued by us which are not overridden by your interests, rights and freedoms.

We may only transfer your sensitive personal data out of our jurisdiction upon obtaining your consent and in accordance with applicable law, and our data security measures and safeguards.

In the event that we transfer your personal data out of our jurisdiction (except at your request) we will ensure that adequate protection is afforded to such data by ensuring at least one of the following safeguards is implemented:

• we will only transfer your personal data to countries with commensurate data protection laws.
• where we use certain service providers, we will use specific contracts which give your personal data the same protection it has in our jurisdiction.

Please contact us for further information on the specific mechanisms we use when transferring your personal data out of our local jurisdiction.

We have adopted several appropriate security measures and safeguards to prevent your personal data from being revealed, accidentally lost, used or accessed in an unauthorised manner, or altered. In addition, we limit access to your personal data to employees, agents, contractors and other third parties on a business need to know basis. They are subject to a duty of confidentiality and will only process your personal data as per applicable law and our instructions.

We have also adopted measures to deal with any suspected personal data breach and will notify you of a breach where we are legally required to do so.

We will only retain your personal data for as long as it is reasonably necessary to satisfy the purpose for which it is collected, including to fulfil any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period where you consent to such retention in the event of a complaint or where we reasonably believe that there is a possibility of litigation in relation to your engagement of our services.

When deciding the appropriate retention period for personal data, we evaluate the amount, nature and sensitivity of your personal data, the possible risk of harm to you from unauthorised access, use or disclosure of your personal data, the reasons for which we process such data and whether we can achieve those purposes through other ways, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your data (see part 9 below for further information on your legal rights).

In some circumstances we will anonymise your personal data for statistical purposes to ensure that it can no longer identify you. In this case we may use such anonymous data indefinitely without additional notice to you.

You have certain legal rights in relation to your personal data. Your rights are to:

• be informed of the use for which your personal data is collected and processed.
• access your personal data which is in our custody or under our control.
• object to the processing of all or part of your personal data unless we demonstrate compelling legitimate interest for the processing which overrides your interests, or where such data is for the institution or defence of a legal claim.
• correction of false or misleading data. We may verify the accuracy of new data that you provide to us.
• deletion of false or misleading data about you or where there is no good reason for us to continue processing your data. You also have the right to ask us to delete your personal data where you have successfully exercised your right to object to processing, or where we are required to erase your personal data under applicable law. Where we are unable to comply with your request to delete such data for legal reasons, you will be informed of such inability at the time of your request.
• withdraw consent at any time where we rely on such consent to process your personal data. Please note that this will not affect the legality of any processing carried out prior to such withdrawal. Also, note that we may be unable to provide certain services to you if you withdraw your consent. We will advise you of this position at the time you withdraw your consent.
• restriction of processing of your personal data. This allows you to request us to suspend the processing of your personal data:
• if you want us to find out the accuracy of the data.
• where you request us to retain the data in order to establish, institute or defend a legal claim.
• here you successfully object to our use of your personal data but we need to ascertain whether we have overriding legitimate grounds to use such data.
• request the transfer of your personal data to you or to a third party. In this case, we will provide you or the third party with your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to data used by us to perform a contract with you or automated data which you previously consented to its use.

• Please contact us if you wish to exercise any of the rights set out in this part.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a safeguard to ensure that your personal data is not revealed to any person who has no right to access it. We may also contact you to request for more information in connection to your request in order to speed up our response.

We will respond to all legitimate requests within one month from the date we receive such requests. It may take us longer than a month if you have made several requests or if your request is complex.  In such cases, we will notify you and keep you updated.

Where you provide us with personal data about third parties (your customers, directors, suppliers etc.) you must ensure that they have been notified that you will be sharing their data with us, the purposes for which the data is to be used, and that their consent has been granted for those purposes.