Privacy Policy
Last updated 22 October 2026
The short version
- We collect what you send us through the contact form (your name, email address and message) and use it only to respond to you.
- We use Google Analytics to understand how the website is used, and Google reCAPTCHA to keep spam off the contact form.
- We do not sell your personal data or use it for advertising.
- You have rights under the Data Protection Act, 2019, including to access, correct and delete your data. Email info@woadvocates.co.ke to use them.
1. Who we are
This website is operated by Wanzau, Odhiambo & Associates Advocates ("the firm", "we", "us" or "our"), a firm of advocates of the High Court of Kenya with offices at Corner House, 6th Floor, Kimathi Street, Nairobi, P.O. Box 104540-00101, Nairobi, Kenya.
For the purposes of the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021, we are the data controller of the personal data described in this policy. You can reach us about anything in this policy at info@woadvocates.co.ke or on +254 711 529 747.
2. Scope of this policy
This policy explains how we handle personal data when you visit woadvocates.co.ke, read our articles, or contact us through the website.
If you instruct us as a client, we will give you further information about how we handle your data in our letter of engagement. That information applies in addition to this policy.
3. Information we collect
Information you give us
- Contact form: your name, email address and the content of your message, including anything you choose to tell us about your matter.
- Email, telephone and WhatsApp: if you contact us directly, we receive your contact details and whatever you share with us.
Information collected automatically
- Technical data: your IP address, browser type and version, device type, operating system, the pages you visit, the page that referred you and the date and time of your visit. Our web server records this in its logs.
- Usage data: collected through Google Analytics, as described in section 7.
- Security data: collected by Google reCAPTCHA on the contact page, as described in section 8.
We do not ask you to create an account, and we do not knowingly collect information from you through the website other than as set out above.
4. How we use it and our lawful basis
We process personal data in line with the principles in section 25 of the Act: lawfully, fairly and transparently, for explicit and specified purposes, and limited to what is necessary. Section 30 of the Act requires a lawful basis for each use:
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry, check for conflicts of interest and arrange a consultation | Taking steps at your request before a contract; our legitimate interest in responding to people who contact us |
| Protect the website and the contact form from spam, abuse and attack | Our legitimate interest in keeping the website secure |
| Understand how the website is used so that we can improve it | Our legitimate interest in running an effective website. You can object at any time (see section 6) |
| Meet our legal and professional obligations, for example under the Advocates Act and anti-money laundering law once you become a client | Compliance with a legal obligation |
| Establish, exercise or defend legal claims | Our legitimate interest; compliance with a legal obligation |
We will not use your personal data for direct marketing without your consent, and we do not make decisions about you based solely on automated processing.
5. Sensitive personal data
The Act gives extra protection to sensitive personal data, such as information about your health, ethnic origin, religious beliefs, sex life, biometric or genetic data, or family details including the names of your children.
Please do not include sensitive personal data, or confidential details of your matter, in the contact form or in an unsolicited email. Give us a short description and we will arrange a secure way to discuss the details. If you do send us sensitive personal data, we will handle it only as permitted by Part V of the Act.
6. Cookies and similar technologies
Cookies are small text files that a website stores on your device. We use the following:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| Session cookie | This website | Essential. Keeps the website working between pages, for example to show the result of a form submission | 2 hours |
XSRF-TOKEN | This website | Essential. Protects forms against cross-site request forgery | 2 hours |
_ga | Google Analytics | Analytics. Distinguishes one visitor from another | 2 years |
_ga_<ID> | Google Analytics | Analytics. Keeps track of the current visit | 2 years |
_GRECAPTCHA | Google reCAPTCHA | Security. Helps tell people from automated programs on the contact page | 6 months |
The map on our contact page is provided by Google Maps. When it loads, Google may set its own cookies and receive your IP address. Our pages also load fonts from Google Fonts and code libraries from cdnjs (Cloudflare). These providers receive your IP address so that they can deliver the files, but they do not set cookies for us.
Managing cookies
You can block or delete cookies in your browser settings. If you block essential cookies, the contact form may not work. You can stop Google Analytics from collecting data about your visits by installing the Google Analytics opt-out browser add-on, or by blocking cookies from google-analytics.com and googletagmanager.com.
7. Google Analytics
We use Google Analytics 4, a web analytics service provided by Google LLC, to understand how visitors find and use the website: for example, which pages are popular, how long visits last and which devices and browsers are used. This helps us improve our content and fix problems.
- Google Analytics uses the cookies listed in section 6 and collects information such as the pages you view, your approximate location (country and city), your device and browser, and how you arrived at the website.
- Google Analytics 4 does not log or store IP addresses.
- We see this information only in aggregated reports. We do not use it to identify you, and we do not use Google's advertising features.
- Google processes this information on our behalf. You can read more in how Google uses information from sites that use its services and in Google's Privacy Policy.
8. Google reCAPTCHA
Our contact form is protected by Google reCAPTCHA, which checks whether a form is being sent by a person or by an automated program. To do this, reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. It may also use the _GRECAPTCHA cookie.
We use reCAPTCHA because we have a legitimate interest in protecting the form, and our inbox, from spam and abuse. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.
9. Who we share information with
We do not sell, rent or trade your personal data. We share it only with service providers who help us run the website and our practice, and only so far as they need it:
- Website hosting and email providers, who store the website and deliver contact form messages to us.
- Google, for Google Analytics, reCAPTCHA, Maps and Fonts, as described above.
- Cloudflare (cdnjs), which delivers some of the code libraries the website uses.
- Our content management platform, which stores and serves our articles and their images.
- WhatsApp (Meta), but only if you choose to contact us using the WhatsApp button. WhatsApp's own privacy policy then applies.
We may also disclose personal data where the law requires it, for example to comply with a court order, or to protect our rights or the safety of others.
Where a provider processes personal data on our behalf, we take steps to make sure that it gives sufficient guarantees of security and confidentiality, as the Act requires.
10. Transfers outside Kenya
Some of our providers, including Google and Cloudflare, store or process data on servers outside Kenya. Where personal data is transferred outside Kenya, we do so in line with Part VI of the Act: to providers that offer appropriate safeguards for the security and protection of personal data, such as contractual data protection commitments, and only so far as necessary for the purposes in this policy.
11. How long we keep information
Section 39 of the Act requires us to keep personal data only as long as is reasonably necessary. In practice:
- Enquiries that do not lead to an instruction are deleted within 12 months of our last contact with you, unless we need them to deal with a dispute or complaint.
- Enquiries that lead to an instruction become part of your client file and are kept for as long as the law and our professional obligations require.
- Server logs are kept for a short period for security purposes and then deleted.
- Google Analytics data is kept for no longer than the retention period set in our Google Analytics account.
12. How we protect information
In line with section 41 of the Act (data protection by design and by default), we use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access or disclosure. These include encrypted connections (HTTPS) to the website, protection of our forms against automated abuse and forgery, restricted access to enquiries, and confidentiality obligations on everyone at the firm.
No method of sending information over the internet is completely secure. This is one reason we ask you not to send confidential or sensitive details through the contact form.
13. Your rights
Under section 26 and Part IV of the Act, you have the right to:
- be informed of how your personal data is used, which is the purpose of this policy;
- access the personal data we hold about you;
- object to our processing of all or part of your personal data, including analytics;
- correct personal data that is false, inaccurate, out of date, incomplete or misleading;
- delete personal data that is false, misleading or that we are no longer authorised to keep;
- restrict our processing in certain circumstances, for example while we check its accuracy;
- data portability: receive your personal data in a structured, commonly used and machine-readable format;
- withdraw consent at any time, where we rely on your consent. This does not affect processing that took place before you withdrew it.
To exercise any of these rights, email info@woadvocates.co.ke or write to us at P.O. Box 104540-00101, Nairobi, Kenya. We may need to confirm your identity before we act on your request. We will respond within the time limits set by the Data Protection (General) Regulations, 2021, and we do not charge for reasonable requests.
14. Data breaches
If a breach of security leads to unauthorised access to personal data and creates a real risk of harm, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires. We will also tell the people affected as soon as reasonably practicable, unless their identity cannot be established.
15. Children
This website is intended for adults. We do not knowingly collect personal data from children through the website. If you are under 18, please ask a parent or guardian to contact us on your behalf. Where we act in a matter involving a child, we process the child's data only with the consent of a parent or guardian, or as otherwise allowed by section 33 of the Act.
16. Complaints
If you have concerns about how we handle your personal data, please contact us first so that we can try to put things right.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the authority that enforces the Act in Kenya. Details are on its website, www.odpc.go.ke.
17. Changes to this policy
We may update this policy from time to time, for example when we change the services we use on the website or when the law changes. The "last updated" date at the top of this page shows when it was last revised. Where a change is significant, we will highlight it on the website.
18. Contact us
For any question about this policy or your personal data, contact:
Wanzau, Odhiambo & Associates Advocates
Corner House, 6th Floor, Kimathi Street, Nairobi
P.O. Box 104540-00101, Nairobi, Kenya
Email: info@woadvocates.co.ke
Telephone: +254 711 529 747, +254 704 556 204