Privacy Policy

Last updated: 20 July 2026

1. Introduction

N.A. Were Advocates (“the Firm,” “we,” “us,” “our”) is a movement-centred, feminist, and decolonial law firm based in Nairobi, Kenya, operating through nwadvocates.com (the “Site”). We work with individuals, organisations, movements, and commercial clients across Kenya and other African jurisdictions.

We understand that many people who visit this Site — including human rights defenders, survivors, and members of communities facing criminalisation or stigma — have real safety concerns about how their information is handled. This policy explains what data we collect through the Site, why, and what choices and rights you have. It is written to comply with the Kenya Data Protection Act, 2019 (“the DPA”) and its subsidiary Data Protection (General) Regulations, 2021, and, where relevant to visitors and clients based outside Kenya, the EU General Data Protection Regulation (GDPR).

This policy covers the Site only. It does not alter or diminish the confidentiality and legal professional privilege that attaches to any client-advocate relationship, which is governed separately by the Advocates Act and applicable rules of professional conduct.

2. Who We Are (Data Controller)

N.A. Were Advocates is the data controller for personal data collected through this Site.

Address: Rose Avenue, Hurlingham, Nairobi, Kenya
Email: info@nwadvocates.com
Phone: +254 751 292 520

3. Information We Collect

3.1. Information you provide directly

Contact form. When you submit our contact form, we collect the information you enter — typically your name, email address, and the content of your message. If your message describes a legal matter, it may include details about your circumstances, which could constitute sensitive personal data (see Section 5).

Direct email or phone contact. If you email or call us directly, we collect whatever information you choose to share.

3.2. Information collected automatically

Analytics (Google Analytics). We use Google Analytics to understand how visitors use the Site — for example, which pages are viewed, how long visitors stay, and general location and device information (typically at city/country level, via IP address). Google Analytics uses cookies and similar technologies to do this. This data is aggregated and is not used by us to identify individual visitors. It is, however, processed by Google, a third-party processor based in the United States; see Section 8 (International Transfers) and Google’s own privacy policy at policies.google.com/privacy.

Log and technical data. Our hosting provider automatically logs standard technical information (such as IP address, browser type, and access times) for security and site-functioning purposes.

Cookies. See Section 4 below.

We do not currently use advertising trackers, social media pixels, or third-party marketing cookies on this Site.

4. Cookies

The Site uses a limited set of cookies:

Purpose	Type	Duration
Site functionality (e.g. remembering cookie consent choice)	Essential	Session / up to 1 year
Google Analytics (_ga, _gid, etc.)	Analytics	Up to 2 years

You can accept, reject, manage, or withdraw consent for analytics cookies through the Site’s cookie banner or cookie settings, where available. You can also control or delete cookies through your browser settings. Disabling analytics cookies will not prevent you from browsing the Site or contacting us, but may affect our ability to understand general Site usage.

5. Sensitive Personal Data

Under the DPA, “sensitive personal data” includes data relating to a person’s health, sexual orientation, ethnic or social origin, conscience or religious belief, genetic and biometric data, and information revealing the commission or alleged commission of an offence. Given the nature of our practice — including strategic litigation on sexual and reproductive health rights and work with LGBTQ+ individuals and movements — messages submitted through our contact form may contain such data.

We process sensitive personal data only with your explicit consent, provided through an affirmative consent checkbox on the contact form or another clear written indication. We use this information only to assess and respond to your enquiry, take steps at your request before entering into a client relationship, or provide legal services that you have requested. You may withdraw your consent at any time by contacting us at info@nwadvocates.com; withdrawal will not affect processing carried out before withdrawal or any processing required by law, professional obligations, legal claims, or legal professional privilege. We apply heightened safeguards to this category of data, including restricted internal access and secure storage.

A practical note on the contact form: for your own safety, we recommend against including highly sensitive case details (such as specifics of an ongoing threat, identifying information about third parties, or evidence of an offence) in the initial website contact form. A short message requesting a consultation is sufficient; we will arrange a secure and confidential channel for any detailed case information once contact is established.

6. Legal Basis and Purposes of Processing

We process personal data collected through the Site for the following purposes and on the following legal bases:

Purpose	Legal basis (Kenya DPA)	Legal basis (GDPR, where applicable)
Responding to enquiries submitted via the contact form	Consent, where you choose to submit an enquiry; and, where applicable, processing necessary to take steps at your request before entering into a client relationship.	Consent (Art. 6(1)(a)); and/or pre-contractual steps at your request (Art. 6(1)(b)).
Processing sensitive personal data included in a message	Explicit consent and, where relevant, processing necessary for establishing, exercising, or defending legal claims or providing legal services requested by you.	Explicit consent (Art. 9(2)(a)); and, where applicable, legal claims or related legal advice (Art. 9(2)(f)), together with an Art. 6 basis such as consent or pre-contractual steps.
Site analytics	Consent, obtained through the cookie banner before non-essential analytics cookies are used.	Consent (Art. 6(1)(a)), obtained before non-essential analytics cookies are used.
Legal, regulatory, and professional conduct compliance	Processing necessary for compliance with a legal obligation to which the Firm is subject.	Legal obligation (Art. 6(1)(c)).
Protecting the Firm’s systems, Site, staff, clients, and others, including site security and fraud prevention	Processing necessary for the Firm’s legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your rights and freedoms; and, where necessary, to protect vital interests.	Legitimate interests (Art. 6(1)(f)); and, where necessary, vital interests (Art. 6(1)(d)).

7. How We Share Your Information

We do not sell personal data. We may share data collected via the Site with:

Service providers who support the Site (e.g. our web host and developer, Qallann Marketing; Google, for analytics), acting as data processors under contract, bound to process data only on our instructions and to appropriate confidentiality and security standards.
Legal and regulatory bodies, where required by law, court order, or the rules of the profession.
Co-counsel or partner organisations, only with your consent, where relevant to representing you or advancing a matter you have raised (e.g. referral to a partner NGO).

We do not share sensitive personal data with any third party except as strictly necessary to provide legal services you have requested, or as required by law.

8. International Data Transfers

Some personal data processed through the Site may be transferred to, stored in, or accessed from countries outside Kenya, including where we use service providers such as Google Analytics or website hosting, or where a specific matter requires engagement with counsel, experts, partner organisations, or service providers in another jurisdiction. We only make such transfers where they are lawful, necessary for the relevant purpose, and subject to appropriate safeguards.

For transfers outside Kenya, we apply Part VI of the DPA and the Data Protection (General) Regulations, 2021. This means that, before transferring personal data, we consider whether the destination country or recipient provides an adequate level of protection, whether appropriate safeguards are in place, whether the transfer is necessary for a recognised purpose such as the establishment, exercise, or defence of legal claims, or whether you have given informed consent after being told of the possible risks. Where sensitive personal data is involved, we will usually seek your explicit consent unless another lawful basis clearly applies.

Where we rely on service providers or professional partners outside Kenya, we take reasonable steps to ensure that personal data is protected through appropriate contractual, technical, and organisational measures. These may include confidentiality obligations, data-processing agreements, cross-border transfer clauses, access controls, encryption or secure transmission measures where appropriate, limits on onward transfers, and requirements to process personal data only for the agreed purpose.

Where GDPR applies to a transfer of personal data outside the European Economic Area, we will rely on an applicable GDPR transfer mechanism, such as an adequacy decision, standard contractual clauses, binding corporate rules, explicit consent, or another lawful derogation under Chapter V of the GDPR. We will also consider whether additional safeguards are needed to ensure that the transferred data remains protected to a standard broadly equivalent to that required under GDPR.

For Google Analytics, analytics data may be processed by Google outside Kenya, including in the United States. We use analytics only with cookie consent and only for understanding Site usage. You can reject or withdraw analytics-cookie consent through the Site’s cookie banner or settings, where available, or by adjusting your browser settings.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to respond to enquiries, provide legal services, comply with legal and professional obligations, resolve disputes, maintain records, and establish, exercise, or defend legal claims.

Contact-form enquiries that do not lead to a client relationship are retained for 12 months and then deleted, unless you ask us to delete them sooner and we are not required to retain them for legal, professional, or record-keeping reasons.
Client and case-related data is retained in accordance with our professional obligations under Sections 90 and 91 of the Law Society of Kenya Code of Standards of Professional Practice and Ethical Conduct, 2017, and our internal records-retention policy. Retention periods may vary depending on the nature of the matter, applicable statutory limitation periods, and legal, tax, professional, or regulatory requirements. Typical retention periods include:
- Conveyancing, land, and probate matters: 7 years.
- Tax matters: 12 years.
- Other client and case-related matters: generally 7 years after the conclusion of the matter, unless a longer period is required or justified.
Analytics data is retained by Google Analytics in accordance with its standard retention settings, which we configure to 14 months where possible.

10. Data Security

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including restricted access to enquiry and case data, secure storage, and staff confidentiality obligations. No system is completely secure; if you are concerned about the sensitivity of information you wish to share, please see the note in Section 5.

11. Your Rights

Under the DPA, you have the right to:

be informed of the use to which your personal data is to be put;
access your personal data in our custody;
object to the processing of your personal data;
correct false or misleading personal data;
request deletion of false or misleading personal data, or personal data that has been unlawfully obtained or is being unlawfully processed;
withdraw consent at any time where processing is based on consent; and
not be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or significantly affects you.

We do not currently use automated decision-making or profiling on this Site. Where applicable under GDPR, you may also request data portability and restriction of processing.

To exercise any of these rights, or to withdraw consent where processing is based on consent, contact us in writing at info@nwadvocates.com. We will respond within the timeframes required by law. Note that some rights may be limited where data is subject to legal professional privilege, a statutory retention obligation, professional conduct obligations, or the establishment, exercise, or defence of legal claims.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya (odpc.go.ke), or, if you are in the EU/EEA, with your local supervisory authority.

12. Children’s Privacy

This Site is not directed at children, and we do not knowingly collect personal data from children through the Site. If you believe a child has submitted personal data to us, please contact us so we can delete it.

13. Changes to This Policy

We may update this policy from time to time, for example to reflect changes in law or our practices. The “last updated” date at the top of this page will reflect the most recent revision. Material changes will be notified on this page.

14. Contact Us

For any questions about this policy or our data practices, contact:

N.A. Were Advocates
Rose Avenue, Hurlingham, Nairobi, Kenya
info@nwadvocates.com
+254 751 292 520