Privacy and Cookie Policy

1. Who we are and what this policy covers

Nelson Nkari & Company Advocates ("the firm", "we", "us" or "our") is responsible for deciding how personal data is used through https://nnkari-advocates.co.ke (the "Website"). We act as the data controller for the activities described in this policy.

This policy explains how we collect, use, disclose, retain and protect personal data when you browse the Website, contact us, subscribe to updates, or use any event, programme or other form that we make available. Personal data is information that identifies you, directly or indirectly.

We apply Kenya's Data Protection Act, 2019 and applicable regulations. Where another country's mandatory privacy law applies to a particular activity, we will also meet those requirements. Accessing the Website does not, by itself, give consent to optional processing.

Our legal work may require additional information and separate client notices. An engagement letter governs the legal services we agree to provide, while this policy continues to explain the Website's processing.

Privacy contact: privacy@nnkari-advocates.co.ke.

Office location: Nairobi, Kenya. Postal address: P.O. Box 22810-00505, Nairobi, Kenya. Please contact us to arrange an in-person appointment.

2. Information we collect

Information you provide. We collect the details you enter into an available form or send to us, such as your name, organisation, role, email address, telephone number, subject of enquiry and message. If you register for an event or programme, we collect the registration and attendance details needed to administer it. An accessibility request may reveal health information. Please provide only what is needed to arrange suitable assistance.

Subscriptions. If we offer updates and you subscribe, we record your email address, subscription preferences and the evidence of your choice. We keep a limited record of an unsubscribe request to avoid contacting you again for that purpose.

Recruitment. If we invite applications through the Website, we collect the application material you choose to submit. A recruitment notice will explain any additional checks or uses before they take place.

Technical and security information. The systems delivering the Website necessarily receive an IP address to transmit a response, together with limited request and security information. Raw IP addresses are not retained in analytics records. They may be processed transiently to determine approximate country and derive a short-lived pseudonymous visit identifier. Operational and security logs may contain IP addresses where needed to deliver and protect the Website; they are restricted to that purpose and follow the retention period in section 10. We do not repurpose them to reconstruct analytics after rejection.

Analytics and session recordings. Optional analytics and session recordings are not currently enabled. If introduced, they will operate only under the separate consent and safeguards described in section 7. Device identifiers and information linked to a browser can be personal data even when a person’s name is absent.

We do not ask for identity documents, financial records, passwords or detailed evidence of a legal matter through a general enquiry form. Where particular information is required, the relevant form or communication will explain why and whether providing it is mandatory.

3. How we obtain information

We obtain information directly from you, from your browser or device, and from systems used to operate and secure the Website. If someone enquires or registers on your behalf, we may receive relevant contact and registration details from them.

Please ensure you have a lawful reason to provide another person's information. Where we obtain personal data indirectly, we provide the information required by law, subject to any applicable exception, and use it only for a justified purpose.

Public sources, professional referrals and conflict-check information may become relevant when an enquiry progresses towards an engagement. Those activities are limited to what is necessary and are explained further at intake where required.

4. Purposes and lawful grounds

Enquiries and requested contact. We use your details to read, route and answer your enquiry. The lawful ground is taking steps at your request before a possible engagement, where applicable, or our legitimate interest in responding to correspondence and administering the firm. Sending an enquiry does not subscribe you to marketing.

Website delivery and security. We process essential technical information to deliver the service, prevent misuse, investigate faults and protect data. We rely on our legitimate interests in operating a secure, usable Website and on legal obligations where they apply. We assess whether those interests are outweighed by your rights.

Events and programmes. If you register, we use the necessary information to manage your booking, communicate practical details and deliver the activity. The ground is the relevant contract or steps you request before entering it, or a properly assessed legitimate interest for a free activity. Optional promotional follow-up requires a separate choice.

Analytics. We use optional analytics to understand aggregate use of pages and improve content and navigation. We rely on your prior, specific consent for the analytics described here.

Newsletters and promotion. Where offered, we use your details for updates or invitations that you have expressly agreed to receive, subject to any other permission expressly provided by applicable law and explained to you at collection. Consent to analytics, an enquiry or attendance is not marketing consent.

Recruitment. Where offered, we use application details to assess and respond to an application, relying on steps towards employment at your request, applicable legal obligations, or a documented legitimate interest as appropriate. Additional sensitive information requires a separate applicable ground.

Compliance and claims. We may keep or disclose necessary information to comply with law, respond to lawful demands, preserve evidence, establish or defend legal claims and maintain professional standards. We identify the applicable legal obligation or legitimate interest for the activity.

We use personal data only for the stated purpose or a lawful, compatible purpose. If a new purpose requires consent or a further notice, we address that before processing begins. Withholding information may prevent us from answering a request or completing a registration, but declining optional analytics or marketing does not prevent ordinary browsing.

5. Legal enquiries, sensitive information and confidentiality

Start an enquiry with a short description and the parties' names needed for an initial conflict check. Please wait for us to confirm an appropriate channel before sending detailed evidence, identity documents or information about children, health, family circumstances or other sensitive matters.

We handle enquiries with appropriate confidentiality. Whether a communication attracts legal professional privilege depends on the law and the circumstances. This policy does not remove any privilege or professional duty that applies, and we do not treat submission of information as a waiver of those protections.

Where sensitive personal data is necessary, we identify both a lawful processing ground and the additional condition required for that category. Depending on the circumstances, this may include establishing, exercising or defending legal claims, or another condition permitted by law. We limit access and seek specific consent where required.

A Website message, automated acknowledgement or meeting request does not itself confirm that we have accepted instructions. Please refer to our Website Terms of Service for the engagement process and urgent matters.

6. Cookies and similar technologies

Cookies are small files stored on your device. Local storage and similar technologies can also store preferences or identifiers. A cookie may last only for a browsing session or remain until its expiry or deletion. A first-party cookie is set for our domain. A third-party cookie is associated with another provider.

Strictly necessary cookies support requested functions, secure staff access and remember your privacy choices, including rejection of optional processing. They are not used for marketing or browsing profiles. We obtain prior consent before loading optional analytics, recording or embedded-video technologies. Ordinary browsing and enquiry submission remain available when optional purposes are declined. Calling a technology "first-party", "custom" or "cookieless" does not remove privacy obligations.

The cookie register in section 8 identifies the actual technologies, their purposes and lifetimes. Browser storage lifetime is separate from the time a record remains on a server.

7. Your choices, analytics and session recordings

No analytics event is collected and no session recording begins before the relevant affirmative permission. The initial notice offers "Necessary only", "Accept all" and access to "Cookie settings". When analytics or recordings are made available, preferences will offer separate controls for analytics, session recordings and embedded videos, all off by default. Recordings require a separate, explicit opt-in; a general "Accept all" action alone will not activate them. Closing the notice, scrolling, continuing to browse, submitting an enquiry or accepting the Website Terms does not amount to optional-processing consent.

You can change or withdraw your choice at any time through the "Cookie settings" link in the Website footer. Withdrawal stops future collection for the withdrawn purpose and removes or disables the associated cookies and identifiers under our control where technically possible. It does not affect the lawfulness of processing before withdrawal. You can also request deletion of identifiable historical records, subject to the limits explained below.

Our consent-controlled analytics uses self-hosted Umami to measure Website use. Its dataset is limited to published public-page paths, fixed link categories, foreground active-time estimates, timestamps, broad referring-source categories, approximate country, coarse device/browser information and pseudonymous visit information. URL queries, fragments and sensitive parameters are excluded; pages carrying a query string are not tracked. The Website shortens IPv4 addresses to a /24 network and IPv6 addresses to a /48 network before sending them to Umami for country detection and salted visit grouping. Full addresses and raw browser-identification strings are not forwarded to or stored in analytics.

Not storing a raw IP address does not automatically anonymise the rest of a record. Umami derives a pseudonymous identifier partly from IP and browser information, with a salt configured to rotate daily. We treat identifiers and event combinations as personal data while a person can reasonably be identified. They are not linked to submitted names, enquiries or client files, and we do not use identity-linking features. Analytics requires consent even where no analytics cookie is used.

Analytics events and recordings exclude enquiry text, form contents, uploaded documents, email addresses, telephone numbers, client or matter identifiers, sensitive search terms and sensitive URL parameters. Submitted names and messages are instead handled as restricted enquiry correspondence, separately from browsing telemetry. We do not use analytics or recordings for advertising, cross-site tracking or linking browsing histories to client files.

If enabled, session replays will recreate permitted page interactions such as clicks, scrolling and navigation. They are not camera, microphone or screen-video recordings. We will mask all page text and input values before transmission, block whole forms and sensitive components, and exclude administration, login, preview, search, enquiry and confidential pages. Capture stops when permission is withdrawn or the visitor enters an excluded page. No activity from before consent is backfilled. Playback and stored assets are restricted to authorised system administrators, and recordings are never linked to a name or enquiry. Recordings remain disabled until masking, exclusion, deletion and access controls are verified.

The current Website infrastructure is hosted by Amazon Web Services in Stockholm, Sweden (eu-north-1). Any approved analytics and replay service will use the same disclosed hosting arrangement unless this notice is updated before a change. System-administrator access is restricted, and the separate retention periods in section 10 apply.

You can reject cookies and analytics and still browse the core Website. Cookie-free security processing needed to deliver and protect the service may continue on its separate lawful ground, with IP anonymisation as described above. We do not repurpose those records to reconstruct analytics after rejection.

Your choice applies to the browser and device in which it is made. A strictly necessary preference cookie remembers acceptance or rejection for six months. It does not activate a purpose you declined. Deleting that cookie or using another browser may require a new choice. New analytics or recording purposes require fresh, specific permission; a previous choice about video embeds does not authorise them. The footer’s "Cookie settings" control lets you review and change the choice.

8. Cookie and storage register

The register below describes current first-party storage and identifies optional features that are not yet active. We will update it before introducing additional technologies. Browser storage expiry is separate from server-side retention.

Consent preference record: nna_cookie_consent, set by Nelson Nkari & Company Advocates on the Website host. It stores separate acceptance or rejection choices for analytics, recordings and embedded videos, is restricted to the current host, and expires after 180 days without renewal on visits. It uses Secure on HTTPS, SameSite=Lax and Path=/. The purposes-v3 notice requires a fresh choice; older video or unavailable-feature choices do not authorise current analytics. Recordings remain disabled. Consent receipt: nna_consent_receipt is a host-only, HttpOnly, Secure, SameSite=Strict cookie with Path=/ and the same remaining 180-day choice lifetime. Its random reference verifies the saved choice against separate consent evidence; it is never sent to Umami, used to group visits, or joined to enquiries. Both cookies are strictly necessary preference/evidence storage, not marketing identifiers. Evidence contains only the notice version, choice, times and random reference, without an IP address, browser string, name or message, for the period in section 10.

Staff authentication: payload-token, set by the firm on the Website host for authorised CMS users, with a two-hour authentication lifetime. Authenticated draft preview uses Next.js __prerender_bypass session storage in a cookie, normally expiring when the browser session ends or preview mode is exited. These cookies support requested staff functions and are not public analytics identifiers. They are not needed for ordinary public browsing.

Analytics: the self-hosted Umami connection uses no analytics cookie or browser-storage identifier. It collects only after an explicit analytics choice and successful consent-evidence verification, and pauses when retention checks are unhealthy. It processes the limited fields in section 7 and derives a server-side salted pseudonymous visit identifier that rotates daily, using the shortened network address and coarse browser information. Estimates may group different visitors together and must not be treated as a count of distinct people. The absence of an analytics cookie does not dispense with consent or the 90-day server-retention limit. No persistent Distinct ID or real-world identity is supplied. Signed-in staff, previews, administration and unpublished or excluded paths are not counted.

Embedded videos: the Website supports Google/YouTube privacy-enhanced players at youtube-nocookie.com, loaded only after video permission. No embedded player is currently active on published event pages. Before publishing an active embed, we will identify any provider-controlled storage and its actual lifetime in this register and link to the provider’s notice. Session recordings are also currently inactive; no recorder cookie, storage identifier or replay collection has been enabled.

Our register review includes server-side events, pixels, recorder traffic and embedded services, because a browser-cookie scan alone may miss them. Optional features remain disabled until their consent and disclosure requirements are met.

9. Who receives personal data

Authorised members of the firm access information where their role requires it. We may use service providers for Website hosting, maintenance, security, email delivery, form handling, backups and the infrastructure running custom analytics. They receive only the data needed for their task and are subject to appropriate contractual, confidentiality and security requirements.

The verified current hosting arrangements are Amazon Web Services, providing Website hosting in Stockholm, Sweden (eu-north-1), and HostAfrica, providing the firm’s cPanel email hosting in Kenya. Website enquiry mail is routed through mail.nnkari-advocates.co.ke. Authorised maintenance access is limited to the task. Backups currently used for staging are held with the Website infrastructure; any new backup provider, subprocessors with relevant access, or different processing location must be assessed and disclosed before use.

If an enquiry becomes a legal engagement, necessary information may be shared with instructed counsel, experts or other professional advisers through the arrangements explained at intake. Event organisers or delivery partners receive registration information only where this is necessary and disclosed.

We may disclose information where a lawful obligation requires it, or where a permitted disclosure is necessary to protect rights or deal with a security incident. We assess the request and applicable professional duties, including privilege, before disclosure.

We do not sell personal data or provide Website enquiry information to advertisers. External organisations may act as independent controllers for their own services. Their own notices explain those uses.

10. Retention and deletion

We keep personal data for the period necessary for its purpose and any applicable legal or professional requirement. We then securely delete it or render it genuinely anonymous. Replacing a name with an identifier alone is not anonymisation.

Website enquiries that do not become engagements: 12 months after the last substantive contact. A minimal conflict record may be retained separately where necessary to protect professional duties, with a documented retention review.

Security and access logs: 14 days from collection, with longer preservation only for a documented incident, legal requirement or claim.

Analytics events and associated pseudonymous identifiers: 90 days from collection. Session recordings and associated assets: 7 days from capture, including recordings marked or saved for later review. Aggregate statistics may be retained longer only where individuals are no longer identifiable and that longer purpose has been approved.

Consent and withdrawal evidence: 12 months after the relevant consent expires or is withdrawn, limited to what is needed to demonstrate and respect the choice. The browser preference cookie separately expires after 180 days.

Subscriptions: until you unsubscribe or the subscription is closed, followed by deletion of subscriber details within 30 days. A limited suppression record may remain to honour the opt-out, restricted to that purpose and reviewed while the firm operates the relevant mailing service.

Event registrations, where offered: 12 months after the event. Unsuccessful recruitment applications, where invited: 6 months after the recruitment process closes. Any longer talent-pool retention requires an explained, separate basis. Programme-registration records follow the disclosed activity-specific terms and the 12-month event-registration period unless a different justified period is explained before collection.

Client records: the applicable engagement and records-retention arrangements apply. We do not promise deletion where a lawful retention obligation or an applicable legal-claims ground requires preservation.

Backups: once a controlled production cycle is in place, deleted information will age out within 30 days. Backups are restricted from ordinary use and any restoration must reapply relevant deletions. Current staging rollback copies require controlled review and expiry before production launch; we do not represent an automated production backup cycle as already operating. A documented legal hold may suspend deletion only for the records it covers.

11. International transfers

The current Website hosting involves processing in Sweden by Amazon Web Services. The firm’s email hosting is supplied by HostAfrica in Kenya. Staging rollback copies and the consent-controlled analytics service follow the Website hosting location. Session recordings remain disabled. Any deployment or provider access involving another country will be assessed and disclosed before it begins.

Before an international transfer, we establish the lawful transfer ground and required safeguards. These may include appropriate contractual or other safeguards recognised by Kenyan law, an applicable adequacy basis, or a permitted necessity ground. Where consent is the transfer ground, we obtain the consent required by law and explain relevant risks. Sensitive personal data requires the additional protections applicable to it.

Using the Website is not blanket consent to overseas transfers. Custom-built analytics is not necessarily hosted in Kenya. Contact us for information about the safeguards relevant to your personal data, subject to lawful protection of confidential information.

12. Security and incidents

We use technical and organisational measures appropriate to the information and risks, including controlled access, secure transmission, system maintenance and procedures for handling incidents. We require appropriate protection from service providers.

No internet system can guarantee absolute security. Please tell us promptly at privacy@nnkari-advocates.co.ke if you suspect a Website-related privacy or security incident. Do not include passwords or unnecessary sensitive evidence in the initial message.

Where a personal data breach meets the legal notification conditions, we notify the Data Commissioner and affected individuals within the applicable statutory requirements. We provide information about protective steps where required.

13. Your rights and how to exercise them

Subject to the conditions and limits in applicable law, you may ask to be informed about use of your data, obtain access, correct inaccurate or misleading information, request erasure, object to processing, request restriction and obtain portability where it applies. You may withdraw consent at any time. You may also exercise applicable rights concerning decisions made solely by automated means.

Our Website analytics is not used to make decisions producing legal or similarly significant effects about you. If we propose such a use, we will first provide the required information and safeguards.

Send a request to privacy@nnkari-advocates.co.ke, describing the right and the relevant interaction with us. We may request proportionate information to verify identity or an authorised representative's authority. Please do not send an identity document unless we explain why it is needed and how to send it securely.

We respond within the time required for the particular right under Kenyan law. Different rights can have different deadlines. If we cannot fulfil a request in whole or part, we explain the lawful reason and available challenge route. We protect other people's information, applicable privilege and records we must lawfully retain. These limits are assessed individually.

Requests are ordinarily handled without charge. Any exceptional fee or refusal must have a lawful basis, which we explain. Cookie withdrawal and marketing opt-out are free.

14. Children

The Website is directed to adults seeking information about the firm and legal services. We do not invite children to submit personal data through general forms or knowingly use their information for promotional profiling.

Where a matter or specifically designed activity requires a child's information, we use an appropriate intake process, verify parental or guardian authority and consent where required, and protect the child's rights and best interests. If you believe a child has supplied information through the Website inappropriately, contact our privacy email so we can assess and address it.

15. Links, embedded services and communications

External links take you to services with their own privacy practices. Embedded maps, videos, booking tools or social content may disclose technical information to their provider when loaded. Any optional embed that processes personal data must be identified in the register and subject to the relevant choice before loading.

Contacting us through an external messaging or social service also involves that provider's processing. Please use the secure channel we agree for sensitive legal information. A link to an external service does not mean that the firm controls its privacy practices.

16. Complaints and policy changes

You may raise a concern with us at privacy@nnkari-advocates.co.ke. You may also complain directly to Kenya's Office of the Data Protection Commissioner without first completing an internal process. The official complaint route is https://www.odpc.go.ke/file-a-complaint/ and the Office's email is info@odpc.go.ke. This policy does not limit any other remedy available by law.

We update this policy when our practices or legal requirements change and display the effective date above. We give an appropriate notice of material changes. Where a new use requires consent, we obtain it before that use begins. A policy update does not retrospectively expand an earlier consent.