Privacy Policy
T.M.M & Partners Advocates — Advocates, Commissioners for Oaths, Patent Agents & Notary Public KMA Centre, Block A, 3rd Floor, Suite 3.1, Mara Road, Upper Hill, Nairobi, Kenya
Last updated: 2nd July 2026
T.M.M & Partners Advocates (“the Firm”, “we”, “us”) is committed to protecting your personal data in accordance with the Data Protection Act, 2019 (Kenya) (“DPA”) and, where applicable, other data protection laws. This Policy explains what personal data we collect through this website, why we collect it, how we use it, and your rights.
1. Who we are
The Firm is the data controller of personal data collected through this website within the meaning of the DPA. Our contact details for data protection matters are set out in Section 10.
2. Personal data we collect
Inquiry form. When you submit an inquiry we collect your name, email address, telephone number, the practice area you select, and the content of your message. This data is transmitted to the Firm by email and stored securely within our website’s administration system.
Meeting bookings. When you book a consultation through our booking calendar, your name, email address, and chosen appointment details are processed by Google Calendar (a service of Google LLC) to create the appointment and generate a Google Meet link. Google’s own privacy policy applies to that processing.
Chatbot. Our website assistant is powered by an artificial-intelligence service provided by Google (Gemini API). Messages you type into the chat are transmitted to that service to generate responses. Do not share confidential, sensitive, or case-specific information in the chat. The chatbot does not provide legal advice, and no advocate-client relationship is created by using it.
Analytics. We use Google Analytics to understand how visitors use our website (pages visited, approximate location, device type). This data is aggregated and does not directly identify you.
Security services. We use Cloudflare Turnstile to protect our forms from automated abuse. Turnstile may process technical information about your browser and device to distinguish humans from bots.
Technical data. Like most websites, our hosting infrastructure automatically logs IP addresses and browser information for security and operational purposes.
3. Why we process your data (lawful bases)
We process personal data:
(a) to respond to your inquiries and provide legal services you request (performance of, or steps prior to, a contract);(b) to schedule and conduct consultations (contract / legitimate interests); (c) to secure our website and prevent abuse (legitimate interests); (d) to understand and improve how our website is used (legitimate interests / consent, where required); and (e) to comply with legal and professional obligations applicable to advocates in Kenya.
4. How we use and share your data
We use your data solely for the purposes above. We do not sell personal data, and we do not use it for third-party advertising. We share data only with: service providers who process it on our behalf as described in Section 2 (Google, Cloudflare, our web hosting provider); professional advisers and insurers where necessary; and public authorities where disclosure is required by law. Some providers (such as Google and Cloudflare) may process data on servers located outside Kenya; where personal data is transferred outside Kenya, we take reasonable steps to ensure it receives an adequate level of protection consistent with the DPA.
5. Confidentiality and the advocate-client relationship
Submitting an inquiry, booking a meeting, or chatting with our website assistant does not create an advocate-client relationship. Information you send before we have agreed to act for you may not be protected by advocate-client privilege. Please do not send confidential details of your matter until we have confirmed our engagement.
6. Data retention
We retain inquiry data for as long as reasonably necessary to respond and, where an engagement follows, in line with our professional record-keeping obligations. Analytics data is retained per Google Analytics’ standard retention settings. We delete or anonymise personal data when it is no longer required.
7. Your rights
Under the DPA you have the right to: be informed how your data is used; access personal data we hold about you; request correction of inaccurate data; request deletion of data we have no lawful basis to retain; object to or restrict certain processing; and lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke). To exercise any of these rights, contact us using the details in Section 10. We will respond within the timelines prescribed by law.
8. Cookies and similar technologies
Our website uses a minimal set of cookies and similar technologies: strictly necessary items for site operation and security, and analytics identifiers used by Google Analytics. You can control cookies through your browser settings; disabling them does not prevent you from using the core functions of the site.
9. Security
We implement appropriate technical and organisational measures to protect personal data, including encrypted transmission (HTTPS), access controls on our administration systems, and anti-abuse protections on all forms. No internet transmission is completely secure, and we cannot guarantee absolute security.
10. Contact us
For any question about this Policy or to exercise your rights, contact:
T.M.M & Partners Advocates KMA Centre, Block A, 3rd Floor, Suite 3.1, Mara Road, Upper Hill, Nairobi, Kenya Email: [info@tmmadvocates.ke] Telephone: +254 703 480 154 / +254 728 178 883
11. Changes to this Policy
We may update this Policy from time to time. The “Last updated” date at the top indicates the current version. Material changes will be highlighted on this page.