Effective Date: 26^th September 2026

1. Introduction

A. Mukasa & Company Advocates (“the Firm”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data entrusted to us.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you:

• visit or interact with our website;
• contact us through our website, email, telephone or other communication channels;
• submit an enquiry or request for legal services;
• become, or seek to become, a client of the Firm;
• interact with us in the course of providing professional legal services; or
• otherwise provide personal information to us.

We process personal data in accordance with the Constitution of Kenya, the Data Protection Act, 2019, applicable regulations made under it, and other applicable laws and professional obligations.

This Privacy Policy should be read together with any specific privacy notices, engagement terms, website terms or other notices that we may provide in particular circumstances.

2. Who We Are

A. Mukasa & Company Advocates is a law firm practising in Kenya.

For purposes of applicable data protection law, the Firm may act as a data controller in respect of personal data for which it determines the purposes and means of processing and, where applicable, may process personal data on behalf of another person or organisation.

3. Personal Data We May Collect

Depending on the nature of your interaction with us, we may collect and process information including:

a. Identity and contact information

This may include your:

• name;
• identification or passport details;
• postal or physical address;
• email address;
• telephone number;
• occupation, position or organisation; and
• other information necessary to identify or communicate with you.

b. Client and matter information

Where you enquire about or instruct us to provide legal services, we may collect information concerning:

• the nature and circumstances of your legal matter;
• parties involved in a transaction or dispute;
• contracts, correspondence and supporting documents;
• corporate, property, financial or commercial information;
• court, tribunal or regulatory proceedings;
• intellectual property rights;
• family, succession or probate matters; and
• other information relevant to our professional engagement.

Such information may, depending on the matter, include sensitive personal data.

c. Regulatory and compliance information

We may collect information necessary to comply with legal and professional obligations, including information required for:

• client identification and verification;
• conflict-of-interest checks;
• anti-money laundering and counter-terrorist financing compliance;
• sanctions and other regulatory screening; and
• statutory record-keeping.

d. Financial information

Where relevant, we may process information concerning:

• payments made to or by the Firm;
• invoices and billing;
• bank or payment references;
• disbursements;
• client account transactions; and
• other accounting or financial records.

We do not ordinarily require visitors to submit payment-card information through this website unless a specific secure payment facility is expressly provided.

e. Website and technical information

When you use our website, certain information may be collected automatically, including:

• Internet Protocol (IP) address;
• browser and device information;
• operating system;
• pages visited;
• date and time of access;
• referring website;
• website interaction information; and
• cookie or similar technology data.

4. How We Collect Personal Data

We may obtain personal data:

• directly from you;
• through forms submitted on our website;
• through email, telephone or other correspondence;
• during client onboarding;
• from documents supplied by you or persons acting on your behalf;
• from clients, counterparties, witnesses, advocates and other persons involved in a legal matter;
• from courts, tribunals, registries, regulators and government agencies;
• from publicly accessible registers, databases and websites;
• from professional advisers and service providers; and
• through technologies used in operating our website and information systems.

Where you provide us with personal data relating to another person, you should ensure that you are authorised to provide that information where required by law.

5. How We Use Personal Data

We may process personal data for purposes including:

• responding to enquiries submitted through our website;
• assessing whether we are able to act for a prospective client;
• carrying out conflict checks;
• establishing and managing the advocate-client relationship;
• providing legal advice and professional services;
• conducting transactions, litigation and other legal proceedings;
• communicating with clients and other relevant persons;
• maintaining client and matter records;
• issuing invoices and managing payments;
• complying with legal, regulatory and professional obligations;
• preventing fraud, misuse and unlawful activity;
• establishing, exercising or defending legal claims;
• managing and improving our website, systems and services;
• maintaining the security of our information systems;
• keeping appropriate business, accounting and professional records; and
• sending professional updates or communications where permitted by law.

We will not ordinarily use personal data for purposes materially incompatible with the purpose for which it was collected unless permitted or required by law.

6. Legal Basis for Processing

Depending on the circumstances, we may process personal data where:

• the processing is necessary to enter into or perform a contract;
• the processing is necessary for compliance with a legal obligation;
• the processing is necessary for the establishment, exercise or defence of a legal claim;
• the processing is necessary for our legitimate interests or those of a third party, where those interests do not improperly override your rights and freedoms;
• you have provided consent;
• the processing is necessary for a task carried out in the public interest or pursuant to law; or
• another lawful basis recognised under applicable law applies.

Where processing is based on consent, you may withdraw that consent, subject to applicable legal and professional limitations.

Withdrawal of consent does not affect the lawfulness of processing undertaken before the withdrawal.

7. Website Enquiries and Prospective Clients

Information submitted through a website enquiry or contact form may be transferred to the Firm's systems for purposes of responding to and managing the enquiry.

Submitting an enquiry through our website does not, by itself, create an advocate-client relationship between you and the Firm.

You should therefore avoid submitting highly confidential or sensitive information through a general website enquiry form unless reasonably necessary.

An advocate-client relationship will ordinarily arise only after the Firm has accepted instructions and any applicable engagement requirements have been satisfied.

8. Confidentiality and Legal Professional Privilege

As a law firm, we are subject to professional duties concerning confidentiality.

Information supplied to us in connection with legal services will be handled in accordance with our professional obligations and applicable law.

Nothing in this Privacy Policy is intended to waive, limit or otherwise affect legal professional privilege, advocate-client confidentiality or any other protection attaching to confidential legal communications.

9. Disclosure of Personal Data

We may disclose personal data where reasonably necessary to:

• our advocates, employees, consultants and authorised personnel;
• advocates, experts, consultants and other professional advisers engaged in a matter;
• courts, tribunals, arbitral bodies and dispute resolution institutions;
• land, company, intellectual property and other public registries;
• government departments, regulators and law-enforcement authorities where lawfully required;
• banks and payment service providers;
• information technology, website hosting, cloud storage, communication, client relationship management and other service providers;
• auditors, accountants and insurers; and
• other persons involved in a transaction or legal matter where disclosure is necessary or authorised.

We require third parties processing personal data on our behalf to handle that information appropriately and in accordance with applicable data protection requirements.

We do not sell personal data.

10. Third-Party Technology and Service Providers

The Firm uses third-party technology platforms and service providers to operate its business and website. These may include providers of:

• website hosting;
• cloud computing and storage;
• email and productivity services;
• client relationship management systems;
• practice and project management systems;
• accounting systems;
• website analytics;
• cybersecurity services; and
• electronic communications.

Personal data may therefore be processed using systems operated by third parties acting under contractual arrangements with the Firm or under their respective legal obligations.

11. International Transfers

Some of our technology providers or their infrastructure may be located outside Kenya.

Where personal data is transferred outside Kenya, we will take reasonable steps to ensure that the transfer is made in accordance with applicable data protection law and that appropriate safeguards for the protection of personal data are in place.

12. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

• enable essential website functionality;
• remember user preferences;
• maintain website security;
• understand website traffic and performance; and
• improve the functionality and user experience of the website.

Some cookies may be placed by third-party service providers.

Where required, you may be given an opportunity to accept, reject or manage non-essential cookies.

You may also configure your browser to refuse or delete cookies. Disabling certain cookies may affect the functionality of parts of the website.

13. Direct Marketing and Professional Updates

Where permitted by law, we may use contact information to send:

• legal updates;
• invitations;
• publications;
• Firm announcements; or
• information relating to our professional services.

Where consent is required, such communications will only be sent where the appropriate consent has been obtained.

You may request that we stop sending marketing communications at any time.

Administrative communications relating to an existing legal matter or professional engagement are not marketing communications and may continue where necessary.

14. Data Security

We take reasonable technical and organisational measures intended to protect personal data against:

• unauthorised or unlawful access;
• accidental loss;
• alteration;
• destruction;
• misuse; and
• unauthorised disclosure.

Our safeguards may include access controls, authentication mechanisms, secure information systems, backups, staff controls, confidentiality obligations and appropriate arrangements with service providers.

However, no website, email system or electronic transmission method can be guaranteed to be completely secure.

15. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to:

• statutory requirements;
• professional obligations;
• limitation periods;
• accounting and tax requirements;
• the establishment, exercise or defence of legal claims; and
• legitimate record-keeping requirements associated with legal practice.

Different categories of information may therefore be retained for different periods.

Where information is no longer required, we may securely delete, destroy or anonymise it, subject to applicable law.

16. Your Rights

Subject to applicable law and any lawful exemptions or restrictions, you may have the right to:

• be informed about how your personal data is being used;
• request access to personal data held about you;
• request correction of inaccurate or misleading information;
• request deletion or erasure of personal data in appropriate circumstances;
• object to certain processing;
• request restriction of processing;
• request portability of personal data where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint concerning the processing of your personal data.

These rights may be subject to restrictions where, for example, processing is necessary to comply with law, preserve legal professional privilege, protect the rights of another person, or establish, exercise or defend a legal claim.

We may request reasonable information to verify your identity before acting upon a request.

17. Complaints

If you have a concern regarding the manner in which we process your personal data, we encourage you to contact us first so that we may address the matter.

You also have the right, where applicable, to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

18. Children's Personal Data

Our website and legal services are not generally directed at children.

Where the Firm is required to process personal data relating to a child in connection with a legal matter, we will process such information in accordance with applicable law and any heightened protections applicable to children's personal data.

19. Third-Party Websites

Our website may contain links to websites operated by third parties.

The Firm does not control the privacy practices of third-party websites. This Privacy Policy does not apply to information collected independently by those third parties.

You should review the applicable privacy policy of any third-party website that you visit.

20. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time to reflect:

• changes in law or regulatory requirements;
• changes in our services;
• changes in our technology or information systems; or
• improvements to our data protection practices.

The latest version will be published on our website together with its effective or revision date.

21. Contact Us

For questions concerning this Privacy Policy, the exercise of data-subject rights, or the Firm's processing of personal data, please contact:

A. Mukasa & Company Advocates

Nairobi, Kenya

Email:info@amcadvocates.com

Telephone: 0795 070 434

Where appropriate, please mark your correspondence “Data Protection / Privacy Request.”