Effective Date: 1 July 2026
Last Updated: 1 July 2026
1. Introduction
Simiyu & Partners Advocates LLP (“S&P Advocates“, “we”, “us”, or “our”) is committed to protecting the privacy and confidentiality of all personal information we collect, use, and store. This Privacy Policy explains how we handle personal data collected through our website at www.spadvocates.co.ke (“the Website”) and through our professional engagement with clients, prospective clients, and other individuals.
We are a limited liability partnership registered under the laws of Kenya. Our principal place of business is Branton Court, Unit A4, Ndemi Lane, Off Ngong Road, Nairobi, Kenya.
By using our Website or submitting an enquiry through our contact form, you acknowledge that you have read and understood this Privacy Policy.
2. The Law That Governs Us
This Privacy Policy is prepared in compliance with the Data Protection Act, No. 24 of 2019 (Kenya) and the Data Protection (General) Regulations, 2021. We are registered as a data controller with the Office of the Data Protection Commissioner of Kenya.
3. What Personal Data We Collect
We collect personal data in the following ways:
3.1 Information You Provide Directly
When you submit an enquiry through our contact form, we collect:
- Full name
- Email address
- Phone number
- Organisation name (where provided)
- Subject of enquiry
- Area of legal interest
- How you found us
- The content of your message
When you apply for a position at the firm, we collect:
- Full name and contact details
- CV, academic transcripts, and covering letter
- Professional qualifications and memberships
- References (where provided)
3.2 Information Collected Automatically
When you visit our Website, we automatically collect certain technical information including:
- IP address and browser type
- Pages visited and time spent on each page
- Referring website or search query
- Device type and operating system
- Cookie data (see Section 8 below)
3.3 Information From Third Parties
We may receive information about you from third parties including referrers, professional directories, or public sources where this is relevant to a legal matter we are handling.
4. How We Use Your Personal Data
We use the personal data we collect for the following purposes:
To respond to your enquiry
When you contact us through the Website, we use your details to respond to your message and, where appropriate, to begin the process of establishing a professional engagement.
To provide legal services
Where an advocate-client relationship is established, we process your personal data as necessary to deliver legal advice and representation.
To manage job applications
We use application data to assess candidates for positions at the firm and to communicate with applicants throughout the recruitment process.
To improve our Website
We use anonymised technical data to understand how visitors use our Website and to improve its content and performance.
To comply with legal obligations
We process personal data where required to comply with our obligations under Kenyan law, including anti-money laundering regulations, court orders, and regulatory requirements.
To send relevant communications
With your consent, we may send you legal updates, insights articles, or other communications relevant to your interests. You may withdraw this consent at any time.
5. Legal Basis for Processing
Under the Data Protection Act, 2019, we process personal data on the following legal bases:
- Consent — where you have given us clear consent to process your data for a specific purpose
- Contract — where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract
- Legal obligation — where processing is necessary to comply with a legal obligation to which we are subject
- Legitimate interests — where processing is necessary for our legitimate interests, including the provision of legal services, the improvement of our Website, and the security of our systems, provided these interests are not overridden by your rights
6. How We Share Your Personal Data
We do not sell, rent, or trade your personal data to third parties.
We may share your personal data in the following limited circumstances:
Within the firm
Personal data is shared among advocates, paralegals, and support staff at Simiyu & Partners Advocates LLP on a need-to-know basis in connection with the matter for which you have engaged us.
Service providers
We work with trusted third-party service providers who assist us in operating our Website and delivering our services, including web hosting providers, email service providers, and IT support. These providers are contractually bound to process your data only on our instructions and in accordance with applicable data protection law.
Professional advisers & counterparties
In the course of legal proceedings or transactions, we may share relevant personal data with courts, tribunals, opposing counsel, regulatory bodies, and other professional advisers as required by the matter.
Legal & regulatory requirements
We may disclose personal data where required to do so by law, court order, or regulatory authority, including the Law Society of Kenya, the Kenya Revenue Authority, and the Anti-Money Laundering reporting framework.
With your consent
We may share your data with third parties where you have given us explicit consent to do so.
7. How Long We Keep Your Data
We retain personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and professional obligations.
Our standard retention periods are as follows:
- Client matter files — seven years from the conclusion of the matter, in line with the Limitations of Actions Act and our professional obligations
- Enquiry and contact form data — two years from the date of submission, unless an engagement is established
- Job application data — six months from the conclusion of the recruitment process for unsuccessful applicants
- Website analytics data — twelve months on a rolling basis
- Financial and accounting records — seven years in accordance with the Income Tax Act and the Companies Act
At the end of the applicable retention period, personal data is securely deleted or anonymised.
8. Cookies
Our Website uses cookies to improve your browsing experience. A cookie is a small text file placed on your device when you visit a website.
We use the following types of cookies:
Essential cookies
These are necessary for the Website to function and cannot be switched off. They are set in response to actions you take such as setting your language preference or submitting a form.
Analytics cookies
These help us understand how visitors interact with our Website by collecting anonymous information about pages visited, time spent, and referring sources. We use this data to improve the Website.
Preference cookies
These allow the Website to remember choices you have made, such as your preferred language through our translation tool.
You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website. For more information about cookies and how to manage them, visit www.allaboutcookies.org.
9. Your Rights Under the Data Protection Act, 2019
Under Kenyan data protection law, you have the following rights in relation to your personal data:
Right of access
You have the right to request a copy of the personal data we hold about you.
Right to rectification
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure
You have the right to request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal and professional obligations to retain certain data.
Right to restriction of processing
You have the right to request that we restrict the processing of your personal data in certain circumstances.
Right to data portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format where processing is based on consent or contract.
Right to object
You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis for processing.
Right to withdraw consent
Where we process your data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact us at:
privacy@spadvocates.co.ke
We will respond to all verified requests within 21 days. We may need to verify your identity before processing your request.
10. Data Security
We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- Secure server hosting with encryption in transit (SSL/TLS)
- Access controls limiting data access to authorised personnel only
- Regular software updates and security monitoring
- Confidentiality obligations binding all members of our team
No method of transmission over the internet is entirely secure. While we take every reasonable precaution, we cannot guarantee the absolute security of data transmitted to our Website.
11. International Data Transfers
Our Website and services are based in Kenya. If you access our Website from outside Kenya, your data may be transferred to and processed in Kenya. By using our Website, you consent to this transfer.
Where we transfer data outside Kenya to service providers, we ensure that appropriate safeguards are in place in accordance with the Data Protection Act, 2019.
12. Third-Party Links
Our Website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any third-party sites you visit.
13. Children
Our Website is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The updated policy will be posted on this page with a revised effective date. We encourage you to review this policy periodically.
15. Contact Us & How to Complain
If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:
Simiyu & Partners Advocates LLP
Branton Court, Unit A4, Ndemi Lane, Off Ngong Road
Nairobi, Kenya
Email: privacy@spadvocates.co.ke
Tel: +254 722 337681
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya:
Website: www.odpc.go.ke
Email: info@odpc.go.ke