Privacy policy

Last updated: 22 October 2026

1. Who we are

Korir Ng'eno Advocates LLP ("KNA", "we", "us") of First Floor, Sagaas Building, Eldoret, Kenya is the data controller for personal data collected through this website. Contact us about privacy at info@kna.co.ke or +254 706 821 042.

2. What we collect

• Enquiry and consultation forms: your name, e-mail address, phone number, area of law, preferred appointment details and the message you write.
• Security information: a one-way coded version (hash) of your IP address, used to stop spam and abuse. We do not store your raw IP address with your message.
• Downloads: we count how many times each document is downloaded. We do not record who downloaded it.

We do not use advertising or tracking cookies, and we do not sell personal data.

3. Why we use it (lawful basis)

• To respond to your enquiry or arrange a consultation - with your consent, which you give on the form, and to take steps at your request before any engagement.
• To keep the website secure and prevent abuse - our legitimate interest in protecting our systems.
• To meet our legal and professional obligations as advocates.

4. Who we share it with

Only with the service providers that run this website and our e-mail (hosting, e-mail delivery and Cloudflare security services), under contracts that require them to protect it. Cloudflare may process technical data such as your IP address to protect the site from attacks. We do not otherwise share your data unless the law requires it.

5. How long we keep it

Website messages that do not lead to an engagement are deleted after 12 months. If you become a client, your information is kept as part of your client file for the period required by law and professional rules.

6. How we protect it

The website uses encrypted connections (HTTPS). Messages are stored in a secured database that only authorised staff can access after two-step sign-in, and every access is logged.

7. Your rights

Under the Data Protection Act, 2019 you have the right to be informed, to access your data, to object to its use, to have inaccurate data corrected and to have data deleted where the law allows. To exercise these rights, contact us using the details above. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Changes

We will post any changes to this policy on this page with a new date.