# Legal Information
Privacy Policy
Accessibility
ACA LLP is committed to safeguarding your privacy. This Privacy Policy outlines how we collect, use, and protect your personal data, and your rights in relation to this data. For more information on our professional confidentiality obligations, please refer to our Terms of Engagement. You may also wish to review our Cookie Policy for details on how we use cookies and web tracking on our website: www.abujalaw.com.
1. Who is responsible for your personal data?
ACA LLP, a law firm registered and operating under the laws of Kenya with its principal office at [insert office address], is the data controller of your personal data. Depending on your interaction with us, different members of ACA LLP may be responsible for handling your data, particularly the lawyer or team providing you with legal services.
2. What personal data do we collect?
We may collect and process the following categories of personal data:
- Contact Details: Name, address, email address, phone number, organization, job title.
- Identification Information: ID/passport number, date of birth, nationality, KRA PIN.
- Billing and Payment Information: Bank details, billing addresses, payment history.
- Professional and Legal Data: Case files, instructions, transaction history, contracts, or documentation provided in legal matters.
- Website Usage Data: IP address, browser type, browsing behavior on our website.
- Event Attendance: Dietary preferences or accessibility requirements if you attend our events.
- Special Categories (where applicable): Health or biometric data, criminal records—processed only where legally permissible and with your consent.
3. How we collect your personal data
We collect personal data through the following means:
-
Directly from you when you communicate with us or engage our services.
-
Through our website, contact forms, newsletters, and client onboarding processes.
-
From third parties such as regulatory bodies, public records, or referring professionals.
-
Via cookies or analytics when you visit our website.
4. Are you required to provide personal data?
Providing your personal data is generally voluntary. However, in some cases, it may be necessary for us to process your data to:
-
Enter into a contractual relationship.
-
Fulfill legal or regulatory obligations.
-
Provide access to our services or platforms.
Without certain personal data, we may be unable to offer our services or respond to your inquiries.
5. Why we use your personal data (Permitted Purposes)
We process personal data for the following purposes:
-
To deliver legal and advisory services.
-
To manage our client relationships, including billing and administration.
-
To comply with legal and regulatory obligations, including anti-money laundering (AML) and know-your-client (KYC) requirements.
-
To protect our IT infrastructure, maintain website security, and prevent fraud or cyber threats.
-
To manage events and seminars, or respond to your inquiries.
-
To carry out internal audits, improve service delivery, and monitor compliance with our professional standards.
We may also use your data (with your consent where required) for marketing communication, newsletters, or legal updates. You may opt-out of these communications at any time.
6. Legal basis for processing
We rely on the following legal grounds:
-
Performance of a contract – when we provide legal services.
-
Legal obligation – to comply with AML, tax, and professional obligations.
-
Legitimate interests – such as managing and developing our business.
-
Consent – where you’ve agreed to marketing or special category data processing.
7. Sharing your personal data
We may share your data with:
-
Law enforcement, regulatory bodies, or courts if legally required.
-
Third-party service providers (e.g., IT support, document storage, payment processors) under confidentiality agreements.
-
Advocates, consultants, barristers, or experts engaged in your matter.
-
Other firms or legal entities where required to provide cross-jurisdictional legal services.
-
Auditors and insurance providers for compliance and risk management purposes.
We will never sell your data to third parties.
8. Security of your personal data
We implement robust physical, technical, and organizational safeguards to ensure your personal data is protected from unauthorized access, loss, or misuse. All data shared with third parties is done under strict confidentiality obligations.
9. International data transfers
If your legal matter or data handling requires it, we may transfer your personal data to countries outside Kenya. Where this is the case, we ensure adequate protection mechanisms are in place, such as contractual safeguards or equivalent data protection measures.
10. Your rights
You have the following rights under data protection laws (where applicable):
-
Access your personal data.
-
Request correction or deletion of inaccurate or outdated data.
-
Withdraw consent (where processing is based on consent).
-
Object to or restrict processing under certain conditions.
-
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
To exercise these rights, contact us at:
Email: info@abujalaw.com
Phone: +254 (0) 782092216
11. Retention of data
We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the duration of your engagement with us, and thereafter for legal, regulatory, or professional retention requirements.
12. Updates to this policy
We may update this Privacy Policy from time to time. The most current version will be available on our website at www.abujalaw.com, and we encourage you to review it periodically.
Partner with a Team That Understands Your Industry
Whether you're launching a new project, navigating regulatory frameworks, or resolving legal challenges, our experienced team is here to help. With deep expertise across diverse industries, we provide practical, strategic, and results-driven legal solutions. Let’s talk about how we can support your success.
