1. Firm Commitment & Legal Scope
LexKen EMS Law LLP (“LexKen”, “the Firm”, “we”, “our”, or “us”) is a premier law partnership registered under the Limited Liability Partnerships Act (Cap 30A, Laws of Kenya), with principal chambers on the 19th Floor, Global Trade Centre (GTC), Westlands Road, Nairobi, Kenya.
We operate as an official Data Controller and Data Processor registered with the Office of the Data Protection Commissioner of Kenya (Registration Certificate No. ODPC/CR/2024/0912). We are committed to upholding the highest standards of confidentiality, professional legal privilege, and rigorous data protection in full compliance with the Kenya Data Protection Act, No. 24 of 2019, the Data Protection (General) Regulations 2021, and internationally recognized benchmarks including the EU General Data Protection Regulation (GDPR) where cross-border instructions apply.
This Privacy Notice governs all personal data collected in the course of client intake, retainer engagements, dispute resolution, conveyancing, corporate transactions, public briefing subscriptions, and user interaction with our digital platforms (including the LexKen Client Portal and Case MX management system).
2. Categories of Personal Data We Process
In order to render professional legal counsel, verify client identity, and comply with the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA 2009), we collect and process the following categories of information:
| Category | Information Collected | Lawful Basis / Purpose | Retention Period |
|---|---|---|---|
| Identity & KYC Data | Full legal name, national identity card or passport number, KRA PIN, company registration documents, and beneficial ownership filings. | Statutory obligation (POCAMLA 2009 & Advocates Act); Client onboarding & conflict check. | 7 years following conclusion of matter or retainer termination. |
| Client Matter Records | Pleadings, witness statements, commercial agreements, title deeds, financial accounts, and correspondence. | Performance of legal retainer contract; Exercise or defense of legal claims. | 7 to 12 years in line with Law Society of Kenya record retention canons. |
| Portal Credentials & Security | Encrypted passwords, multi-factor authentication (TOTP/SMS), session logs, and IP addresses. | Legitimate interest in maintaining cryptographic integrity of confidential court files. | Duration of active account + 90 days audit archive. |
| Billing & Payment Records | Invoicing details, bank confirmation slips, fee notes, disbursements, and transaction references. | Statutory tax compliance (KRA) and contract execution. | 7 years pursuant to Tax Procedures Act 2015. |
| Public Communications & Subscriptions | Email address, organization, practice area interests, and publication feedback. | Express opt-in consent; easily revokable at any time. | Until unsubscription or 24 months of inactive readership. |
3. How Personal Data Is Collected
We acquire information through several primary channels:
- Direct Submissions: Information provided during consultations, onboarding questionnaires, matter intake forms, and document upload via our secure client portal.
- Third-Party Authorities & Public Registries: Official records extracted from the Business Registration Service (BRS), Ardhi House Land Information System (Ardhisasa), the National Transport and Safety Authority (NTSA), or the Judiciary of Kenya Case Tracking System (CTS).
- Automated Digital Technologies: Strictly necessary telemetry, session cookies, and security telemetry collected when you navigate
lexkenems.com.
4. Information Sharing & Cross-Border Data Transfers
LexKen EMS Law LLP will never sell, lease, commercialize, or trade personal data to third parties.
We disclose personal data strictly on a need-to-know basis under binding confidentiality and data processing covenants to:
- Courts, Tribunals & Regulatory Bodies: High Court of Kenya, Court of Appeal, Supreme Court, tax appeals tribunals, arbitration centers, and statutory regulators when mandated by civil procedure or subpoena.
- External Legal Counsel & Experts: Instructed Senior Counsel, forensic accountants, land surveyors, and medical specialists engaged specifically for your matter.
- Audited Technical Infrastructure Providers: ISO/IEC 27001-certified hosting partners executing encrypted document storage within high-security data centers.
Whenever personal data is transferred outside Kenya (e.g. for multinational transactions or international arbitration in London, Singapore, or the DIFC), we ensure compliance with Section 48 and 49 of the Kenya Data Protection Act 2019, securing adequate data protection safeguards or standard contractual clauses.
5. Data Subject Rights & Recourse
Pursuant to Part IV of the Kenya Data Protection Act 2019, every client and website visitor possesses enforceable legal rights regarding their personal data:
Right to be Informed (Section 26)
You are entitled to clear, transparent disclosure regarding the purpose, legal basis, and recipients of your personal data before it is gathered.
Right of Access (Section 26 & 27)
You may request a verified copy of all personal records we maintain about you, free of charge, within 21 days of submitting a Data Subject Access Request (DSAR).
Right to Rectification & Correction
You may request the immediate correction of misleading, incomplete, or outdated personal particulars held in our registry.
Right to Erasure / Right to be Forgotten
You may request destruction of your data where it is no longer required, subject to our statutory retention duties under POCAMLA, the Advocates Act, and limitation of actions statutes.
Right to Object & Restrict Processing
You may object to processing for marketing or non-essential purposes. Any objection will be addressed by our Data Protection Officer within 14 calendar days.
Right to Data Portability
You may obtain your personal files in a structured, commonly used, machine-readable format (e.g., encrypted JSON or standardized PDF archive).
6. Cryptographic Security & Safeguards
The confidentiality of legal counsel demands institutional-grade security. Our infrastructure enforces:
- End-to-End & In-Transit Encryption: TLS 1.3 encryption across all public endpoints and AES-256 encryption at rest for documents and database volumes.
- Role-Based Access Control (RBAC): Matter confidentiality rings ensuring only assigned advocates and legal assistants can inspect client files.
- Tamper-Proof Audit Logging: Continuous chronological telemetry of document views, modifications, and downloads.
- Incident Response SLA: Suspected security anomalies trigger our rapid response protocol with preliminary containment within 15 minutes and statutory notice to the ODPC within 72 hours.
7. Contact the Data Protection Officer (DPO)
For any queries regarding this policy, to exercise your data rights, or to submit a complaint, please reach our designated Data Protection Officer:
Office of the Data Protection Officer
LexKen EMS Law LLP
19th Floor, Global Trade Centre (GTC), Westlands Road
P.O. Box 48201 - 00100, Nairobi, Kenya
Direct Email: [email protected]
Telephone: +254 142 222 000 / +254 142 222 111
If you remain unsatisfied after engaging our DPO, you retain the statutory right to lodge an appeal with the Office of the Data Protection Commissioner of Kenya at www.odpc.go.ke.