This Privacy Policy explains how ELK Associates ("we," "us," or "our") collects, uses, stores, and protects personal information obtained through our website and in the course of our professional engagements. We are committed to handling your data with the care, discretion, and integrity our clients and contacts rightly expect from a legal practice.We operate in compliance with Kenya's Data Protection Act, 2019, and where applicable, align our practices with international standards including the General Data Protection Regulation (GDPR). As a law firm, we recognise that personal information, particularly information shared in connection with legal matters, demands the highest standard of protection, and we take that responsibility seriously.
This Policy applies to all individuals whose personal data we process: prospective clients, current clients, website visitors, business contacts, and members of our team. It covers data collected through our website, by email, by telephone, in person, or through any other channel through which you engage with us.We may update this Policy periodically to reflect changes in law, regulation, or our own practices. Material updates will be published on this page. We encourage you to review this Policy regularly to stay informed.
We collect personal information that you provide directly to us, information we gather automatically when you use our website, and information we obtain in the course of providing legal services.
Information you provide directly includes your name, contact details (email address, phone number, and postal address), company or organisation name, and any other information you share when contacting us, engaging our services, or subscribing to our communications.Information collected automatically through our website includes IP addresses, browser type, pages visited, and time on page, gathered through cookies and similar technologies. Please refer to our Cookies Policy for further detail.Information collected in the course of legal engagements may include identification documents, financial records, information about counterparties, and other data necessary to advise and represent you in compliance with our professional obligations.
We use your personal information for the following purposes:To provide and manage legal services, including advising, representing, and corresponding with you in connection with your matter. To respond to enquiries and communicate with you regarding our services, publications, and events. To comply with our legal and professional obligations, including anti-money laundering due diligence, conflict-of-interest checks, and regulatory reporting requirements. To improve our website and understand how visitors interact with our content. To send updates and information about relevant developments where you have consented or where we have a legitimate interest in doing so.We will not use your information for any purpose incompatible with the reason it was originally collected without your prior consent.
We retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, subject to our legal, regulatory, and professional obligations.For client matter files, we generally retain records for a minimum of seven years following the conclusion of a matter, in accordance with professional practice standards and our obligations under the Advocates Act and related regulations. Certain categories of information, including anti-money laundering records, may be subject to specific mandatory retention periods prescribed by law.Information collected through our website, such as analytics data, is retained for shorter periods appropriate to the purpose of collection.At the end of any applicable retention period, information will be securely deleted or anonymised in a manner consistent with our data protection obligations and the requirements of the Data Protection Act, 2019.
Under Kenya's Data Protection Act, 2019, you have the following rights in relation to your personal data:
The right to be informed about how your personal data is collected and used. The right of access to request a copy of the personal data we hold about you. The right to rectification of inaccurate or incomplete data. The right to erasure of your personal data in certain circumstances. The right to restrict or object to the processing of your personal data where legitimate grounds exist. The right to data portability, where applicable under law.To exercise any of these rights, please contact us using the details provided in this Policy. We will respond within the timeframes required by applicable law and without charge unless a request is manifestly unfounded or excessive.If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. These measures include secure data storage systems, access controls, encrypted communications, and staff training on data protection obligations.While we take all reasonable precautions, no method of internet transmission or electronic storage is entirely free from risk. If you believe your personal data has been compromised in connection with our services, please notify us immediately so we can act without delay.
