Privacy Notice

Who we are

CS Advocates LLP is a limited liability partnership of advocates registered in Kenya, with its offices at The Mirage (Tower 2), 13th Floor, Waiyaki Way, Westlands, Nairobi, P.O. Box 62700-00200. For the purposes of the Data Protection Act 2019, CS Advocates LLP is the data controller for personal data collected through this website. Our data protection contact is the Managing Partner, who can be reached at [email protected] or on +254 20 80 93 000.

What this notice covers

This notice explains how we collect, use, share and retain personal data when you visit cs.legal, contact us, subscribe to our newsletter, Legal Alerts and Weekly Newsletter, or ask us to act in a matter. It should be read with our Cookie Policy and Terms of Use.

What we collect

Enquiry details: your name, email address, telephone or WhatsApp number, organisation, the subject of your enquiry, and anything you choose to tell us in a message or callback request.
Matter information: documents, correspondence and other information you give us when we are instructed.
Newsletter details: your email address and the record of your confirmation and, if applicable, unsubscribe request.
Career application details: your name, email address, telephone number, the role you are applying for, preferred practice area, any note you add, and any PDF CV or cover letter you upload.
Technical data: the pages you visit on this site, the type of device you use, and security-related data such as IP addresses in server and CDN logs. Our own statistics collector is designed not to store your IP address with usage events.

Why we use it, and our lawful basis

To respond to your enquiry and decide whether we can act: necessary to take steps at your request before a contract, and our legitimate interest in responding to prospective clients.
To provide legal services: necessary for the performance of our engagement with you.
To run and secure this website: our legitimate interest in keeping the site available, secure and useful, including abuse prevention and aggregate usage statistics.
To send our newsletter: your consent, which you can withdraw at any time.
To consider a career application: your consent, and our legitimate interest in reviewing applications from pupils holding over and associates.
To record anonymous usage statistics: your consent, recorded by the privacy banner. If you choose essential only, non-essential statistics are not recorded.
To meet professional and legal obligations: compliance with our duties as advocates, conflict and anti-money-laundering checks, court orders, and applicable tax and record-keeping law.

We do not sell personal data. We share it only where necessary, with:

Service providers who process data for us: Cloudflare, Inc. (website delivery, DNS and security), Microsoft Corporation (Microsoft 365, including our email), our website hosting provider, and Google LLC where the Contact page displays a Google Maps embed or you choose a map link. Career application files are stored privately on our own hosting and are not published.
Professional advisers and insurers: our auditors, insurers and other advisers, under duties of confidence.
Regulators, courts and authorities: the Office of the Data Protection Commissioner, the Law Society of Kenya, courts, tribunals and law enforcement, where the law requires or permits disclosure.
Other parties to a matter: counterparties, their advocates and other professionals, where necessary to act on your instructions and with your authority.

Transfers outside Kenya

Some of our service providers process data outside Kenya. Cloudflare and Microsoft operate global networks, so data may be processed in jurisdictions other than Kenya. Where a transfer is made, we rely on appropriate safeguards, including contractual data protection terms with the provider, such as standard contractual clauses where applicable, and we will give you more detail on request. Transfers are made only for the purposes described in this notice.

How long we keep it

Enquiries that do not become engagements: 12 months after our last contact, then deleted.
Client and matter records: 7 years after the matter closes, or longer where a legal obligation, a pending dispute or our professional rules require it.
Newsletter subscriptions: until you unsubscribe, then deleted, with the confirmation record kept for 30 days.
Website statistics: aggregate event records for 26 months. They are not linked to an identified person.
Server and security logs: up to 12 months.
Career applications: 12 months from receipt, then deleted, unless you ask us to remove them earlier.
Comments: until removed, or sooner on a valid erasure request.

Your rights

Under the Data Protection Act 2019 you have the right to be informed about how your data is used, to access it, to ask us to correct or erase it, to restrict or object to processing, to receive it in a portable form, to withdraw consent at any time, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. To exercise a right, email [email protected] or write to the Managing Partner at the address above. We may need to verify your identity. We respond within a reasonable period, normally within 30 days.

Complaints

If you are unhappy with how we have handled your data, please contact us first so that we can address it. You also have the right to complain to the Office of the Data Protection Commissioner: odpc.go.ke.

The privacy banner records your choice in your browser’s local storage. For statistics, the key is cs-analytics, set to on if you allow anonymous statistics and off if you choose essential only. For your display preference, the key is cs-theme. We do not use advertising cookies. To change or withdraw your choice, clear this site’s storage in your browser settings; the banner will then ask again. The Cookie Policy lists every key and the third parties involved.

Security

We use access controls, encrypted connections, and reputable infrastructure providers to protect personal data. No system is completely secure, but we review our safeguards and will notify you and the Office of the Data Protection Commissioner where a breach is likely to result in a risk to your rights.

Changes to this notice

We review this notice at least annually and update it when our processing or the law changes. The version on this page is the current one.

Last reviewed: 27 October 2026. This notice is general information about our data practices; it does not create rights beyond those in the Data Protection Act 2019 and other applicable law.