Privacy Policy
Last updated: 28 September 2026
Mwaura Benedict Njuguna & Company Advocates (“MBN Law“, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This policy explains what personal data we collect through mbn-law.co.ke and in the course of our legal services, why we collect it, how we use and protect it, and the rights you have under the Data Protection Act, 2019 of Kenya (the “Act“), the Data Protection (General) Regulations, 2021, and Article 31 of the Constitution of Kenya.
1. Who we are
MBN Law is a law firm established in 2021 and is the data controller of the personal data described in this policy.
- Head office: Windsor House, Muindi Mbingu Street, 5th Floor, Suite 510, Nairobi
- Branches: Sansora Crown Apartments (Ground Floor), Nakuru; Milele Center (2nd Floor), Kitengela, Kajiado
- Email: info@mbn-law.co.ke
- Telephone: 0727 475 682 | 0708 749 832 | 0720 166 368
2. Data we collect
a) Through our website
- Contact and enquiry forms: name, email address, telephone number, type of enquiry, and the message you write.
- Appointment booking form: your contact details, preferred date and time, and the matter you want to discuss.
- Newsletter subscription: name and email address (processed through Mailchimp).
- WhatsApp chat: your phone number, name and the content of messages if you contact us through the WhatsApp button.
- Comments: where comments are enabled on our blog, we collect the details you enter in the comment form (such as name, email address and website), plus your IP address and browser user agent string, which help us detect spam.
- User accounts: if you register or log in on our website, we store the personal information you provide in your user profile.
- Technical data: IP address, browser type, device, pages visited and time spent, collected through cookies and similar technologies.
Gravatar. If you comment, an anonymised string (a hash) created from your email address may be sent to the Gravatar service to check whether you use it. Once your comment is approved, your Gravatar profile picture is visible to the public next to your comment. Gravatar’s privacy policy is at automattic.com/privacy.
Images and media. If you upload images to the website, please avoid uploading images with embedded location data (EXIF GPS), as visitors can download images and extract that data.
b) In the course of providing legal services
- Identification details, such as name, ID or passport number, KRA PIN, date of birth, address and contact details.
- Information about your matter, including documents, instructions, correspondence, and financial or property details.
- Information about opposing parties, witnesses and other third parties, where relevant to your matter.
- Payment and billing information.
c) Sensitive personal data
Some matters, such as family, criminal, employment or succession cases, may involve sensitive personal data as defined in the Act (for example health data, family details, criminal records, or ethnic or religious information). We process sensitive personal data only where you have consented, where it is necessary to establish, exercise or defend a legal claim, or where the Act otherwise permits.
3. How and why we use your data
We process personal data only where we have a lawful basis under section 30 of the Act.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and booking appointments | Your consent, and steps taken at your request before entering into a contract |
| Providing legal advice and representation | Performance of our contract (engagement) with you; establishing, exercising or defending legal claims |
| Verifying identity, conflict checks, and anti-money-laundering and other regulatory duties | Compliance with legal obligations (including the Advocates Act and the Proceeds of Crime and Anti-Money Laundering Act) |
| Billing, accounting and record keeping | Contract; legal obligation (including tax law) |
| Sending our newsletter and legal updates | Your consent, which you can withdraw at any time |
| Publishing comments, detecting spam, and managing user accounts | Your consent; our legitimate interest in keeping the site secure and free of spam |
| Operating, securing and improving our website | Our legitimate interests, and your consent for non-essential cookies |
We do not sell your personal data, and we do not use it for automated decision-making or profiling that produces legal effects about you.
4. Who we share your data with
Client information is subject to advocate-client confidentiality and legal professional privilege. We share personal data only where necessary and only with:
- Courts, tribunals, arbitrators, registries and government bodies (for example the Land Registry, Registrar of Companies, KRA) as needed for your matter.
- Other advocates, counsel, experts, valuers, surveyors, process servers and agents we instruct on your behalf.
- Our partner Urban Core Limited, only where you ask us to support a property transaction involving their services.
- Service providers acting as data processors on our instructions, such as website hosting, email, cloud storage, Mailchimp (newsletters), and messaging providers, bound by written agreements as required by the Act.
- Automated spam detection services, which may check visitor comments, and Gravatar (Automattic), which may receive a hashed form of your email address.
- Professional advisers, auditors and insurers, under a duty of confidentiality.
- If you request a password reset, your IP address is included in the reset email.
- Regulators, law enforcement or other authorities where required by law or court order.
5. Transfers outside Kenya
Some of our service providers (for example Mailchimp, email and cloud storage providers) may store or process data outside Kenya. We transfer personal data abroad only as permitted by sections 48 to 50 of the Act: where the destination has adequate data protection safeguards, where appropriate contractual safeguards are in place, or where you have consented. Sensitive personal data is processed outside Kenya only in the circumstances the Act and Regulations allow.
6. How long we keep your data
We keep personal data only as long as necessary for the purpose collected, in line with section 39 of the Act.
- Website enquiries that do not lead to an engagement: up to 12 months.
- Client files: after the matter closes, or longer where a law, court order or ongoing limitation period requires. Original documents held for safekeeping are returned to you or kept as agreed.
- Financial and billing records: as required by tax and accounting law.
- Newsletter data: until you unsubscribe.
- Comments: a comment and its metadata (such as IP address) are kept for as long as the comment remains published, so that we can recognise and automatically approve follow-up comments from you. You can ask us to delete your comment and its data at any time.
- User accounts: profile information is kept while your account is active. You can view, edit or delete your personal information at any time (except your username). Website administrators can also see and edit it.
After this period we securely delete or anonymise the data.
7. Security
We apply appropriate technical and organisational measures to protect personal data, including access controls, password protection, encryption where appropriate, secure storage of physical files, and confidentiality obligations for our staff. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the ODPC within 72 hours of becoming aware of it and will inform you without unreasonable delay, as required by section 43 of the Act.
8. Your rights
Under section 26 of the Act you have the right to:
- Be informed of how your personal data is used.
- Access the personal data we hold about you.
- Object to the processing of all or part of your personal data.
- Correct false or misleading data.
- Delete false or misleading data about you, and data we are no longer entitled to keep.
- Data portability, in the circumstances set out in section 38 of the Act.
- Withdraw consent at any time, without affecting processing already carried out lawfully.
If you have an account on this site or have left comments, you can also request an exported file of the personal data we hold about you, including data you gave us, and you can ask us to erase it. This does not cover data we must keep for administrative, legal or security purposes.
To exercise any of these rights, email our Data Protection Officer at the address in section 13. We will respond within the timelines set by the Act and Regulations (generally 30 days). We may need to verify your identity first. Some rights may be limited where we must keep data to comply with the law, to protect legal professional privilege, or to establish, exercise or defend legal claims. If so, we will explain why.
9. Cookies
Our website uses cookies and similar technologies. Essential cookies keep the site working and secure. Analytics or marketing cookies, where used, are set only with your consent. You can accept or reject non-essential cookies through the cookie banner, and you can also block or delete cookies in your browser settings, although parts of the site may then not work properly.
Specifically, our WordPress site may set the following:
- Comment cookies: if you leave a comment, you may opt in to saving your name, email address and website in cookies so you do not have to re-enter them next time. These last one year.
- Login test cookie: if you visit our login page, we set a temporary cookie to check whether your browser accepts cookies. It contains no personal data and is discarded when you close your browser.
- Login and screen option cookies: when you log in, we set cookies to save your login details and display choices. Login cookies last two days, and screen option cookies last one year. If you select “Remember Me”, your login persists for two weeks. Logging out removes the login cookies.
- Editing cookie: if you edit or publish an article, a cookie records the post ID of the article you edited. It contains no personal data and expires after one day.
10. Children
Our website is not directed at children. We process the personal data of a child (a person under 18) only where the law allows and with the consent of a parent or guardian, or where it is in the child’s best interests, for example in family or succession matters, as required by section 33 of the Act.
11. Third-party links and embedded content
Our website links to other sites, including Urban Core (urbancore.co.ke) and social media platforms. We do not control them and are not responsible for their privacy practices. Please read their policies before sharing personal data.
Articles on this site may include embedded content such as videos, images or articles from other websites. Embedded content behaves exactly as if you had visited the other website. Those sites may collect data about you, use cookies, add their own third-party tracking, and monitor your interaction with the embedded content, including if you have an account and are logged in there.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with the “last updated” date above. Where changes are significant, we will take reasonable steps to notify you.
13. Contact and complaints
For any question about this policy or your personal data, contact our Data Protection Officer:
Mwaura Benedict Njuguna & Company Advocates
Windsor House, Muindi Mbingu Street, 5th Floor, Suite 510, Nairobi
Email: info@mbn-law.co.ke
Telephone: 0727 475 682
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya: www.odpc.go.ke.