PRIVACY NOTICE

1. Introduction

WANGECHI MUGO & ASSOCIATES (“WMA Legal”, “we”, “our”, or “us”) is a law firm duly registered and operational in Kenya.

We are committed to protecting your personal data and respecting your privacy in compliance with the Data Protection Act, 2019 (the “Act”). This Privacy Notice applies to an individual who visits our website, engages our legal services or communicate with us. It explains:

what personal data is processed about you;
- why we are processing your personal data and for which purposes;
- for how long we hold your personal data;
- how to access and update your personal data;
- the options you have regarding your personal data; and
- where to go for further information.

This Privacy Notice explains how we collect, use, disclose and safeguard your personal data when you visit our website, engage our legal services, or communicate with us.

2. Data Controller

WMA Legal is the data controller of your personal data. If you have any questions or concerns regarding this Privacy Notice or your data, you may contact us at admin@wmalegal.africa .

3. Personal Data We Collect

We may collect and process the following types of personal data:

Nature of Personal Data	Specific Personal Data
Identity Information	Name National ID Passport number KRA PIN Date of birth/age Photograph Usernames
Contact Information	Phone number Email address Postal address Physical address

Financial Information	Bank details Mobile money details
Background Verification Data	Utility bills Evidence of source of funds
Technical Data	IP address Browser type Access times Device information
Communication Data	Messages Feedback sent to us via contact forms or email

4. How We Collect Your Personal Data

We may collect your personal data in the following ways:

When you fill out our website contact form or send us an email or text message.
- When you engage us to provide legal services;
- During consultations, meetings or phone calls;
- When you visit or interact with our website (automated tracking tools may be used);
- When you apply for a job by sharing your curriculum vitae and any other information attendant thereto for any job opening that we may advertise; or
- From publicly available sources or third parties such as registries and regulators.

5. Lawful Basis for Processing

We only process your personal data under any of the following legal grounds:

Your consent, where required;
- Where it is necessary to perform a contract with you or take steps at your request before entering into one;
- For our legitimate interests such as business administration and communication; or
- To comply with a legal obligation (such as KYC and anti-money laundering laws).

Where the processing is based on consent, you have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent.

In relation to any processing of sensitive personal data, we will rely on specific consent from you at the time unless there is otherwise a legal requirement for us to process such information.

6. How We Use Your Data

We may use your personal data for the following purposes:

Purpose	Lawful basis
To respond to your enquiries and provide legal advice or representation.	Contract performance Legitimate interests (to enable us to perform our obligations and provide our services to you) Consent
To prepare legal documents, filings or correspondence.	Contract performance
To comply with legal or regulatory or risk management obligations.	Legal obligation Legitimate interests
For internal record-keeping and administration.	Legitimate interests
To improve our website and services.	Legitimate interests Consent
To send legal alerts or newsletters (if you opt in).	Consent
For marketing and business development.	Consent Legitimate interests
For research and development.	Legitimate interests
For recruitment purposes.	Legitimate interests Contract performance
Use of CCTV surveillance.	Consent Legitimate interests
To re-organise or make changes to our business.	Legitimate interests.

7. Disclosure of Personal Data

We may share your personal data with:

Advocates, consultants, auditors or staff working under confidentiality agreements;
- Courts, tribunals, regulatory authorities or government agencies as required by law;
- Our insurers;
- Third-party service providers (such as IT, email or case management systems);
- Other parties with your consent or as part of a legal process.

Any third-party service providers we may engage that process personal data on our behalf are also contractually obligated to respect the confidentiality of personal data.

We may process your personal data to meet legal or regulatory requirements. This may include sharing your data with government, regulatory or law enforcement agencies

during inquiries, investigations or legal proceedings. We will notify you or forward the request to you before we respond unless it would interfere with efforts to prevent or detect a crime.

8. Third Party Contractors

As provided above, we may appoint subcontractors for data processing activities. This includes, IT systems or software providers, IT support service providers, document and information storage providers.

We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.

These subcontractors will process personal data on our behalf and at our direction. What is our legal basis?

Pursuant to our contract with you, it may be necessary for us to engage sub-contractors to support us in fulfillment of our contractual obligations or to deliver the best possible services to you.

It is in our legitimate interest to use personal data in such a way to ensure that we provide our services to you efficiently.

9. Will We Transfer Your Information Overseas?

The information that we collect from you may be transferred to and stored at a location outside Kenya. In certain cases, it may also be processed by service providers operating outside Kenya. Such service providers may be engaged in cloud data storage, IT services, processing of payments, data analytics and other services.

When we transfer your information outside Kenya, we will do so responsibly and in compliance with the data protection laws.

10. Data Retention

We retain your personal data for as long as is necessary:

To fulfill the purpose for which it was collected;
- To comply with legal, regulatory or professional obligations; and
- To defend or establish legal claims.

11. Your Data Protection Rights

Under the Act, you have the right to:

be informed of the use to which your personal data is to be put;
- access your personal data in our custody;
- object to the processing of all or part of your personal data;
- correction of false or misleading data;
- request for deletion of false or misleading data about you.
- withdraw consent to our processing of your information (to the extent such processing is based on previously obtained consent);
- data portability (moving some of your information elsewhere) in certain circumstances;
- ask us to stop or start sending you marketing messages as described below in the marketing section;
- oppose profiling and specifically profiling for marketing purposes;
- not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning or significantly affecting you, unless as permitted by applicable law.

To make any of these requests, please write to us at admin@wmalegal.africa .

We may ask for further information to identify you and ensure the personal data relates to the individual making the request. We will respond within the period set out in the Act.

12. Security of Your Data

We implement reasonable technical and organizational measures to secure your personal data from unauthorized access, disclosure, alteration or destruction.

13. Cookies and Website Usage

Our website may use cookies or similar technologies to enhance user experience and monitor usage patterns.

You may refuse to accept cookies by activating the relevant setting in your browser. You can configure your browser to block or delete cookies, and you may also have the option to opt-out of certain tracking mechanisms.

14. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be posted on this page with a revised “last updated” date.

15. Contact Us

Questions, comments and requests regarding this Privacy Notice should, unless otherwise provided, be addressed to admin@wmalegal.africa .

If you have any concerns about our use of your personal data, you also have the right to make a complaint to the Office of the Data Protection Commissioner in Kenya (ODPC).

Last Updated: 3^rd day of July 2025