Who we are
In shortHerman Tambo Law Advocates runs this website and is responsible for the personal data it collects. You can reach us in Nairobi by email or phone.
Herman Tambo Law Advocates (“we”, “us”) operates this website and provides legal services. Under the Kenya Data Protection Act, 2019, we act as the Data Controller for any personal data collected through this platform.
Location: Nairobi, Kenya. Contact: herman@hermantambolaw.com · +254 702 858 990.
01What personal data we collect
In shortOnly what you give us to answer and scope your matter, plus basic site usage data. We collect the minimum necessary.
We adhere to the principle of data minimisation and only collect what is necessary.
- Contact details you provide (name, email, phone, company) via forms, WhatsApp or direct phone calls.
- Matter information you choose to share to help us scope work and provide an accurate quote.
- Usage data and cookies (pages viewed, device type, referrer) used for security and analytics.
- Campaign counts when you arrive from one of our social media posts: which post it was, the platform, and whether you went on to use a free tool, tap WhatsApp or send an enquiry. This is counted anonymously with a random number that lasts only for that browser tab. It does not include your IP address, a cookie, or anything you type.
- Files you upload, only when you deliberately choose to share them through our secure intake channels.
02Why we collect it (lawful basis)
In shortWe use your data to respond, to act for you once engaged, to meet legal duties and to keep the site secure. Each use has a recognised lawful basis.
| Basis | Purpose |
|---|---|
| Pre-contract | To answer enquiries, respond and quote. |
| Contract | Processing necessary to deliver the legal work once you engage us. |
| Legal obligation | To comply with the law, for example KRA compliance or LSK/ARO record-keeping. |
| Legitimate interests | To improve site performance, analyse traffic and prevent fraud. |
04Processors and sharing
In shortWe never sell or trade your data. We share it only with the service providers we need to run the site and deliver our work.
We do not sell, rent or trade your personal data. We only share data as needed to run this site and deliver services. Trusted partners include:
- Google Workspace
- WordPress
- Calendly
05International transfers
In shortSome providers store data outside Kenya. We use reputable vendors bound by contractual safeguards consistent with the Act.
Some of our software providers store data on servers outside Kenya. We take reasonable steps to ensure appropriate safeguards exist, using reputable vendors bound by contractual terms conforming to the Data Protection Act.
06Retention
In shortEnquiries are kept for up to two years and client files for the period the profession requires. Analytics data is kept for 26 months.
| Record | Kept for |
|---|---|
| Enquiries and leads | Up to 24 months |
| Client files | Typically 7 years (LSK) |
| Analytics and campaign counts | 26 months |
07Your rights under the Act
In shortYou can ask to see, correct or delete your data, or object to how we use it. If we do not resolve it, you can complain to the ODPC.
Under the Data Protection Act, you have several fundamental rights regarding your personal information:
- Access
- Correction
- Deletion
- Objection
- Restriction
- Withdrawal of consent
To exercise your rights, email us directly. If unresolved, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
08Children
In shortThis site and our services are for adults. Tell us if a child has sent us data and we will remove it.
Our site and services are for adults. If you believe a child has provided data, contact us to remove it immediately.
09Security and breaches
In shortThe site is encrypted in transit. If a breach affects you, we will tell you and the ODPC within 72 hours.
We use technical measures including HTTPS/SSL. Breach policy: we will notify you and the ODPC within 72 hours as required by law.
10Contact us
In shortEmail us for any privacy question, access request or to withdraw consent. We will respond directly.
For privacy-related enquiries, data access requests, or to withdraw consent, email us directly.