Confidentiality is at the heart of what we do as advocates. This notice explains how FMC Advocates collects and uses personal data, and the choices you have.
LAST UPDATED OCTOBER 2026
1. Who we are
FMC Advocates LLP ("FMC", "we", "us") is a law firm based at Kalson Towers, 1st Floor, Right Wing, The Crescent, off Parklands Road, Westlands, Nairobi, Kenya (P.O. Box 1481-00621). We decide how and why your personal data is used, so we are its data controller under the Data Protection Act, 2019. We are registered with the Office of the Data Protection Commissioner (ODPC).
If you have a question about this notice or how we use your data, email consult@fmcadvocates.com with "Data protection" in the subject line. It will go to the person responsible for data protection at the firm.
2. Who this notice covers
This notice applies to personal data about:
- people who visit our website or contact us with an enquiry;
- our clients and prospective clients, and people connected to their matters, such as directors, shareholders, beneficial owners, family members, beneficiaries, witnesses and other parties;
- people who attend our events or FMC Learning & Development training;
- people who receive our legal updates and guides;
- suppliers, referrers and other professionals we work with; and
- job and internship applicants.
Our own staff are covered by a separate internal notice.
3. What we collect
| SOURCE | EXAMPLES |
|---|---|
| From you | Your name, contact details, organisation and role; the details of your enquiry or matter; identity documents, KRA PIN and proof of address for client checks; payment details; and your preferences about our updates. |
| From our work for you | Correspondence, attendance notes, advice, documents we prepare and billing records. |
| From others | Your organisation or adviser, other advocates, courts, public registries (such as land and company registries), screening services we use for client checks, and people who refer you to us. |
| From our website | Technical data such as your IP address, browser and the pages you visit, but only through the cookies you accept. See our Cookie Policy. |
Kenyan law treats some information as sensitive personal data, including health information, marital status, family details (such as the names of your spouse, children or parents) and property details. Much of our private client, employment and property work involves this kind of information. We use it only where your matter needs it and the Act allows, for example to establish, exercise or defend legal rights.
Please do not include sensitive or confidential details in the website enquiry form. We will ask for what we need once we have confirmed that we can act for you.
4. How we use it, and why
We may only use personal data where the law gives us a reason (a "lawful basis"). The main purposes and bases are:
| PURPOSE | LAWFUL BASIS |
|---|---|
| Responding to your enquiry and checking for conflicts of interest before we act | Your consent, given on our enquiry form, and steps you ask us to take before entering into an engagement |
| Providing legal, notarial and commissioning services | Performing our engagement with you; complying with legal obligations |
| Client due diligence, anti-money laundering checks and any reports the law requires | Complying with legal obligations, including under the Proceeds of Crime and Anti-Money Laundering Act |
| Billing, accounts and recovering fees | Performing our engagement; our legitimate interests |
| Sending legal updates, guides and event invitations | Your consent, which you can withdraw at any time |
| Running events and training | Performing our agreement with you; your consent where we ask for it |
| Running, securing and improving our website and systems | Our legitimate interests; your consent for analytics cookies |
| Recruitment | Steps before entering into a contract; our legitimate interests |
| Complying with court orders and the requirements of regulators and the Law Society of Kenya | Complying with legal obligations |
| Establishing, exercising or defending legal claims | Our legitimate interests, and as the Act allows for sensitive data |
5. Legal updates and event invitations
We only add you to our mailing list if you ask us to, for example by ticking the box on our enquiry or sign-up forms. Every email we send has an unsubscribe link, or you can email us to stop. We will act on your request promptly and free of charge.
We do not sell, rent or share our mailing list. We do not use personal data of children for marketing.
6. Confidentiality and privilege
As advocates, we owe our clients a duty of confidentiality, and communications made for the purpose of legal advice are privileged. These duties apply alongside data protection law.
They can limit what we disclose. For example, if someone asks for data we hold about them in a client's matter, we may not be able to provide documents that are confidential or privileged to our client.
8. Transfers outside Kenya
Some of our service providers store data outside Kenya, and cross-border matters involve foreign counsel. We transfer personal data out of Kenya only where the Data Protection Act allows it: where there are appropriate safeguards (such as contract terms), where the destination offers adequate protection, or where the transfer is needed for your matter or you have consented. Some sensitive data needs extra safeguards, and we apply them.
You can ask us for more information about these safeguards.
9. How long we keep it
We keep personal data only as long as we need it for the purpose we collected it, or as the law requires. As a guide:
| RECORD | HOW LONG |
|---|---|
| Enquiries that do not become a matter | 12 months from our last contact |
| Client files and matter records | At least seven years after the matter closes, and longer where a later need is likely, for example for land, wills, trusts and estates |
| Wills and original documents held in safe custody | Until you, your estate or your authorised representative need them |
| Client due diligence and anti-money laundering records | At least seven years after the matter or relationship ends |
| Accounting and tax records | At least five years, as tax law requires |
| Mailing list | Until you unsubscribe. We also remove contacts who have not engaged with our updates for three years |
| Job applications | 12 months, unless you join us |
| Cookies | As set out in our Cookie Policy |
After that, we securely delete the data or anonymise it.
10. How we protect it
We use technical and organisational measures appropriate to a law firm, including access controls, multi-factor authentication, encryption, confidentiality obligations for our team and service providers, and regular training.
AI tools. We use approved AI tools to support our work, under our AI use policy. They run under contractual confidentiality and security terms, a lawyer reviews everything they produce, and we do not use them to make decisions about you. We do not put client confidential information into public AI tools.
If a breach of personal data creates a real risk of harm, we will notify the ODPC within 72 hours of becoming aware of it and tell those affected where the law requires.
11. Your rights
Under the Data Protection Act, you have the right to:
- be informed about how we use your data;
- access the personal data we hold about you;
- object to our use of your data, including at any time for marketing;
- have false or misleading data corrected or deleted;
- ask us to restrict how we use your data;
- receive your data in a portable format, where it applies;
- withdraw your consent at any time, without affecting what we did before; and
- not be subject to a decision based only on automated processing that significantly affects you. We do not make such decisions.
To use any of these rights, email consult@fmcadvocates.com with "Data protection" in the subject line. We may need to confirm your identity first. We will respond within the time the law requires, and usually free of charge. Some rights are limited by our duties of confidentiality, our legal obligations and our need to establish or defend legal claims. If so, we will explain why.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
12. Children
Our website is not intended for anyone under 18, and we do not knowingly collect children's data through it. Some matters, such as succession, guardianship and family trusts, involve information about children. In those cases we use it only for the matter, with the consent of a parent or guardian or as the law otherwise allows.
13. Changes to this notice
We review this notice regularly and will post any changes on this page. This version was last updated in October 2026.