Home › Privacy Policy
FIRM · LEGAL
Privacy Policy
This Privacy Policy explains how Firm Advisory Limited collects, uses, stores, and protects personal data in connection with the FIRM website and services.
Effective Date
1 January 2025
Last Updated
August 2026
Applicable Law
Data Protection Act 2019
Data Controller
Firm Advisory Limited
Your Privacy Matters. FIRM is committed to protecting your personal data in accordance with the Kenya Data Protection Act 2019. This Policy explains what data FIRM collects, why FIRM collects it, and your rights in relation to it. Read it together with FIRM’s Terms of Service.
01 · INTRODUCTION
Introduction and Data Controller
Firm Advisory Limited (“FIRM”, “we”, “our”, or “us”) is the data controller responsible for personal data processed in connection with the FIRM website and services. FIRM is incorporated in Kenya and operates from Westlands, Nairobi.
This Privacy Policy applies to:
- Visitors to the FIRM website at firm.co.ke;
- Individuals and businesses who contact FIRM with an enquiry; and
- Clients who engage FIRM for any service.
FIRM is committed to protecting personal data in accordance with the Kenya Data Protection Act 2019 (No. 24 of 2019) (“KDPA”) and all other applicable data protection laws. References to “personal data” in this Policy mean any information that identifies or can be used to identify a natural person.
FIRM’s data controller contact details are:
Firm Advisory Limited, Westlands, Nairobi, Kenya | office@firm.co.ke
02 · DATA COLLECTION
Personal Data We Collect
2.1 Information You Provide Directly. When you use the FIRM website, submit an enquiry, or engage FIRM for a service, you may provide:
- Contact information: full name, email address, and phone number;
- Business information: company name, registration number, business activities, and structure;
- Identity documents: national identification cards, passports, or other government-issued documents required for registration and compliance services;
- Corporate information: director and shareholder names, identity documents, and shareholding details required for company registration and compliance filings;
- Financial information: payment details processed through secure third-party payment providers (FIRM does not store payment card numbers);
- Correspondence: the content of any communications you send to FIRM.
2.2 Information Collected Automatically. When you visit the FIRM website, certain information is collected automatically, including:
- IP address, browser type, and operating system;
- Pages visited, time spent on pages, and referring URLs;
- Device identifiers and usage data;
- Data collected through cookies and similar tracking technologies (see Section 9).
2.3 Information About Third Parties. In connection with certain services, such as company registration, FIRM may collect personal data about directors, shareholders, beneficial owners, and other individuals associated with a Client’s business. Clients are responsible for ensuring they have the legal basis to share such individuals’ personal data with FIRM and for informing those individuals that their data will be processed in connection with the engagement.
03 · HOW WE USE YOUR DATA
How FIRM Uses Personal Data
FIRM uses personal data for the following purposes:
- Service delivery: to provide, manage, and complete the services you have engaged FIRM for, including preparing and submitting documents to Government Authorities on your behalf;
- Communication: to communicate with you about your engagement, respond to enquiries, and provide service updates;
- Government filings: to submit required information to the Business Registration Service, Kenya Revenue Authority, Kenya Industrial Property Institute, or other relevant authorities in connection with a service engagement;
- Payment processing: to process fees for FIRM’s services through secure payment providers;
- Legal compliance: to comply with FIRM’s legal and regulatory obligations under Kenyan law, including record-keeping, anti-money laundering obligations, and tax requirements;
- Record maintenance: to maintain accurate records of services provided and client engagements;
- Service improvement: to analyse website usage and improve the quality and delivery of FIRM’s services;
- Marketing: to send information about FIRM’s services, where you have consented to receive such communications. You may withdraw this consent at any time.
FIRM does not use personal data for automated decision-making that produces legal or similarly significant effects without human review.
04 · LEGAL BASIS
Legal Basis for Processing
Under the Kenya Data Protection Act 2019, FIRM processes personal data on the following legal bases:
- Performance of a contract: where processing is necessary to provide services you have engaged FIRM for or to take steps at your request prior to entering into an engagement;
- Legal obligation: where processing is required to comply with a legal obligation under Kenyan law, including anti-money laundering requirements, tax obligations, and statutory record-keeping;
- Legitimate interests: where FIRM has a legitimate interest in processing personal data, such as improving services, responding to enquiries, preventing fraud, and maintaining business records, and that interest is not overridden by your rights and interests;
- Consent: where you have provided express consent for a specific purpose, such as receiving marketing communications about FIRM’s services. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Where FIRM relies on legitimate interests as the legal basis, those interests are: delivering and improving corporate services, operating the FIRM website, communicating with enquirers and clients, maintaining business records, and preventing fraud and unlawful use of FIRM’s services.
05 · DATA SHARING
Sharing Personal Data
FIRM does not sell personal data to third parties. FIRM shares personal data only in the following circumstances:
- Government Authorities: FIRM shares personal data with the Business Registration Service, Kenya Revenue Authority, Kenya Industrial Property Institute, and other relevant Government Authorities where required to deliver a service. Such sharing is inherent to the service engaged and takes place on the basis of contract performance and legal obligation;
- Payment processors: FIRM uses secure third-party payment processors to process service fees. These providers process payment information under their own privacy policies and contractual data protection obligations;
- Technology service providers: FIRM may use third-party technology providers for website hosting, email, and document management. These providers are contractually required to process data only on FIRM’s instructions and in accordance with applicable data protection law;
- Professional advisors: FIRM may share information with professional advisors (such as lawyers or accountants) in connection with a specific engagement, under applicable confidentiality obligations;
- Legal requirements: FIRM may disclose personal data where required by law, court order, or a lawful request from a Government Authority or law enforcement body;
- Business transfers: in the event of a merger, acquisition, or transfer of FIRM’s business or assets, personal data held by FIRM may be transferred to the successor entity, subject to applicable data protection obligations.
06 · DATA RETENTION
How Long FIRM Retains Your Data
FIRM retains personal data only for as long as necessary for the purposes for which it was collected, subject to any legal obligations to retain it for longer. FIRM’s general retention periods are as follows:
- Active client engagement records: retained for the duration of the engagement and for a minimum of 7 years following completion, in accordance with Kenyan statutory record-keeping requirements under the Companies Act 2015 and the Tax Procedures Act 2015;
- Identity documents: retained for the period required by applicable anti-money laundering regulations and no longer than necessary;
- Website enquiries where no engagement proceeds: retained for up to 2 years;
- Marketing consent records: retained until consent is withdrawn plus 1 year to demonstrate compliance;
- Website usage data: retained for up to 26 months in aggregate or anonymised form.
Where personal data is no longer required, FIRM will securely delete or irreversibly anonymise it. Where data forms part of a Government filing, the copies held by FIRM are deleted in accordance with the above periods; data held by Government Authorities is subject to those authorities’ own retention practices.
07 · YOUR RIGHTS
Your Data Protection Rights
Under the Kenya Data Protection Act 2019, you have the following rights in relation to your personal data held by FIRM:
- Right of access: to request a copy of the personal data FIRM holds about you, together with information about how it is being processed;
- Right to rectification: to request that FIRM corrects inaccurate or incomplete personal data without undue delay;
- Right to erasure: to request deletion of your personal data where FIRM no longer has a lawful basis for retaining it, subject to FIRM’s legal obligations to retain certain data;
- Right to restriction of processing: to request that FIRM restricts processing of your personal data in certain circumstances, such as where you contest its accuracy or where processing is unlawful;
- Right to data portability: to receive personal data you have provided to FIRM in a structured, commonly used, and machine-readable format where processing is based on consent or contract;
- Right to object: to object to processing of your personal data where FIRM relies on legitimate interests as the legal basis;
- Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, submit a written request to FIRM at office@firm.co.ke. FIRM will respond within the timeframe required by the KDPA. FIRM may need to verify your identity before processing a request.
If you are not satisfied with FIRM’s response to any data protection matter, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
08 · COOKIES
Cookies and Tracking Technologies
8.1 What Are Cookies. Cookies are small text files stored on your device when you visit a website. They allow the website to recognise your device and remember information about your visit.
8.2 Cookies FIRM Uses. The FIRM website uses the following categories of cookies:
- Essential cookies: strictly necessary for the website to function. These cannot be disabled without affecting the operation of the website;
- Analytics cookies: used to collect information about how visitors use the website, including pages visited and time spent, to help FIRM improve the website. Data collected is aggregated and anonymised where possible;
- Preference cookies: used to remember your settings and preferences to improve your experience on return visits.
8.3 Managing Cookies. You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Refusing or deleting certain cookies may affect the functionality of the FIRM website.
8.4 Third-Party Cookies. The FIRM website may use analytics tools (such as Google Analytics) that set their own cookies. These tools collect usage data in accordance with their own privacy policies. FIRM uses this data only in aggregate form to understand website usage patterns.
09 · SECURITY
Security of Personal Data
FIRM takes the security of personal data seriously and implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include:
- Encrypted communication channels for transmitting sensitive personal data;
- Access controls limiting access to personal data to authorised personnel with a legitimate need;
- Secure storage and handling of identity documents and sensitive client information;
- Use of reputable, security-certified third-party technology providers.
No method of electronic transmission or storage is completely secure. While FIRM takes the protection of personal data seriously and applies reasonable security measures, FIRM cannot guarantee absolute security against all possible threats. In the event of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, FIRM will notify the Office of the Data Protection Commissioner and affected individuals in accordance with the obligations under the KDPA.
10 · THIRD-PARTY LINKS
Third-Party Websites
The FIRM website may contain links to third-party websites, including Government Authority websites such as the eCitizen portal, the KRA website, and the KIPI website. These links are provided for the convenience of users and for reference purposes.
FIRM is not responsible for the privacy practices, content, accuracy, or security of any third-party website. FIRM’s Privacy Policy does not apply to third-party websites. FIRM recommends that you review the privacy policy of any website you visit before submitting personal data.
Links to third-party websites do not constitute an endorsement by FIRM of those websites or their operators.
11 · CHILDREN
Children's Privacy
FIRM’s website and services are intended for business use by adults. FIRM does not knowingly collect or process personal data from individuals under the age of 18.
If you have reason to believe that FIRM has inadvertently collected personal data from a person under the age of 18, please contact FIRM at office@firm.co.ke and FIRM will take prompt steps to delete that data.
12 · INTERNATIONAL TRANSFERS
International Data Transfers
FIRM primarily processes personal data within Kenya. In certain circumstances, personal data may be processed by technology service providers or professional advisors located outside Kenya.
Where personal data is transferred outside Kenya, FIRM ensures that such transfers are subject to appropriate safeguards in accordance with the Kenya Data Protection Act 2019, including use of service providers who are contractually bound to process data to an equivalent standard of protection, or where transfer is necessary for the performance of a contract you have engaged FIRM to fulfil.
13 · CHANGES
Changes to This Privacy Policy
FIRM may update this Privacy Policy at any time to reflect changes in FIRM’s data processing practices, changes in applicable law, or improvements to FIRM’s services.
The current version of this Privacy Policy is always available at firm.co.ke/privacy-policy/. The “Last Updated” date at the top of this page indicates when the Policy was most recently revised.
Where changes are material, FIRM will notify active clients by email to the address associated with their engagement. Continued use of the FIRM website or services following notification of material changes constitutes acceptance of the updated Policy.
14 · CONTACT
Data Controller Contact
For any privacy-related enquiries, requests to exercise your rights under the Kenya Data Protection Act 2019, or data protection complaints, contact FIRM at:
Firm Advisory Limited
Westlands, Nairobi, Kenya
office@firm.co.ke
firm.co.ke
If you are not satisfied with FIRM’s response, you may contact the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.
Also read: FIRM Terms of Service