Master Privacy & Cookie Policy

Document details

Item	Detail
Document	Master Privacy & Cookie Policy (the “Master Policy” / hub)
Joint data controllers	IVIO Advocates LLP; Rotich, Langat & Partners Advocates LLP (“RL Partners”)
Operating brand / platform	IVIO Advocates LLP
Covered internet assets	ivioadvocatesllp.co.ke; mzizi-africa.com; zerocarbonvillage.africa; wosia.co.ke (each with its own service-specific notice)
Data Protection Officer	Margaret A. Odhiambo — joint DPO for both firms — dpo@ivioadvocatesllp.co.ke
Version / status	v1.0
Effective date	13 July 2025
Next review	12 July 2026

1. Who we are

IVIO Advocates LLP and Rotich, Langat & Partners Advocates LLP (“RL Partners”) are law firms organised under the laws and bar rules of Kenya. For the processing of personal data described in this Master Policy — the provision of legal services and the operation of our shared internet assets — the two firms jointly determine the purposes and means of processing and are therefore joint data controllers under the Data Protection Act, 2019 (the “Act”).

The firms operate, and make their internet services available, under the MZIZI Africa brand and platform. Our internet assets include mzizi-africa.com, zerocarbonvillage.africa and wosia.co.ke (together, the “Internet Services”).

The joint controllers control all of the firm’s brands and internet assets — including Wosia, MZIZI Africa and Zero Carbon Village. Their respective responsibilities as joint controllers (including for responding to data-subject requests and transparency) are set out in a collaboration / joint-controller arrangement between the two firms. You may exercise your rights, and raise any query, against either firm, using the single contact point in Section 19.

2. Scope and how this policy works

This Master Policy applies to personal data we process about clients and prospective clients; the individuals whose data our clients provide to us (for example, in the course of a matter); website visitors and users of the Internet Services; job applicants; and our staff, consultants and contacts, to the extent set out here.

It is supplemented by service-specific privacy notices for each Internet Service. In particular, wosia.co.ke (our online will-making platform) processes sensitive personal data, children’s data and cross-border transfers, and is governed by its own detailed notice; this Master Policy does not replace it.

3. The personal data we collect

Depending on your relationship with us, we may process:

• Identity and contact data — name, national ID/KRA PIN where required, postal/email address, telephone.
• Client and matter data — instructions, correspondence, documents and information relating to a matter, which may include information about third parties you provide to us.
• Financial and payment data — billing details and, for purchases on our platforms, payment identifiers processed by our payment providers.
• Recruitment data — CVs, qualifications and related information from applicants.
• Technical and usage data — information collected automatically through cookies and similar technologies (Section 8).
• Sensitive (special-category) personal data — for example health, family, financial or similar information where it is necessary for a matter or a service (Section 6).

4. How we collect it

• Directly from you — when you instruct us, contact us, apply for a role, buy a product/training, or use the Internet Services.
• Automatically — through cookies and similar technologies when you use the Internet Services (Section 8).
• From third parties — for example public registries, other professional advisers, or referrers.
• Indirectly — data about other people that you give us. Where a client provides personal data about a third party (for example a beneficiary, executor, counterparty or witness), we act on the basis set out in Section 5 and, where the Act requires, we will inform that person of the collection within the period the Regulations prescribe, except where an exemption applies or where doing so would breach a duty of confidentiality (as it would, for example, with a confidential will during the maker’s lifetime).

5. The purposes and our lawful bases

We process personal data only where the Act provides a lawful basis. The main purposes and bases are:

Purpose	Lawful basis under the Act
Providing legal services and administering your matters	Performance of a contract (and steps prior to a contract); our legitimate interests in running the practice
Client intake, conflict checks and customer due diligence for AML/CFT/CPF	Compliance with a legal obligation — the Proceeds of Crime and Anti-Money Laundering Act and the LSK Legal Sector Guidelines on AML/CFT/CPF, which require risk-based due diligence. If we cannot complete these checks we may be unable to act for you
Operating, securing and improving the Internet Services	Our legitimate interests
Sales of products, training and services on our platforms, and taking payment	Performance of a contract
Recruitment	Steps prior to a contract; our legitimate interests; consent where required
Direct marketing (updates, events, publications)	Consent — opt-in; you may object or unsubscribe at any time (Section 9)
Processing sensitive (special-category) data	A specific condition under the Act — usually explicit consent, or the establishment, exercise or defence of a legal claim (Section 6)
Meeting legal, regulatory and professional obligations; establishing or defending legal claims	Legal obligation; our legitimate interests

6. Sensitive (special-category) personal data

Some matters and services necessarily involve sensitive personal data (for example health, family, financial, or similar information). We do not rely on “legitimate interests” for such data. We process it only where a specific condition under the Act applies — in most cases your explicit consent, or because processing is necessary for the establishment, exercise or defence of a legal claim, or another condition permitted by the Act. Our will-making service (wosia.co.ke) relies on explicit consent for sensitive data and sets this out in its own notice.

7. International (cross-border) transfers

Some of our processors are located outside Kenya, so your personal data may be transferred and processed abroad. Because some of that data is sensitive, we transfer it only where the Act permits — with your consent and subject to appropriate safeguards, or where another basis in the Act applies. For example, our will-making platform processes data with a hosting provider in Frankfurt, Germany, under a data-processing agreement and after obtaining the data subject’s specific transfer consent; the relevant service notice gives the detail. We will tell you, at the point it matters, where your data is going and what protects it.

8. Cookies and similar technologies

Our websites use cookies and similar technologies. We group them as:

• Strictly necessary — needed for the site to work and to keep it secure (including on log-in areas). These do not require consent.
• Non-essential — for preferences, analytics and similar. We set these only with your consent, collected through our cookie banner, and you can change or withdraw that consent at any time.

Where our banner offers “Accept” and “Reject”, your choice is recorded. You can also manage cookies through your browser. We do not use Google Analytics, and we do not permit third-party cookie providers to use personal data about users of the Internet Services for their own purposes.

9. Marketing and communications

We send marketing (updates, events, publications) only to people who have opted in. You can withdraw consent or object at any time, the right to object to direct marketing is absolute and we will act on it without exception, by using the unsubscribe link or the contact point in Section 19. Marketing uses your contact details only; we never use the content of your matter or any sensitive data for marketing.

10. Sharing and recipients

We do not sell personal data. We share it only with: our processors and service providers (hosting, email, payments, IT), who act on our instructions under written data-processing agreements; professional, regulatory or law-enforcement bodies where the law requires or permits; and others where you authorise it or it is necessary to provide a service you have requested. Our processors are bound to protect your data and to use it only as we direct.

11. Retention

We keep personal data only as long as necessary for the purposes for which it was collected, to meet our legal, regulatory and professional obligations (including limitation periods for potential claims), and in line with our retention schedule. Records that must survive to support future legal processes (for example, a will) are kept for correspondingly longer periods, as set out in the relevant service notice.

12. How we protect your data

We maintain appropriate technical and organisational measures to protect personal data, which include restricted, role-based access; encryption; secure authentication; logging of access; staff training; and contractual protections with our processors. No system is completely secure, but we work to keep our safeguards effective and to review them.

13. Your rights

Subject to the conditions and exceptions in the Act, you have the right to:

Right	We respond within
Be informed about, and access, your personal data	7 days
Have inaccurate data corrected (rectification)	14 days
Have data erased, where the Act allows	14 days
Restrict processing	14 days
Object to processing (including where we rely on legitimate interests)	14 days
Object to direct marketing	At any time, honoured without exception
Data portability	30 days

You also have rights in relation to decisions based solely on automated processing (Section 14). To exercise any right, contact us using Section 19 or make a request at mzizi-africa.com/dsar. We may need to verify your identity. There is normally no fee.

14. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where our services use rules or automation to assist (for example to help assemble a document), the output is for your and your adviser’s decision, not an automated decision about you.

15. Children

We do not knowingly collect personal data online from anyone under 18 through the Internet Services except where the service is designed to involve a child’s information as part of a lawful purpose (for example, naming a minor in a will), in which case we process only the minimum necessary, with the appropriate consent or guardian involvement, and with the additional protections the Act requires. We do not profile children.

16. Complaints

If you have a concern, please contact our DPO first (Section 19) so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya — odpc.go.ke

17. Registration

IVIO Advocates LLP and RL Partners are registered as data controllers with the Office of the Data Protection Commissioner where required.

18. Changes to this policy

We may update this Master Policy from time to time. Where a change is material, we will take reasonable steps to bring it to your attention (for example, a notice on the affected Internet Service) rather than relying on the update alone. The version and effective date are shown at the top.

19. Contact us and our DPO

Our Data Protection Officer is the single point of contact for the joint controllers on data-protection matters, including access requests, corrections and complaints:

Data Protection Officer: Margaret A. Odhiambo — joint DPO for both firms — dpo@ivioadvocatesllp.co.ke

IVIO Advocates LLP and RL Partners (Rotich, Langat & Partners Advocates LLP) share these offices:

Nairobi

Maziwa Lane, Block 1, Ground Floor
P.O. Box 3336–00100, Nairobi
+254 118 119199

Mombasa

Canon Towers II, Bandari Wing, 2nd Floor
Moi Avenue
P.O. Box 41742–80100, Mombasa

Kapsabet

Asai Complex, 1st Floor (next to Equity Bank)
Kisumu Road
P.O. Box 1315–30300, Kapsabet