Privacy Policy

1. Who we are

Pepe Advisory Limited (company registration number PVT-MA15L9JB) is the data controller for personal data collected through this website. Our office is at Crescent Business Center, 3rd Floor, Parklands, Nairobi, Kenya.

This policy explains what we collect, why, and what you can do about it. It is written to meet our obligations under the Data Protection Act, 2019.

2. What this policy covers

This policy covers personal data collected through this website: principally what you enter in the consultation request form, together with the records our web server keeps.

It does not cover personal data we handle once we act for a client. That is governed by the engagement letter and by the confidentiality obligations we owe our clients.

3. What we collect

When you submit a consultation request we collect:

• your name
• your organisation, if you give one
• your email address
• your telephone number, if you give one
• the service you select
• your preferred consultation date, if you give one
• your description of the matter

We also record the page you submitted the form from, and the date and time of submission.

Your description of the matter is free text and you decide what goes into it. Please keep it to what we need in order to tell you whether we can help. Do not include personal data about other people, confidential documents, or detailed commercial information at this stage.

We do not ask for financial account details, payment card numbers, or identity document numbers anywhere on this website, and you should not enter them.

4. Records kept by our web server

Our hosting provider records the IP address, browser type, and the date and time of requests made to this site, as web servers ordinarily do. The consultation form is also rate limited by IP address to prevent automated abuse; the counter that does this holds your IP address for one hour and then expires automatically.

These records exist to keep the site running and secure. They are not used to build a profile of you.

5. Cookies and similar technologies

This website sets no cookies. It uses no analytics, no advertising and no cross-site tracking, and it stores nothing in your browser. There is no consent banner because there is nothing to consent to.

If we introduce analytics we will update this policy before doing so, and we will ask for your consent before setting any cookie that is not strictly necessary.

Typefaces are served from this website itself. No fonts, scripts, images or other resources are loaded from any third party, so browsing this site does not disclose your IP address to anyone other than our hosting provider.

6. Why we use your personal data, and our lawful basis

We use what you send us to:

• respond to your enquiry
• assess whether we are able to act, including checking for conflicts of interest
• prepare for a consultation
• meet our professional and legal obligations

Our lawful basis under section 30 of the Data Protection Act, 2019 is that the processing is necessary in order to take steps at your request before entering into a contract. We also rely on our legitimate interest in responding to enquiries addressed to us, which we consider does not prejudice your rights and freedoms.

Where we go on to act for you, the engagement letter governs how we handle your information.

We do not use your details for marketing without asking you separately, and we do not sell personal data.

7. Who else has access

Within the firm, access is limited to those who need it in order to respond to you.

Outside the firm, personal data is processed on our behalf by:

• our hosting provider, which operates the servers this website runs on, and which also holds the short-lived copy of your enquiry described in section 10
• our email provider, which delivers your enquiry to us and holds it in our mailbox

We disclose personal data to anyone else only where you ask us to, or where we are required to do so by law or by a regulator.

8. Transfers outside Kenya

Our hosting and email providers operate outside Kenya. This means that when you submit the form, what you send is transmitted to and stored on servers outside Kenya, and remains there for the periods described in section 10.

Sections 48 and 49 of the Data Protection Act, 2019 require appropriate safeguards for transfers of this kind. We rely on the contractual and technical safeguards in our providers' terms, and we do not use providers who reserve the right to use what we send them for their own purposes.

If you would prefer not to send your information outside Kenya, telephone us on the number in section 16 instead of using the form.

9. Pepe Advisory and Clyde and Associates

Pepe Advisory Limited and Clyde and Associates LLP are related but separate firms.

Personal data you submit through this website is held by Pepe Advisory Limited. We do not pass it to Clyde and Associates LLP unless you ask us to, unless you instruct both firms, or unless we are required to.

10. How long we keep it

When you submit the form, a copy of what you send — including your IP address — is written to storage at our hosting provider before the enquiry is emailed to us. It exists so that a failure of the email service cannot lose your enquiry. It expires automatically 30 days after submission and is not kept beyond that.

The enquiry itself reaches us as an email. Where an enquiry does not lead to an engagement, we keep that email for 24 months and then delete it. We keep it for that period so that we can carry out conflict checks and recognise a returning enquirer.

Where an enquiry leads to an engagement, the record becomes part of the client file. It is then kept for seven years after the engagement ends, which is the period our client due diligence and anti-money-laundering obligations require.

Section 39 of the Data Protection Act, 2019 requires personal data to be kept no longer than is necessary for the purpose it was collected for. We review these periods against that requirement.

11. How we protect it

The website is served over HTTPS, so what you submit is encrypted in transit.

This website has no database, no administration area and no login. There is no public way to retrieve a submitted enquiry, and nothing you send is displayed anywhere on the site. The temporary copy described in section 10 can be reached only by those with administrative access to our hosting account.

Once the enquiry reaches us it is an email, and access to it is limited to those within the firm who need it in order to respond to you.

No system is completely secure, and email in particular is not. That is a further reason to keep your first message brief.

12. Your rights

Under section 26 of the Data Protection Act, 2019 you have the right:

• to be informed of how your personal data is being used
• to access the personal data we hold about you
• to have inaccurate or misleading data corrected
• to have your data deleted, in the circumstances the Act allows
• to object to processing, including processing for marketing
• to withdraw consent, where consent is the basis we rely on

To exercise any of these rights, write to us at the address in section 16. We will respond within the period the Act allows, and we may ask you to confirm your identity before we act on a request.

These rights have limits. Where we are required to keep a record in order to meet a professional, regulatory or statutory obligation, we will tell you that rather than delete it.

13. Complaints

If you are not satisfied with how we have handled your personal data, please tell us first, so that we have the opportunity to put it right.

You also have the right to complain to the Office of the Data Protection Commissioner.

14. Children

This website is intended for businesses, investors, family enterprises and private clients. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of eighteen. If you believe a child has submitted information through this website, contact us and we will delete it.

15. Changes to this policy

We may update this policy. Any change is published on this page and applies from the effective date shown. Where a change is significant we will say what has changed.

16. How to contact us

For any question about this policy, or to exercise any of your rights:

• Pepe Advisory Limited, Crescent Business Center, 3rd Floor, Parklands, Nairobi, Kenya
• advisory@pepeadvisory.com
• +254 114 000 333

Effective 20/09/2026