Privacy Policy
Effective date: 29 September 2026
Gallant Law & Associates ("GLA," "we," "us") is committed to protecting personal data in accordance with Kenya's Data Protection Act, 2019 ("DPA") and applicable regulations and guidance from the Office of the Data Protection Commissioner ("ODPC").
1. Data we collect
When you submit an enquiry or book a consultation, we may collect your name, email address, phone number where supplied, client context, preferred reply channel, organisation name where applicable, selected practice area, a brief description of your matter, and the appointment information you provide to Cal.com.
If you consent to anonymous analytics, we also retain a short, sanitised source label (for example, Google or LinkedIn) and a random session journey identifier. These values do not contain your name, email address, phone number, requested appointment time or free-text matter details. They remain blank when analytics consent has not been granted.
2. Why we use the data
We use enquiry and booking information to respond, assess whether and how we can assist, manage appointments and provide legal services if you engage us. We use anonymous analytics only to understand website use and conversion paths. We use your email for legal updates only where you separately request marketing communications and complete Brevo's double-opt-in step.
3. Privacy choices and lawful basis
Essential storage records your privacy choice and supports the action you request. Optional analytics and the embedded Cal.com calendar are disabled until you consent. You can accept all optional services, choose them individually, use essential functions only, or later change your choice through the Privacy choices button in the footer.
We rely on your consent for optional analytics, external booking content and marketing communications. We process enquiry and engagement information to take steps at your request and, where you become a client, to perform the resulting professional-services contract and meet applicable legal and professional obligations.
4. Cookies and browser storage
The site does not use advertising cookies or cross-site advertising trackers. A necessary local-storage record keeps your privacy choices. Only after analytics consent is granted does session storage hold the random journey identifier and sanitised source label for the current browser session. Withdrawing analytics consent removes those session values and stops new analytics events. Cal.com may use its own cookies or browser storage after you permit the external calendar or open its site directly.
5. Analytics and attribution
When enabled, privacy-conscious analytics records page paths and named events such as consultation-button selections, calendar readiness and successful enquiries. Event payloads exclude names, email addresses, phone numbers, appointment times and free-text legal-matter details. Attribution is first-party, session-limited and used for aggregate conversion analysis; it is not used to build advertising profiles or track you across unrelated websites.
6. Service providers and international transfers
Formspree processes enquiry submissions; Cal.com processes online bookings after you permit the calendar or visit Cal.com; Brevo processes double-opt-in marketing subscriptions; WhatsApp/Meta processes WhatsApp messages; and Manus Analytics processes consented anonymous events. These providers may process data outside Kenya. We take reasonable steps to use appropriate processors and safeguards, and we do not sell or rent personal data. Website fonts are hosted with the website and do not require a connection to Google Fonts.
7. Retention
Personal data submitted through the website is retained for up to 5 years from submission, subject to periodic review and any longer period required by law, professional obligations, dispute management or an active client relationship. Consent choices remain until you change them or until the consent version is renewed. Session attribution ends when the browser session ends or when you withdraw analytics consent.
8. Your rights
Subject to applicable limitations, you may ask to access, correct, delete, restrict or object to processing of your personal data, withdraw consent without affecting earlier lawful processing, and complain to the ODPC. Contact info@gallantlawke.com.
9. Data protection contact
Susan Musyoka, Managing Partner and PECB Certified Data Protection Specialist, is the firm's data-protection contact. Email info@gallantlawke.com with a privacy question or rights request.
10. Security and confidentiality
We use reasonable technical and organisational measures to protect personal data. Do not send urgent deadlines, original documents or highly sensitive information through the initial website form. Submission does not by itself create a lawyer–client relationship.
11. Changes to this notice
We may update this notice when the website, law or service-provider arrangements change. The effective date above shows the latest revision.