Global Sites LimitedGlobal Sites LimitedGlobal Wakili · Legal Enterprise Back to main site

Privacy Policy

Effective date: 3 June 2026 | Last updated: 3 June 2026

Global Wakili Limited ("we", "us", "our") is committed to protecting your privacy and the confidentiality of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in accordance with the Kenya Data Protection Act 2019(KDPA), the EU General Data Protection Regulation (GDPR) where applicable, and other relevant legislation.

1. Data We Collect

1.1 Account and Identity Data

  • Name, email address, phone number
  • Role and permissions within your firm
  • Authentication credentials (passwords stored as bcrypt hashes — never in plain text)
  • National ID / KRA PIN (where provided for tax compliance)

1.2 Firm and Client Data

  • Law firm details: name, KRA PIN, eTIMS ID, address
  • Client records: names, contact information, matter details
  • Financial data: invoices, payments, trust account balances, journal entries
  • Documents: legal documents uploaded to the platform

1.3 Usage Data

  • Login timestamps, IP addresses, device information
  • Feature usage patterns (aggregated, anonymized)
  • API request logs (retained for 90 days)

1.4 Integration Data

  • M-PESA transaction references (not card numbers or PINs)
  • eTIMS submission records and KRA control numbers
  • Calendar events (when Google/Microsoft calendar is connected)

2. How We Use Your Data

  • Service delivery: Providing legal ERP features, processing payments, filing eTIMS returns
  • Security: Detecting and preventing unauthorized access, fraud, and data breaches
  • Compliance: Meeting our obligations under Kenyan law, KRA requirements, and Law Society rules
  • Support: Responding to support requests and troubleshooting
  • Improvement: Analyzing anonymized usage patterns to improve the Platform
  • Communications: Sending service notifications, security alerts, and billing information

3. Legal Basis for Processing

  • Contract: Processing necessary to provide the services you have subscribed to
  • Legal obligation: Tax compliance (KRA eTIMS), Law Society of Kenya trust accounting rules
  • Legitimate interest: Security monitoring, fraud prevention, service improvement
  • Consent: Marketing communications, optional integrations (Google, Microsoft)

4. Data Storage and Security

Your data is stored in encrypted PostgreSQL databases hosted on Neon Serverless (AWS infrastructure, EU/US regions). Documents are stored in AWS S3 with AES-256 encryption at rest and TLS in transit.

Security measures include:

  • Application-level tenant isolation — no tenant can access another tenant's data
  • Tamper-evident SHA-256 hash-chain audit logs
  • JWT authentication with minimum 32-character secrets
  • Rate limiting and IP-based protection
  • Malware scanning on all document uploads (VirusTotal API)
  • CORS restricted to production domain only

5. Data Retention

  • Active account data: Retained for the duration of your subscription + 90 days post-termination
  • Financial records: 7 years minimum (Kenya Tax Act, Advocates Act requirements)
  • Audit logs: 7 years (immutable — required for regulatory compliance)
  • Documents: Per your firm's configured retention policy (default 7 years)
  • API request logs: 90 days

6. Data Sharing

We do not sell your data. We share data only with:

  • KRA (eTIMS): Invoice data required by law for tax compliance
  • Safaricom (M-PESA): Payment transaction data for processing
  • Anthropic: Document/matter data sent to Claude API for AI features (only when you explicitly use AI tools; subject to Anthropic's privacy policy)
  • Infrastructure providers: Neon (DB), AWS (storage), Redis (queuing) — under data processing agreements
  • Law Society of Kenya: If required by their audit or regulatory powers
  • Law enforcement: Only when legally compelled with appropriate court order

7. Your Rights (KDPA 2019)

Under the Kenya Data Protection Act 2019, you have the right to:

  • Access: Request a copy of your personal data
  • Correction: Correct inaccurate personal data
  • Deletion: Request deletion of personal data (subject to legal retention requirements)
  • Portability: Export your data in a standard format
  • Objection: Object to processing based on legitimate interest
  • Withdraw consent: Withdraw consent for consent-based processing at any time

To exercise these rights, contact: privacy@globalwakili.co.ke

8. AI and Automated Processing

When you use AI features (document analysis, contract review, etc.), your data may be sent to Anthropic's Claude API. Key safeguards:

  • Only data you explicitly submit for AI analysis is sent
  • Sensitive fields (bank details, national IDs) are automatically redacted before sending
  • All AI calls are logged in our audit trail
  • No AI output is used operationally without human review
  • AI features can be disabled per tenant in Platform Settings

9. Cookies

The Platform uses only essential session storage (JWT stored in the browser's localStorage, not third-party cookies). No third-party tracking or advertising cookies are used.

10. Changes to This Policy

We will notify you of material changes via email 30 days in advance. Continued use after the notice period constitutes acceptance.

11. Contact and Complaints

Data Protection Officer: dpo@globalwakili.co.ke
For complaints to the regulator: Office of the Data Protection Commissioner (ODPC), Kenya.