Legal
Privacy Policy
Last updated 21 October 2026.
This Privacy Policy explains how AI PRO LTD ("we", "us"), which operates the Wakili Link service, collects, uses, shares and protects personal data when you use wakililink.com, the client portal and the advocate portal (together, the "platform"). It also explains your rights under the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021.
In short: we collect what we need to match you with a verified advocate and run the platform. We share your inquiry only with the advocates matched to it. We never sell personal data or show client or advocate details to the public, and you can ask us at any time what we hold about you.
1. Who we are
Wakili Link is an online service operated by AI PRO LTD. It is not a separate company. We operate online only: we have no walk-in offices, and enquiries, matching and consultations take place online. We are a technology platform, not a law firm. We do not give legal advice or represent anyone.
For the personal data described in this policy, AI PRO LTD is the data controller as defined in the Act. Independent advocates on the platform are separate data controllers for the information you give them once you engage them (see section 7).
Contact for privacy matters: support@wakililink.com (subject line "Data protection").
2. The personal data we collect
Data you give us
- Enquiries: your name, email, phone number, organisation (if any) and message when you use our contact form.
- Consultation bookings: your name, contact details, a short summary of your matter, the practice area and your preferred times. Consultations take place by video.
- Client account and profile: name, email, phone number, county and location, preferred language and preferred way of being contacted.
- Legal inquiries: the description of your legal need, the practice area or service, urgency, location and any documents you choose to upload. This often includes information about other people (for example the other party to a dispute), and may include sensitive personal data such as health, family or criminal-record details where relevant to your matter.
- Advocate applications: name, contact details, admission number, practising-certificate status, practice areas, courts, languages, experience, and verification documents (practising certificate, admission documents, professional indemnity cover and identity document).
- Payments: amounts, references and payment status for subscriptions, consultation fees and platform fees. Your M-Pesa number is processed by Safaricom and card details by Paystack; we never see or store full card numbers or your M-Pesa PIN.
- Testimonials: the text, display name and optional rating you submit, and your consent to publish them.
- Data protection requests: the details you give us to verify and respond to a request about your rights.
- Communications: emails, messages and call notes when you contact us or we contact you.
Data we collect automatically
- Security and service logs: IP address, browser and device details, and the date and time of requests to our servers. We use these to keep the platform secure and working.
- Site statistics: cookieless and anonymous, as described in our Cookie Policy.
- Analytics: Google Analytics, only if you accept analytics cookies.
- Form protection: Google reCAPTCHA on our enquiry, booking and intake forms.
- How you found us: the referring site and campaign labels, sent only with a form you submit.
Data from other sources
- Advocate checks: public registers, such as the Law Society of Kenya register of advocates, to confirm an applicant's status.
- Payment confirmations: confirmations from M-Pesa and Paystack.
- Business contact information: information about businesses and professionals that is published publicly, such as on company websites or professional directories. We use it to contact organisations about the platform (see section 5).
3. Why we use your data, and our legal basis
| Purpose | Legal basis under the Act |
|---|---|
| Create and run your client or advocate account | Performance of a contract with you |
| Verify advocates before they can receive referrals | Legitimate interests (a safe, trustworthy platform); legal obligation where applicable |
| Match your inquiry with suitable advocates | Performance of a contract; your consent for sensitive personal data you choose to share |
| Book, confirm and remind you about consultations | Performance of a contract |
| Take payments and keep financial records | Performance of a contract; legal obligation (tax and accounting records) |
| Send service messages (account, inquiry, booking and payment updates) | Performance of a contract |
| Send newsletters and marketing | Your consent, which you can withdraw at any time |
| Contact businesses about the platform | Legitimate interests, with an opt-out in every message |
| Publish testimonials | Your consent |
| Keep the platform secure and prevent fraud and spam | Legitimate interests |
| Improve the website using analytics | Your consent (Google Analytics); legitimate interests (cookieless statistics) |
| Answer enquiries and data protection requests | Legitimate interests; legal obligation |
| Meet legal, regulatory and court requirements | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 9).
4. Automated processing and AI
If you submit an inquiry without choosing a practice area, we use an artificial-intelligence (AI) service to suggest the area of law, the type of legal service and how urgent the matter appears.
- What is sent: only the text of your inquiry description, plus our list of practice areas and services. Your name, contact details and account details are not sent. Anything you write in the description is sent, though, so leave out personal details that aren't needed.
- What it decides: nothing about you. The suggestion is used only to route your inquiry to advocates who cover that area, and only when the system is confident. The AI gives no legal advice, does not decide whether you get help, and does not set fees.
- Your choices come first: if you pick a practice area yourself, the AI is not used, and the urgency you choose is never changed. Our staff can review the AI's suggestions.
- Your rights: under section 35 of the Act, you can object to automated processing or ask a person to review how your inquiry was routed by emailing support@wakililink.com.
The client assistant. Signed-in clients can ask the portal's AI assistant about their own account, such as matters, invoices, documents or upcoming dates. To answer, we send your question and the relevant records from your account to the same AI provider. The answer is shown to you and not saved as a conversation, but your question is kept in our audit log. The assistant summarises your records; it does not give legal advice. You don't have to use it.
The AI provider acts as our data processor under a written agreement that limits its use of your data to providing these services to us.
5. Marketing and business outreach
- Newsletters and offers: we send these only if you ticked the separate marketing box. That consent is never a condition of using the platform.
- Contacting businesses: we may contact businesses and professionals about the platform by email, SMS or WhatsApp, using business contact details that were published for that purpose. Every message says who we are and how to opt out.
- Opting out: use the unsubscribe link in any email, reply STOP to any SMS or WhatsApp message, or email support@wakililink.com. We keep a suppression record so that we don't contact you again.
- Service messages: we still send messages about your account, inquiries, bookings and payments after you opt out of marketing, because they are part of the service.
6. Who we share your data with
- Matched advocates: your inquiry details are shared only with the advocate(s) matched to that inquiry, so they can decide whether to accept it. Your contact details are shared with an advocate once a referral is accepted.
- Service providers (data processors), each under a written agreement and acting only on our instructions:
- cloud hosting and secure document storage;
- email, SMS and WhatsApp delivery;
- payment processing (Safaricom M-Pesa and Paystack);
- the AI service described in section 4;
- Google, for reCAPTCHA and, with your consent, Google Analytics.
- Authorities: regulators, law enforcement agencies, courts and the Office of the Data Protection Commissioner, where the law requires it.
- Professional advisers: auditors, insurers and our own legal advisers, under confidentiality obligations.
- A buyer or successor: if Wakili Link is reorganised, merged or sold, your data stays protected under this policy.
We do not sell personal data. We do not publish client or advocate details on the public website or to search engines. Advocate profiles are visible only to signed-in clients with an active subscription.
7. When you engage an advocate
Once you instruct an advocate, the information you share with them for legal advice is handled by that advocate as an independent data controller. It is protected by their professional duty of confidentiality and by advocate–client privilege, not by this policy. Ask your advocate for their own privacy notice.
8. International transfers
Some of our service providers store or process data outside Kenya, for example cloud, email and AI providers. When that happens, we transfer data only as sections 48 to 50 of the Act and the Regulations allow, for example where:
- there are appropriate safeguards, such as contractual protections;
- the destination offers adequate protection; or
- the transfer is necessary to provide the service you asked for.
Sensitive personal data is transferred only with your consent and appropriate safeguards. You can ask us for details of these safeguards.
9. Your rights
Under the Act you have the right to:
- Be informed about how your data is used (this policy).
- Access the personal data we hold about you.
- Correct data that is inaccurate, out of date or incomplete.
- Delete data that we no longer need, or that we process unlawfully.
- Object to processing based on our legitimate interests, and to direct marketing at any time.
- Restrict processing while a complaint or correction is being resolved.
- Data portability: receive data you gave us in a structured, machine-readable format (JSON), or have it sent to another controller.
- Withdraw consent at any time. This does not affect processing that already happened.
- Not be subject to solely automated decisions that significantly affect you (see section 4).
How to make a request: use our data protection request form or email support@wakililink.com. We may ask you to confirm your identity. We respond within the time limits set by the Regulations and never later than 30 days. Requests are free unless they are clearly unfounded or excessive.
Complaints: if you are unhappy with how we handled your data, please tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
10. How long we keep data
| Data | How long |
|---|---|
| Client and advocate accounts | While the account is active, then up to 2 years after closure. This allows for disputes and queries. |
| Inquiries, referrals and uploaded documents | While the account is active, then up to 2 years after the inquiry closes |
| Enquiries that did not lead to an account | Up to 24 months |
| Consultation bookings | Up to 2 years after the consultation |
| Payment and financial records | 7 years. Kenyan tax law requires records to be kept for at least 5 years. |
| Advocate verification documents | While the advocate is on the platform, then up to 2 years |
| Marketing suppression records | Indefinitely, so we never contact you again after you opt out |
| Testimonial consent records | As long as needed to show that publication was lawful |
| Raw cookieless site statistics | 90 days. After that only daily totals are kept. |
| Security logs and IP addresses on enquiries | Up to 12 months |
| Consent and audit records (for example, when you accepted the Terms) | As long as needed to show we acted lawfully |
| AI assistant questions (audit log) | As long as the account is active, then up to 2 years |
When a retention period ends, we delete the data or anonymise it so it can no longer identify you. Automated jobs apply these periods to website enquiries and site statistics. Other records are reviewed and removed manually.
11. How we protect your data
- Encryption in transit (HTTPS) and of stored secrets and credentials.
- Role-based access, so staff see only what their job needs.
- Multi-factor authentication for staff systems.
- Audit logs of sensitive actions.
- Authorisation checks, so inquiry and advocate data is visible only to the client, the matched advocates and authorised staff.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Data Commissioner within 72 hours of becoming aware of it. Where the risk to you is high, we will also tell you without undue delay, as section 43 of the Act requires.
12. Children
The platform is for adults. We do not knowingly collect data from anyone under 18 without the consent of a parent or guardian. A matter concerning a child, such as custody or maintenance, should be submitted by the parent, guardian or other adult acting for the child. If you believe a child has given us data without that consent, contact us and we will delete it.
13. Links to other websites
Our site links to other websites, such as government registers and court websites. We are not responsible for their privacy practices. Please read their own policies.
14. Changes to this policy
We will update this policy when our practices or the law change, and revise the "last updated" date above. If a change significantly affects how we use your data, we will tell account holders by email or in the portal before it takes effect.