Privacy notice
This notice explains what personal data we collect through robinmuthomi.com and its registration forms, why we collect it, who we share it with, and the rights you have under the Data Protection Act, 2019.
Who we are
robinmuthomi.com is run by Robin Muthomi Mutiga, Advocate, trading as Robin Advisory Group, Nairobi, Kenya (“we”, “us”). We decide how your data is used for the purposes below and are responsible for it. Contact: robin@robinmuthomi.com or WhatsApp 0799 157 696.
What we collect and why
| Data | Why we need it | Basis |
|---|---|---|
| Name, email, phone number | To confirm your seat, send venue and day details and contact you about the session you booked. | Contract (your booking) |
| LSK / P.105 number | So Wakili 101 can record your CPD point with the Law Society of Kenya. | Contract; LSK CPD rules |
| M-Pesa confirmation code and amount | To match your payment to your seat and keep payment records. | Contract; legal obligation (tax records) |
| Document type you draft most, and any task you name | To seat you with people who do similar work and prepare exercises for the day. | Contract (to prepare your session) |
| Feedback and ratings you give after a session | To improve our sessions. We quote short extracts with your first name and last initial only where you agreed to it on the feedback form. | Consent |
| Photographs taken on the day | To record the session and show future participants what the day looks like. Tick the box on the form, or tell us on the day, and we leave you out. | Legitimate interest, with a right to opt out |
| Technical logs (IP address, browser, pages requested) | Kept by our hosting provider to keep the site secure and working. We do not use advertising trackers on this site. | Legitimate interest |
| Visit statistics: the page you open, the site that sent you (its name only), any campaign tag in the link, device type (phone, tablet or computer) and country | To count visits and see which channels bring people to our sessions. We set no cookies. Unique visitors are counted with a code made from a one-way scramble of your connection details, the date and a private key; your IP address is not stored, and a code from one day does not match the next. If your browser sends “Do Not Track”, nothing is recorded. | Legitimate interest |
We do not ask for, and you should not send us, confidential client information. Exercises on the day use non-confidential tasks only.
How registration works
In-person labs. When you submit the Working Lab form, your details are saved to our registration database and we email you a confirmation. You can then look up your own seat on the status page using your name and email; it shows nothing else. The form also offers a WhatsApp message addressed to us; nothing is sent there unless you press send. WhatsApp is operated by Meta and its own privacy terms apply to that message.
Online webinars. Webinar registration forms save your details to our registration database and send your confirmation and reminder emails through our email provider.
Who we share it with
- Wakili 101, our CPD accreditation and event partner: your registration details (name, contact details, P.105 number, payment reference, the document type and task you give us, and your photo preference), for payment collection (the M-Pesa till is theirs), running the day, certificates and CPD filing.
- The Law Society of Kenya: your name and P.105 number, which Wakili 101 sends to record your CPD point.
- Service providers acting on our instructions only: Vercel (website hosting), Supabase (registration database), Brevo (email delivery) and Google (our notification inbox, and the web fonts this site loads).
We do not sell your data, and we do not share it for anyone else’s marketing. Some of these providers store data outside Kenya; where they do, we rely on the safeguards the Act requires.
How long we keep it
Registration details are kept for two years after the session, so we can answer CPD queries. Payment records are kept for five years, as the Tax Procedures Act requires. Feedback is kept for three years, or until you ask us to remove it if that is sooner. Visit statistics are kept for twelve months. After that, data is deleted or anonymised.
Your rights
Under the Data Protection Act, 2019 you may ask us to tell you what data we hold about you, correct it, delete it, receive a copy in a portable format, or stop using it for a purpose you object to, including marketing. You may withdraw consent at any time; this does not affect what was done before. Write to robin@robinmuthomi.com and we will reply within the time the Act allows.
If you are not satisfied with our answer, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).
Security
Access to registration records is limited to the people who run the session. We collect only what each purpose needs.
Changes
If we change this notice, we will update the date at the top. Material changes will be flagged on the registration page.