Her Legacy Consulting Ltd is a tax advisory and business consulting firm registered in Kenya. We operate Her Legacy Consulting (herlegacyconsulting.co.ke) and Legacy Tax Hub (legacytaxhub.co.ke), Kenya’s AI-powered tax compliance platform.

We are a data controller under the Kenya Data Protection Act 2019 (the Act). We are responsible for deciding how and why your personal data is used.

We collect personal data when you use our services, tools, or forms. This includes:

• Identity data — first name, last name
• Contact data — email address, WhatsApp or phone number
• Business data — business name, structure, KRA PIN, VAT registration status
• Financial data — revenue figures, expense figures, tax calculations entered into our tools
• Usage data — which tools you use, pages you visit, and how you interact with our platform
• Communication data — messages sent to Amara, our AI tax advisor

We do not collect sensitive personal data such as national ID numbers, bank account details, or passwords unless explicitly required to deliver a service you have requested.

We use your personal data for the following purposes:

• To deliver tax filing, compliance, and advisory services you have requested
• To follow up on service enquiries submitted through our forms
• To send you relevant tax reminders, deadline notifications, and compliance updates
• To improve our tools, calculators, and platform based on usage patterns
• To communicate with you about your account, bookings, or service delivery
• To comply with our legal obligations under Kenya tax laws and regulations

We will never sell your personal data to third parties. We will never use your data for purposes unrelated to tax advisory and compliance services.

Under the Kenya Data Protection Act 2019 we process your data on the following lawful bases:

• Consent — where you have explicitly ticked the consent box on our forms
• Contract — where processing is necessary to deliver services you have requested and paid for
• Legitimate interests — where we have a legitimate business interest in following up on enquiries, improving our tools, or communicating about tax deadlines
• Legal obligation — where we are required to process data to comply with KRA or other regulatory requirements

We share your data only where necessary to deliver our services:

• Zoho Bigin — our CRM system used to manage client relationships and follow-ups
• Zapier — automation platform used to route form submissions to our systems
• Supabase — database platform used to store platform account information
• Anthropic — the AI provider powering Amara, our tax advisor (conversation data is processed to generate responses)
• KRA — where we are filing returns on your behalf we submit your data to the Kenya Revenue Authority as required

All third party providers are required to maintain appropriate security standards. We do not share your data with any other parties without your explicit consent.

We retain your personal data for as long as necessary to deliver our services and comply with our legal obligations:

• Active client data — retained for the duration of our engagement and for 7 years after to comply with KRA record-keeping requirements
• Enquiry data — retained for 2 years from the date of enquiry
• Platform account data — retained while your account is active and for 1 year after account closure
• Tool usage data — retained for 12 months then anonymised

You have the following rights regarding your personal data:

• Right to access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your data where we no longer have a lawful basis to hold it
• Right to object — you can object to us processing your data for direct marketing purposes
• Right to withdraw consent — where processing is based on consent you can withdraw it at any time
• Right to lodge a complaint — you can lodge a complaint with the Office of the Data Protection Commissioner of Kenya

To exercise any of these rights please contact us at hello@herlegacyconsulting.co.ke. We will respond within 21 days as required by the Act.

We take the security of your personal data seriously. We use industry-standard measures including:

• Encrypted data transmission (HTTPS) on all our platforms
• Access controls limiting who within our team can access client data
• Secure third-party platforms with their own security certifications

No method of electronic transmission or storage is 100% secure. If you have concerns about data security please contact us immediately.

Legacy Tax Hub uses the Meta Pixel to track website visits and interactions for the purpose of improving our advertising and understanding how people use our tools. This data is anonymised and aggregated. No personally identifiable information is shared with Meta beyond standard web analytics.

We do not use cookies for any purpose beyond essential website functionality.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify active clients of any material changes. The date at the top of this page shows when the policy was last updated.