ECOLAW FIRM is committed to protecting and respecting the privacy of all individuals whose personal data we process, including clients, prospective clients, website visitors, business contacts, employees, and third parties. This Privacy Policy explains how we collect, use, store, share, and protect personal data in the course of providing legal services and operating our digital platforms. It also sets out your rights under applicable data protection law, including the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR), other applicable Nigerian laws, and international best practices. In compliance with applicable law, we have appointed a Data Protection Officer (DPO). Data protection enquiries may be directed to info@ecolawfirm.com.
Personal Data we use and collect
For the purposes of this Policy, personal information means any information that is reasonably capable of being associated or linked, directly or indirectly, with an identified or identifiable individual or household.
When you engage our legal services, contact us, or interact with our website, you may provide us with:
- Contact Information: Full name, title, and contact details (email address, phone number, postal address)
- Professional information: Company name, job title, industry and legal matters you inquire about
- National identification details and other KYC/AML verification documents
- Financial information necessary to process payments or advise on financial matters
- Details of your legal matter, including facts, documents, correspondence, and instructions
- Any sensitive personal data voluntarily shared in the course of legal proceedings (e.g. health information, criminal records)
In providing you with legal advice, representation, or other services, you may disclose to us personal information relating to third parties, such as your employees, directors, officers, or business contacts. By doing so, you warrant that you have a lawful basis for processing and transferring such information to us. Upon receipt, we may process and disclose that information in the manner described in this Privacy Policy.
Information We Collect Automatically
When you visit our website, we may automatically collect:
- IP address, browser type, operating system, and device information
- Pages visited, time spent on pages, and referring URLs
- Cookie data (see our Cookie Policy for details)
- Log Data and Usage Analytics
Information from third parties
We may receive personal data about you from:
- Referring parties, co-counsel, or opposing legal teams in the course of legal proceedings
- Publicly available sources such as the Corporate Affairs Commission (CAC), court registries, regulatory databases, and published judgments
- Business partners, agents, or introducers
- Credit reference agencies and anti-money laundering screening services
Purposes and Legal Basis for Processing
We process personal data only where we have a lawful basis to do so. The table below sets out the principal purposes for which we process personal data and the corresponding legal grounds:
| Purpose of Processing | Legal Basis | Examples |
|---|---|---|
| Provision of legal services | Legal obligation | Advising clients, drafting documents, representing clients in court |
| Client onboarding and KYC/AML compliance | Legitimate interests; Consent | Verifying identity, conducting conflict checks, anti-money laundering screening |
| Billing and payment processing | Performance of a contract | Issuing invoices, processing retainer payments |
| Communication and correspondence | Legitimate interests; Consent | Responding to enquiries, sending updates on matters |
| Marketing and business development | Consent | Sending newsletters, event invitations (opt-in only) |
| Legal and regulatory compliance | Legal Obligation | Filing obligations, court orders, regulatory reporting |
| Website analytics and improvement | Legitimate interests; Consent | Monitoring website traffic, improving user experience |
| Security and fraud prevention | Legitimate interests; Legal obligation | Detecting and preventing unauthorised access, cybersecurity monitoring |
Special Categories Of Personal Data
In the course of providing legal services, particularly in criminal litigation, family law, employment disputes, and personal injury & tort-related matters, we may process sensitive (special category) personal data, including:
We process such data only to the extent strictly necessary for the relevant legal purpose, on the basis of legal obligation, legal claims, or your explicit consent. All such data is handled with the highest standard of confidentiality and professional privilege.
Legal Professional Privilege
Communications and documents exchanged between our clients and us for the dominant purpose of obtaining or giving legal advice, or in connection with actual or contemplated litigation, are protected by legal professional privilege. This privilege belongs to the client and will not be waived without the client's instructions. With respect to documents or processes which are already filed in court, they become public documents for which any member of the public may apply to the court for certified true copies or extracts; for this reason, we may, in furtherance of our law practice, disclose on our website, judgments, rulings or decisions of the Courts. We maintain robust internal protocols to preserve and protect privileged materials.
How we share Professional Data
We do not sell, rent, or trade personal data. We may disclose your personal data only as necessary and only with the following categories of recipients:
We may receive personal data about you from:
- Courts and Tribunals: When representing clients in legal proceedings before any court, tribunal, or arbitral panel in Nigeria or abroad.
- Regulatory and Government Bodies: We disclose personal information to law enforcement agencies, governmental bodies, or regulatory authorities where we are legally or regulatorily obliged to do so by law, or where we reasonably determine that disclosure is necessary to prevent or detect fraud or other criminal activity, or to protect the rights, property, or safety of the Firm, our clients, or any other person. Governmental bodies or regulatory authorities we may disclose to include, but are not limited to, the Corporate Affairs Commission, NRS, CBN, NUPRC, SEC, and the NDPC.
- Legal Proceedings and Transactions: We may disclose personal information as reasonably necessary in the course of providing legal advice, representation, or services, including in connection with litigation, arbitration, regulatory investigations, and commercial Transactions.
- Co-Counsel and Expert Witnesses: Where we engage other legal practitioners, barristers, or technical experts to assist with a matter.
- Service Providers: Technology providers, cloud storage providers, payment processors, and administrative support services acting as data processors under appropriate data processing agreements.
- Professional Advisers: Accountants, auditors, insurers, and other advisers to the Firm who are bound by confidentiality obligations.
- Successors in Title: In the event of a merger, acquisition, or restructuring of the Firm, personal data may be transferred to the relevant successor entity.
- Express Consent: With your consent, we may disclose personal information to any third party where you have given your express consent to such disclosure.
International Data Transfers
Our services span Nigeria and the broader African market, and we may engage service providers or co-counsel in other jurisdictions. Where we transfer personal data outside Nigeria, we ensure that appropriate safeguards are in place, including:
We may receive personal data about you from:
- Adequacy decisions by the Nigeria Data Protection Commission (NDPC)
- Standard Contractual Clauses approved by the relevant data protection authority
- Binding Corporate Rules, where applicable
- Your explicit consent, where required by law
We will not transfer personal data to a jurisdiction that does not provide an adequate level of data protection without first implementing the above safeguards.
Data Retention
We retain personal data for as long as necessary to fulfil the purposes described in this policy, to comply with our professional and legal obligations, and to resolve any disputes. The principal retention periods we apply are:
We may receive personal data about you from:
- Client Matter Files: A minimum of 6 years from the conclusion of a matter, or longer where required by applicable law or professional rules, including the Rules of Professional Conduct for Legal Practitioners.
- KYC/AML Records: A minimum of 5 years from the end of the business relationship, in accordance with the Money Laundering (Prevention and Prohibition) Act 2022.
- Financial Records: 6 years, in accordance with Nigerian tax and financial regulations.
- Marketing Data: Until you withdraw consent or opt out of communications, whichever is earlier.
- Website Analytics Data: As specified in our Cookie Policy.
Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised.
Data Security
We maintain robust technical and organisational safeguards designed to protect your personal information against accidental or unlawful destruction, unauthorised alteration, unlawful disclosure, and illegitimate access or use. These safeguards include:
- Secure, encrypted digital storage and transmission of client files
- Role-based access controls limiting data access to authorised personnel only
- Regular staff training on data protection and confidentiality obligations
- Use of secure, law-firm-grade case management and document automation platforms
- Incident response protocols for detecting and reporting personal data breaches
Access to your personal information is strictly confined to personnel, agents, contractors, and authorised third parties whose functions genuinely require it. All such persons are bound by obligations of confidentiality and may process your personal information only in accordance with our instructions. We maintain documented incident response procedures to address actual or suspected data security breaches. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) and, where applicable, you and other affected individuals, in accordance with the Nigeria Data Protection Act (NDPA) 2023.
Your Rights as a Data Subject
Subject to applicable law and any overriding professional obligations (including legal professional privilege), you have the following rights in respect of your personal data:
We may receive personal data about you from:
- Right of Access: To obtain confirmation of whether we process your personal data and to receive a copy of that data.
- Right to Rectification: To request correction of inaccurate or incomplete personal data.
- Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where processing is unlawful.
- Right to Restriction: To request that we restrict processing of your personal data in certain circumstances.
- Right to Data Portability: To receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller where processing is based on consent or contract.
- Right to Object: To object to processing based on our legitimate interests or for direct marketing purposes.
- Right to Withdraw Consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
- Right to Complain: To lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng, or any other competent supervisory authority.
To exercise any of these rights, please contact us at info@ecolawfirm.com. We will respond within 30 days, or as otherwise required by applicable law. We may need to verify your identity before processing your request.
Children's Data
Our services are not directed to children under the age of 18. We do not knowingly collect personal data from children except where necessary in the course of legal proceedings involving a child (for example, custody matters or criminal proceedings involving minors), in which case we apply enhanced safeguards and process only the minimum data necessary. If you believe we have inadvertently collected data from a minor, please contact us immediately.
Automated Decision-Making and Profiling
We do not make decisions that produce legal or similarly significant effects on individuals solely by automated means. All legal advice, assessments, and professional determinations rendered by the Firm are made by qualified legal practitioners, informed by human judgment and professional expertise.
Where we employ automated tools or technologies to support our operations, such tools serve a purely assistive function and do not independently determine outcomes affecting your rights or interests.
To the extent that any processing of your personal information involves profiling, such profiling is conducted only where it is necessary for the performance of our services, required by applicable law, or carried out with your explicit consent. You retain the right to object to profiling in circumstances where it produces effects of legal or comparable significance, to request human review of any automated output that materially affects you, and to express your view and contest any such determination.
If you wish to exercise any of these rights or require further information regarding our use of automated processing, please contact us using the details set out in the Contact section of this Policy.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our practices, or the nature of our services. Material changes will be communicated through our website or directly to affected clients and individuals. The "Last Updated" date at the top of this policy indicates when it was most recently revised.
How to Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about how we handle your personal data, please contact us at:
ECOLAW FIRM13A, Ayo Babatunde Crescent, OniruVictoria Island, Lagos State, NigeriaEmail: info@ecolawfirm.com | law@ecolawfirm.com
Tel: +2348137035688 | +2348089676440