Effective Date: October 1, 2026

1. Introduction
ACCIN Law Advocates (“the Firm”) is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us. As a legal practice in Abuja, Nigeria, we process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).

2. Data Controller & Contact
ACCIN Law Advocates is the Data Controller responsible for your personal data. For any inquiries or to exercise your rights, please contact our Data Protection Officer at: dpo@accinlawadvocates.com.

3. Information We Collect
We collect personal data necessary for legal representation and firm administration, including:

• Client Intake: Names, contact details, identification documents (e.g., NIN, Passport), and details relevant to legal matters (including sensitive data where required for a case).
• Communications: Information you provide via email, phone, or our website.
• Technical Data: IP addresses and browser data collected via our website, in compliance with cookie notice requirements.

4. Legal Basis for Processing
We process your data based on:

• Contractual Necessity: To provide legal services or enter into a retainer agreement.
• Legal Obligation: To comply with professional conduct rules, anti-money laundering (AML/CFT) laws, and court orders.
• Legitimate Interests: For firm administration, security, and defending legal claims.
• Consent: Where required, such as for marketing communications. You may withdraw consent at any time.

5. Confidentiality & Privilege
Information shared in the context of an established advocate-client relationship is subject to strict professional secrecy and legal privilege under Nigerian law.

6. Data Subject Rights (Under the NDPA)
You have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erasure of data where retention is no longer lawful.
• Restrict or Object to processing based on legitimate interests.
• Data Portability to receive your data in a structured format.
• Lodge a Complaint with the Nigeria Data Protection Commission (NDPC).

7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by legal and professional retention obligations.

8. Data Security & Breach Notification
We employ appropriate technical and organizational measures to protect your data. In the unlikely event of a data breach, we will notify the NDPC within 72 hours and inform affected individuals where there is a high risk to their rights and freedoms.

9. Third-Party Disclosures
We do not sell or rent your data. We may disclose data to:

• Courts, tribunals, and regulatory agencies as required for legal representation.
• Vetted service providers (e.g., IT support, secure cloud storage) bound by confidentiality agreements.
• Other legal practitioners or experts were necessary for your matter, with your consent or as implied by the retainer.

10. Cross-Border Transfers
Where data is transferred outside Nigeria, we ensure the recipient is subject to adequate protections or a valid Cross-Border Data Transfer Instrument approved by the NDPC.