How we handle your personal data

Lex Firma LP (“Lex Firma”, “the Firm”, “we”, “us” or “our”) is a law firm practising in Nigeria from its office at 20 Mohammed L. Hassan, Jabi, Abuja, Nigeria. We are committed to protecting the privacy of our clients, prospective clients, website visitors, candidates and everyone else whose personal data we handle.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to this website and to personal data we process in the course of providing legal services.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (the “NDPA”), the Nigeria Data Protection Regulation 2019 and, where they apply to a particular matter, other data protection laws including the EU and UK General Data Protection Regulation.

Nothing on this website is legal advice, and sending us an enquiry does not by itself create a lawyer–client relationship. That relationship begins only once we have completed our conflict and client due diligence checks and confirmed our engagement in writing.

Lex Firma LP is the data controller for the personal data described in this policy. If you have any question about this policy, or wish to exercise any of the rights set out in section 11, you can reach us at:

• Email: info@lexfirmalp.com
• Telephone: +234 803 660 9307
• Office: 20 Mohammed L. Hassan, Jabi, Abuja, Nigeria

Information you give us

• Enquiries. When you complete the form on our Contact page we collect your name, email address, the subject line and the content of your message.
• Correspondence. If you email, call or write to us, we keep a record of that correspondence.
• Mailing list. If you sign up for our legal insights, we collect the email address you provide.
• Career applications.If you apply to join us, we collect the contents of your application — typically your name, contact details, education, professional qualifications, employment history and anything else you choose to include in your CV or covering message.
• Client information.When we act for you, we collect identity and verification documents, contact and billing details, and information relating to your matter. Depending on the matter, this can include sensitive personal data — for example information about financial affairs, alleged offences, court proceedings, health or political affiliation.

Information collected automatically

• Our hosting provider records standard server logs when you visit, including your IP address, browser and device type, the pages you request and the time of the request.
• We process the IP address of anyone submitting the contact form for a short period, to limit how many messages can be sent from one source and to block automated abuse.

Information from other sources

In the course of a matter we may receive personal data about you from someone other than you — for example from a client who instructs us in a matter involving you, from opposing counsel, from courts and tribunals, from regulators, from public registries such as the Corporate Affairs Commission, or from identity verification providers.

A cookie is a small file stored on your device by a website. We use very few, and we do not use advertising cookies or sell any data collected through them. Our typefaces are served from our own infrastructure rather than an external font service, so simply viewing a page does not disclose your visit to a font provider.

When you first visit, a banner asks whether you accept analytics cookies. Nothing optional is loaded until you choose — if you decline, no analytics script is requested at all. You can change your mind at any time using the Cookie Preferences link at the bottom of any page.

We treat reCAPTCHA as necessary because without it the enquiry form is open to automated abuse. It runs only on our Contact page, and Google receives your IP address and interaction signals in order to score the submission.

Our Contact page also embeds a Google Map so you can find our office. That map loads with the page, and in doing so Google receives your IP address and may set its own cookies under its privacy policy, over which we have no control. If you would rather avoid this, you can block third-party cookies in your browser or simply not visit that page — our address is in section 2 either way.

The NDPA requires us to have a lawful basis for each purpose for which we process personal data. Those purposes, and the bases we rely on, are:

Data protection law is not the only duty we owe you. As legal practitioners we are bound by professional obligations of confidentiality under the Rules of Professional Conduct for Legal Practitioners, and communications between a lawyer and client for the purpose of legal advice attract legal professional privilege under the Evidence Act.

These duties are wider than this policy. We do not disclose confidential client information to anyone outside the Firm except where the client instructs us to, where it is necessary to conduct the matter, or where we are compelled by law or a court order.

Privilege and confidentiality can also limit what we are able to disclose in response to a request under section 11 — for example where releasing information about you would reveal privileged material belonging to a client.

We may share personal data with:

• Our service providers. This website is hosted by Vercel Inc., and messages sent through the contact form are delivered to our inbox by Resend, our transactional email provider. These providers act on our instructions and are bound to keep the data confidential and secure.
• Google.Google LLC receives personal data through three features of this website: reCAPTCHA on our Contact page, the map embedded on that page, and — only if you accept analytics cookies — Google Analytics. In each case Google acts under its own privacy policy. Section 4 explains what each one does and how to limit it.
• Counsel, experts and third parties in a matter. Where conducting your matter requires it — including counsel we brief, expert witnesses, process servers, courts and tribunals, arbitrators, mediators and opposing parties.
• Regulators and law enforcement. Where we are required to disclose by law, including to the Nigeria Data Protection Commission, tax authorities, and agencies with statutory powers to compel disclosure.
• Our own advisers. Our auditors, insurers, bankers and professional advisers, where they need the information and are themselves under a duty of confidentiality.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Some of the providers described in section 7 store or process data on servers outside Nigeria. Where personal data is transferred out of Nigeria we do so on one of the bases permitted by the NDPA — that the destination provides adequate protection, that the recipient is bound by contractual safeguards obliging it to protect the data to the standard required in Nigeria, or that the transfer is necessary for the performance of a contract or for the establishment, exercise or defence of legal claims.

We keep personal data only for as long as we need it for the purpose it was collected, and to meet our professional, regulatory and legal obligations. In general:

• Client files— for the duration of the engagement and for a period afterwards reflecting the applicable limitation periods and our professional obligations. Some records are kept longer where the nature of the matter requires it.
• Client due diligence records — for the period required by anti-money laundering legislation after the relationship ends.
• Enquiries that do not become matters — for a limited period, so that we have a record of conflicts and of what was discussed.
• Unsuccessful applications— for a limited period, in case a suitable role arises.
• Mailing list— until you unsubscribe.
• Server logs— for the short period applied by our hosting provider.

This website is served over an encrypted connection, and personal data submitted through it is transmitted over TLS. We apply access controls to our systems and files, our lawyers and staff are bound by professional confidentiality obligations, and our forms carry rate limiting and automated-submission checks.

No method of transmission over the internet is completely secure. Please do not send confidential or privileged details of a legal matter through the website contact form. Send us a short, general description instead and we will arrange a secure channel — or call us on +234 803 660 9307.

Subject to the conditions in the NDPA, you have the right to:

• Be informed about how we use your personal data — which is the purpose of this policy.
• Request access to the personal data we hold about you.
• Have inaccurate or incomplete personal data corrected.
• Request deletion of your personal data where we no longer have grounds to keep it.
• Request that we restrict our processing of your personal data.
• Object to processing that we carry out on the basis of our legitimate interests.
• Receive certain personal data in a portable, machine-readable format.
• Withdraw your consent at any time, where we rely on consent — for example for our mailing list.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, email info@lexfirmalp.com. We may need to verify your identity before we act. We will respond within the period required by the NDPA and, if we need longer because your request is complex, we will tell you why.

These rights are not absolute. We may be unable to comply in full where the data is subject to legal professional privilege, where we are required by law to retain it, or where complying would disclose personal data about someone else. Where we cannot comply, we will explain why.

We do not make decisions producing legal effects concerning you by automated means, and we do not use your personal data for profiling.

This website is intended for adults and is not directed at children. We do not knowingly collect personal data from children through this website. Where a matter requires us to process a child’s personal data, we do so on the basis of the consent of a parent or guardian or another lawful basis available under the NDPA.

Our website links to third-party sites, including the professional profiles of our people and our social media channels. This policy does not apply to those sites. We are not responsible for their content or their privacy practices, and we encourage you to read the privacy policy of any site you visit from ours.

We may update this policy from time to time to reflect changes in our practices or in the law. The date at the top of this page shows when it was last revised. Where a change is material we will take reasonable steps to bring it to your attention. This version was last updated on 5 August 2026.

If you have a question about this policy or a concern about how we have handled your personal data, please contact us at info@lexfirmalp.com in the first instance. We take such concerns seriously and will investigate.

If you are not satisfied with our response, you have the right to complain to the Nigeria Data Protection Commission, the supervisory authority for data protection in Nigeria, at ndpc.gov.ng.