Your Data, Handled Like a Brief

Equibridge Attorneys ("EBA", "the firm", "we") is a law firm at B3C, Enoch's Court 1, Jabi, Abuja, Nigeria. For the purposes of the Nigeria Data Protection Act 2023, we are the data controller for the personal data described in this policy — meaning we decide why it is held and what is done with it, and we answer for that.

This policy covers this website, our case tracker, and the personal data we handle in the ordinary course of acting for clients.

Only what we actually need. In practice that falls into three buckets:

• Enquiry details. If you use the contact form or write to us: your name, email address, phone number, the service you selected, and whatever you choose to tell us about your matter.
• Client and matter data. Once you instruct us: identification and onboarding records, the documents and facts relevant to your brief, correspondence, and the fee and payment records we are required to keep.
• Nothing behavioural. No cookies, no analytics, no advertising pixels, no session recording, no fingerprinting. We do not build a profile of you, because we have no use for one.

Worth being precise about, because it is unusual: this website has no backend. The contact form does not transmit anything to a server of ours. When you press send, it opens a message in your own email application, pre-filled with what you typed — you remain in control, and nothing leaves your device until you choose to send it.

Under the NDPA 2023 we must have a lawful basis for every use. Ours are:

• Performance of a contract — to carry out the retainer or engagement you have instructed us on.
• Legal obligation — to meet the professional, regulatory, anti-money-laundering and record-keeping duties that bind legal practitioners.
• Legitimate interests — to respond to enquiries, run the firm, pursue or defend legal claims, and keep our systems secure.
• Consent — where we ask for it specifically, and which you may withdraw at any time without it affecting what was lawful before.

Clients whose matters are live can be given access to our case tracker — the internal business tool we use to monitor progress on each brief. Some specifics, since it holds the most sensitive data we have:

• Access follows onboarding. A tracker is released only after a client has been properly onboarded to the firm and the necessary payments have been made.
• Two parties, no one else. A matter's ledger is visible to that client and to the lawyers assigned to that brief. No other client, and no unassigned member of the firm, can open it.
• Access is granted deliberately. Adding or removing a person from a matter is a recorded act by the firm. It never happens automatically.
• Nothing is published. Tracker pages are not indexed by search engines and are not reachable by anyone who has not been given the link and the credentials.

Narrowly, and never for money:

• Courts, tribunals and registries — where conducting your matter requires a filing or a service.
• Counsel, experts and agents — instructed on your brief, under equivalent duties of confidence.
• Regulators and authorities — only where the law compels disclosure, and only so far as it compels it.
• Service providers — such as our email and document infrastructure, bound to process data only on our instructions.

We do not sell, rent or trade personal data. If a transfer outside Nigeria is ever necessary to conduct a matter, we do it only on a basis the NDPA 2023 permits.

Only as long as the purpose or the law requires — then it goes.

• Access on a need-to-know basis — matter data is available to the lawyers conducting that brief, not to the firm at large.
• Confidentiality obligations — every member of the firm is bound by professional duties of confidence that outlast their time with us.
• Secured infrastructure — our systems are the state-of-the-art technological structure the firm was built around, kept current deliberately.
• Breach response — if a personal data breach occurs and the NDPA 2023 requires notification, we notify the Nigeria Data Protection Commission, and you, within the time the law allows.

Under the NDPA 2023 these are yours to exercise. Tap any of them to see what it means in practice.

If you think we have handled your data badly, tell us first — we would rather fix it than have it escalated, and we will look at it seriously. You are equally entitled to go straight to the Nigeria Data Protection Commission (NDPC), the supervisory authority for data protection in Nigeria, and to seek a remedy through the courts. Coming to us first does not cost you either of those routes.

When the law moves or our practice changes, this policy changes with it. The revision date at the top of the page always reflects the current version. Where a change materially affects clients with live matters, we tell them directly rather than relying on them to notice.

Data protection questions go to the same people who handle our clients' data protection matters.