Privacy Policy

NEXTLAW is a Service law firm. We are committed to protecting your privacy and to processing your personal data in line with the Applicable Data Protection Law (defined in Section 22 below). References in this policy to “we”, “us”, “our” or the “Firm” are to NEXTLAW; references to “you” are to any natural person whose personal data we process.

The Firm acts as the data controller for personal data collected through this website and through our offices and electronic channels. When we act on behalf of clients, the relevant client is typically the data controller and we process personal data on their instructions in accordance with our engagement terms and the Applicable Data Protection Law.

We process personal data in accordance with the following principles:

• processed lawfully, fairly, and in a transparent manner;
• collected for specific, explicit, and legitimate purposes, and not further processed in a way incompatible with those purposes;
• adequate, relevant, and limited to what is necessary for the purposes for which it is processed;
• accurate, complete, not misleading, and kept up to date having regard to the purpose;
• retained in a form that permits identification of the data subject for no longer than is necessary; and
• processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage.

We rely on one or more of the following legal bases under the Applicable Data Protection Law when we process your personal data:

Your consent

Where required, we will obtain your consent before processing your personal data. Consent may be given through check-boxes, online forms, written confirmation, or other clear affirmative action. You may withdraw your consent at any time using the contact channels in Section 21. Where we rely on consent and you withdraw it, we may be unable to continue providing the relevant service.

Other lawful bases

• Contract: to perform a contract with you, or to take steps at your request before entering into a contract.
• Legal obligation: to comply with laws and regulations applicable to the Firm.
• Legitimate interests: for our own legitimate interests or those of a third party, where these are not overridden by your rights and interests.
• Vital interests: to protect your vital interests where you are unable to give consent.
• Public interest: for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

The categories of personal data we may collect about you depend on the nature of our relationship with you. They may include:

We will only process sensitive personal data and personal data of children where we have a clear legal basis, including, where required, explicit consent.

We collect personal data in the following ways:

• Directly from you: when you engage us, contact us by email or phone, attend our offices or events, complete a form on this website, or submit an application for employment.
• Automated technologies: as you interact with this website, we automatically collect technical data through cookies, server logs, and similar technologies. See our Cookies Policy for further information.
• CCTV: we use CCTV at our offices to help protect visitors, employees, and assets.
• Recruitment processes: we may collect data about education, employment history, identity, and right to work from you, your referees, recruitment agencies, screening providers, and publicly available sources.
• Third parties and public sources: we may receive personal data from clients, counterparties, regulators, courts, professional advisers, screening providers, and publicly available registers in the course of our work.

We use personal data to provide legal services and to operate the Firm. The main purposes for which we process personal data, by business function, are summarised below.

We may also use personal data for general business purposes such as fraud prevention, dispute resolution, business continuity, internal audit, and corporate restructuring, and to comply with court orders, regulatory requests, and law enforcement obligations.

We do not subject you to automated decision-making (including profiling) that produces a legal effect concerning you or similarly significantly affects you, unless (a) the decision is necessary for the performance of a contract with you, (b) you have provided explicit consent, or (c) the decision is authorised by law.

You may receive marketing communications from us where you have provided consent or where we have another lawful basis to do so. You can object to direct marketing or opt out of further communications at any time using the unsubscribe link in any marketing email or by writing to us. We do not share your personal data with third parties for their own marketing purposes without your express consent.

We use cookies and similar technologies on this website. For further information on what these are, how we use them, and how to manage your preferences, see our Cookies Policy.

We share personal data with third parties only where we have a lawful basis to do so and only to the extent necessary. We require third parties to process personal data on our instructions, subject to contractual confidentiality and security obligations, and in accordance with the Applicable Data Protection Law.

In the course of providing services, we may transfer personal data outside Nigeria. We will only do so where (a) the destination country is recognised by the Nigeria Data Protection Commission as providing an adequate level of protection, (b) appropriate safeguards are in place (such as contractual data-protection clauses), or (c) one of the lawful derogations under the Applicable Data Protection Law applies. In each case we take reasonable steps to ensure that personal data is handled securely.

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, accidental loss, destruction, or damage. These include access controls, encryption where appropriate, logging and monitoring, segregation of duties, vendor due diligence, and confidentiality obligations for our partners, employees, and third-party providers.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Where personal data is no longer required, we will securely delete or anonymise it.

Subject to the Applicable Data Protection Law and any applicable exemptions, you have the following rights in relation to your personal data:

• To be informed about how we process your personal data. This Privacy Policy is designed to give you that information.
• Access a copy of the personal data we hold about you.
• Rectification of personal data that is inaccurate or incomplete.
• Erasure of personal data where there is no overriding lawful reason for us to continue processing it.
• Restriction of processing in certain circumstances, for example while we verify accuracy or assess an objection.
• Data portability for personal data you have provided to us under a contract or with your consent and which is processed by automated means.
• Object to processing carried out on the basis of our legitimate interests, including profiling, and to processing for direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you consider that our processing of your personal data infringes the Applicable Data Protection Law.

We typically respond to requests within one month. If your request is complex or you have made several requests, we may extend that period and will keep you informed.

We do not knowingly collect personal data directly from children or persons under a legal disability without the consent of a parent, legal guardian, or other authorised representative. If you believe that we have collected such data, please contact us so that we can investigate and take appropriate action.

This website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy practices. When you leave this website, we encourage you to review the privacy policy of every site you visit.

If you have a complaint about how we process your personal data, please contact our Privacy Office in the first instance using the details in Section 21. We will work to resolve your concerns. If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission.

We keep this Privacy Policy under review and may update it from time to time to reflect changes in the Applicable Data Protection Law, our services, or our data practices. Any updates will be published on this page; by continuing to use this website after an update has been published, you accept the updated policy.

For any question, concern, or request relating to this Privacy Policy or our data practices, please contact:

• Email: privacy@nextlawpractice.com / contact@nextlawpractice.com
• Post: NEXTLAW, 1 Adedeji Adekola Street, Off Freedom Way, Lekki Phase 1.
• Telephone: +234-809-108-2144