Back to Home

Privacy Notice

Effective 24 September 2026 · Version 2026-09-24

This notice explains what personal data we collect when you use our website and client portal, why we use it, who we share it with, how long we keep it and the rights you have under the Nigeria Data Protection Act 2023. If anything is unclear, email us.

1. Who we are

Attorneys Klinique (“we”, “us”) is a law firm registered with the Corporate Affairs Commission as a business name, No. 9868241. Our registered address is 2 Joshua Madaki Close, Apo Zone E, Abuja, FCT, Nigeria, and our office is at No. 2 Joshua Madaki Close, Opposite Eterna Fuel Station, Abuja. We are the data controller for the personal data described here.

For anything about your personal data, contact our data protection contact at attorneysklinique@gmail.com or call +234 814 321 2579 or +234 805 569 5664.

2. What we collect

  • Identity and contact details: your name, email address, phone number, company name, postal address, city, state and profile photo if you add one.
  • Account and security records: sign in method, one time codes (stored only as a scrambled hash), two factor records for partners and staff, and the record of what you agreed to and when.
  • Information about your legal matter: what you tell us in the guide, bookings, messages and forms, the documents and photos you upload, your evidence timeline and reminders, and notes our partners make while acting for you.
  • Payment records: amounts, dates, invoice numbers and Paystack payment references. Your card or bank details go straight to Paystack; we never see or store them.
  • Messages we send you: which confirmations and reminders we sent by email, SMS or WhatsApp, to which address or number, and whether they were delivered.
  • Reviews: if you send us a testimonial, your name, rating, review, and any role, city and photo you add, plus your email address if you give it (never published).
  • Contact form details: what you send us, plus your internet address and browser type, kept briefly to stop spam and abuse.
  • Technical data: the cookies described in section 11, a scrambled (hashed) form of your internet address used only to limit repeated sign in, sign up and guide requests, and, only if you accept analytics, anonymous visit statistics.

Sensitive personal data. Legal matters often involve health, family life, religion, criminal allegations or finances. We only use such details to advise and act for you, to establish, exercise or defend legal claims, or with your explicit consent, and we keep access to them tightly limited.

We collect this data from you, from people acting for you, and from the services you choose to sign in with (such as Google, which shares your name, email and photo).

3. Why we use it and our lawful basis

PurposeLawful basis
Creating and running your portal accountPerforming a contract with you, or steps you ask for before one
Booking consultations, advising and acting on your matterContract; for sensitive data, legal claims or your explicit consent
Sending your description or document to the AI assistantYour consent, asked for each time, which you can refuse
Taking payment, issuing invoices, keeping accountsContract and our legal obligations under tax and accounting law
Booking confirmations and reminders by email, SMS or WhatsAppContract; you can switch WhatsApp off in your profile
A welcome note from the founder, reminders about evidence you saved but did not submit, and check ins every two weeks or after a long absenceOur legitimate interest in looking after our clients; switch them off in Notifications or with the link in any of these emails
New month and public holiday greetings, and occasional firm newsYour consent, given by switching them on; withdraw it at any time
Answering contact form enquiriesYour consent, given on the form
Publishing your review on the website after we approve itYour consent, given on the review form; withdraw it at any time
Conflict checks and meeting our professional duties as lawyersLegal obligation
Keeping the platform secure, preventing fraud, audit recordsOur legitimate interest in protecting you and the firm
Counting visits with Google Analytics and Vercel Web AnalyticsYour consent through the cookie banner

We do not sell personal data and we do not use it for advertising.

4. The AI assistant and automated answers

Our guide, document explainer and evidence tool can use an AI assistant provided by Anthropic PBC in the United States. Your words or document are sent to it only if you tick the box that asks for your agreement. If you do not tick it, the guide is built from our own written library and nothing you wrote is sent to Anthropic. If you choose a language other than English, only our standard library text is sent to be translated. The document explainer needs the AI, so it only runs with your agreement.

Before anything is sent we ask you to tick this box: “I agree that my document will be securely processed by our AI provider, Anthropic, outside Nigeria, only to prepare this explanation. It is not used to train their AI. I will leave out ID numbers, bank details and health details unless they matter.” In the guide and the evidence tool the same wording says “what I type” instead of “my document”.

Anthropic processes the content only to produce your answer, under its commercial terms, which do not allow it to use the content to train its AI. Please leave out ID numbers, bank details and health details unless they matter to your question.

The answer is general legal information, not a decision about you and not legal advice. No decision with legal or similarly significant effect is ever made about you by automated means alone. You can ask for a partner to review any automated answer through your profile or by emailing us.

The microphone button uses your browser’s own speech recognition. In some browsers, such as Google Chrome, your voice is processed by the browser maker (Google) to turn it into text. Type instead if you prefer.

5. Who we share it with

Only people who need it see your data. Inside the firm, our partners and staff can see client details so the firm can handle your matters. Outside the firm, these providers process data for us under their data processing terms:

ProviderWhat they do for usWhere
SupabaseDatabase, file storage and sign inUnited States
VercelHosting of the website and its serversUnited States and its global network
AnthropicAI assistant, only with your consentUnited States
PaystackCard and bank paymentsNigeria, with some processing abroad
Termii and Meta (WhatsApp)Sign in codes, SMS and WhatsApp noticesNigeria, European Union and United States
ResendSending emailsUnited States
GoogleSign in with Google, Meet links, calendar invites, file storage for the firm, and Analytics if you accept itUnited States and other countries

We also share data where the law requires it (for example a court order or a request from a regulator we must obey), with courts, other parties and their lawyers when we act on your matter with your instructions, and with our professional advisers, auditors and insurers under a duty of confidence.

6. Transfers outside Nigeria

Our database, files and servers are hosted in the United States, and some providers above work from other countries. Before any transfer we make sure it is allowed by the Nigeria Data Protection Act 2023: the provider must be bound by data processing terms that protect your data to a standard at least equal to the Act, or the transfer is necessary for the contract you asked for, or, for the AI assistant, you have given explicit consent after being told the data leaves Nigeria. You can ask us for details of these safeguards.

7. How long we keep it

DataHow long
Phone sign ups that never enter their first codeDeleted automatically after 24 hours
One time sign in codesDeleted automatically after 24 hours
Scrambled internet address used to limit repeated requestsDeleted automatically within a day
Guide requests made without signing inDeleted automatically after 30 days if you do not sign in and save them
Internet address and browser type from the contact formDeleted automatically after 90 days
Records of messages we sent youDeleted automatically after 12 months
Reviews we decided not to publishDeleted automatically 12 months after they were rejected
Contact form enquiriesDeleted automatically 12 months after we replied or closed them
Data protection requestsThe details you sent and our reply are cleared 36 months after we handled the request; a record that a request was made and answered is kept
Security and audit records of actions taken in the portalDeleted automatically after 24 months
Published reviewsWhile published; removed when you ask us
Your account and profileWhile your account is open; ask us to close it at any time
Matter files, documents and correspondenceUp to 7 years after the matter closes, to meet our professional duties and deal with any later claim
Payment and accounting recordsAs long as tax and accounting laws require
Analytics statistics (only with your consent)No longer than 14 months

When a period ends we delete the data or make it anonymous so it can no longer identify you.

8. How we protect it

  • All traffic to the site is encrypted in transit (HTTPS), and our database provider encrypts stored data.
  • Database rules make sure clients can only reach their own records, and client files are private, opened only through links that expire after an hour.
  • Partners and staff must use two factor sign in with an authenticator app.
  • One time codes are stored only as scrambled hashes, and administrative actions and data requests are logged.
  • We only give access to people who need it, and our partners are bound by legal professional confidentiality.

If a personal data breach is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you promptly if the risk to you is high, as the Act requires.

9. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

  • be told how your data is used, which this notice does;
  • get a copy of your data, including in a format you can take elsewhere;
  • have wrong or incomplete data corrected;
  • have your data deleted, or its use limited, where there is no good reason for us to keep using it;
  • object to our use of your data, including where we rely on our legitimate interests;
  • withdraw any consent you gave, at any time, without affecting what was done before;
  • not be subject to a decision based only on automated processing that has legal or similarly significant effects on you;
  • complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Signed in clients can download their data and send requests from the profile page. Anyone can also email us. We may ask you to confirm your identity first. We aim to reply within 30 days. Some records must be kept even if you ask us to delete them, for example accounting records or files we need to meet our professional duties; if so, we will tell you which and why.

To close your account, follow the steps on Delete your account, which also lists what we keep.

10. Children

Our website and portal are for people aged 18 and over, and we ask you to confirm this when you create an account. If a matter concerns someone under 18, a parent or legal guardian should contact us for them. If we learn we hold a child’s data without that consent, we will delete it.

11. Cookies and similar technology

Essential cookies keep you signed in and the site secure, so they do not need your consent. Analytics cookies are only set if you press “Accept analytics”. You can change your choice at any time with “Cookie settings” at the bottom of every page.

NamePurposeHow long
sb-… (Supabase)Keeps you signed in to the portalUntil you sign out, refreshed while you use the site
ak_anonLinks a guide request to your browser before you sign in, so you can save it30 days
ak_terms_consentCarries your agreement to these terms through Google sign up1 hour, then removed
g_oauth_stateProtects the firm’s Google account connection (partners only)A few minutes
ak_cookie_consent_v1 (browser storage)Remembers your cookie choiceUntil you clear it
Session storage itemsHand your homepage text to the guide, time the resend code button and show the opening animation onceUntil you close the tab
_ga, _ga_… (Google Analytics)Counts visits and pages, only with your consent. Never sees what you typeUp to 2 years
Vercel Web Analytics (no cookie)Counts visits and pages, only with your consent, using a visitor hash that Vercel discards after 24 hours. The address bar query is removed before anything is sentNone stored in your browser

12. Changes to this notice

We will update this notice when our practices change. The version and effective date are shown at the top. If a change affects what you agreed to, we will ask you to read and accept the new version on your profile page.

13. Contact

Data protection contact, Attorneys Klinique: attorneysklinique@gmail.com, +234 814 321 2579, No. 2 Joshua Madaki Close, Opposite Eterna Fuel Station, Abuja. See also our Terms of Engagement and Copyright and Confidentiality Notice.