Privacy Policy

This Privacy Policy applies to all personal data we collect and process in connection with:

• Visitors to our website at digitallord.com.ng and any subdomains;
• Clients and prospective clients who engage us for legal, compliance, or advisory services;
• Users of the Opti Consent Manager plugin (both Free and Pro tiers);
• Participants in our training programmes, workshops, seminars, and webinars;
• Subscribers to our newsletters, legal alerts, and blog publications;
• Individuals who submit enquiries, consultation requests, or contact forms;
• Job applicants and freelance collaborators;
• Attendees at legal tech events organised or co-organised by us;
• Any third parties whose personal data is processed in the course of our professional engagements.

This Policy does not apply to third-party websites, services, or platforms that may be linked from our website. We encourage you to review the privacy policies of any third-party sites you visit.

The nature of personal data we collect varies depending on the service or interaction involved. We describe each service area and corresponding data collection below.

3.1 Corporate, Commercial & Startup Advisory

In providing legal and advisory services to businesses, founders, and organisations, we may collect:

• Full names, professional titles, and contact details of directors, founders, and key officers;
• Company registration details, CAC numbers, and regulatory filing information;
• Financial information necessary for transaction structuring (e.g., cap table data, investment amounts);
• Identification documents (e.g., government-issued ID, BVN for KYC purposes where required);
• Employment and contractual information necessary for HR documentation and employment agreements;
• Intellectual property details, including trademark and patent information;
• Correspondence, meeting notes, and instructions shared during retainer engagements.

Legal basis: Performance of contract; Compliance with legal obligations; Legitimate interests of the Company in providing professional legal services.

3.2 Data Protection & Privacy Compliance Services

In providing DPO-as-a-Service, DPIA facilitation, policy drafting, compliance audits, and staff training, we may process:

• Organisational charts, employee names, roles, and contact details of client staff;
• Data processing inventories and Records of Processing Activities (ROPAs) prepared on behalf of clients;
• Information about third-party processors and sub-processors of client organisations;
• Details of data incidents and breach investigations handled on behalf of clients;
• Employee and executive training records and assessment results;
• Regulatory correspondence between clients and the Nigeria Data Protection Commission (NDPC) or other authorities;
• Personal data contained in sample datasets reviewed during compliance audits (subject to appropriate anonymisation and NDA protections).

Legal basis: Performance of contract; Compliance with legal obligations; Legitimate interests in delivering professional compliance advisory services.

3.3 Artificial Intelligence, Technology & Emerging Innovations Advisory

In advising fintech, healthtech, edtech, blockchain, and regtech clients on AI ethics, governance, and tech law, we may collect:

• Technical specifications and system documentation of clients’ AI or data-driven products;
• Names and contact details of technical teams, product managers, and executives;
• Details of AI models, datasets, training methodologies, and risk assessments;
• Contractual and regulatory documentation submitted for review;
• Information about third-party AI vendors and technology partners engaged by clients.

Legal basis: Performance of contract; Legitimate interests in providing specialist technology advisory.

3.4 Opti Consent Manager Plugin

In connection with the Opti Consent Manager plugin, we collect data in two distinct capacities:

(a) As Data Controller — Plugin User Account Data
When you register for and use the plugin (Free or Pro), we collect: Name and email address used for account creation; Organisation name and billing details; Payment confirmation data transmitted by Paystack (we do not store card details); Licence key activation records; Plugin usage logs, feature access records, and technical diagnostics; Support communications and tickets.

(b) As Data Processor — Consent Records and Data Subjects
To the extent that you (as a Plugin user/Data Controller) use the plugin to capture, store, or process personal data of your own data subjects (e.g., in generating consent records and receipts), we act solely as your Data Processor. We process such data strictly on your instructions and in accordance with our Data Processing Agreement. We do not use your data subjects’ data for our own purposes.

3.5 Training Programmes, Workshops & Webinars

For in-person and virtual training events, we collect:

• Full name, professional title, and employer of participants;
• Contact details for registration and certificate issuance;
• Attendance and assessment records;
• Photographs and video recordings where participants have provided consent;
• Payment details for paid events (processed through authorised channels).

Legal basis: Performance of contract; Consent (for photographs and recordings); Legitimate interests in delivering and improving training services.

3.6 Website and Blog

When you visit digitallord.com.ng, we may automatically collect: IP address, browser type, and operating system; Pages visited, time spent on pages, and navigation paths; Referring URLs and search terms; Device identifiers and general geographic location (country/city level); Cookies and similar tracking technologies (see Section 9).

When you interact with the website by submitting a contact form, subscribing to the newsletter, or booking a consultation, we collect the information you voluntarily provide, including your name, email address, phone number, and the content of your message.

Legal basis: Legitimate interests in improving website performance and user experience; Consent (for cookies and newsletter subscriptions); Performance of contract (for consultation booking).

3.7 Legal Tech Events

For events organised or co-organised by DL Legal Consults, we collect participant registration data, feedback, and where consented event photography and recordings. Event partner data (sponsors, co-organisers) is processed under our commercial agreements.

We use personal data collected only for the specific purposes for which it was collected and for compatible purposes consistent with those purposes. Our primary purposes include:

Purpose	Type of Data	Legal Basis
Delivering legal and advisory services	Contact, professional, and engagement data	Contract; Legal obligation
Providing and maintaining the Opti Consent Manager plugin	Account, payment, and usage data	Contract; Legitimate interests
Processing plugin payments	Email address; Payment confirmation from Paystack	Contract
Issuing Licence Keys and support	Name, email, Licence Key data	Contract
Conducting DPIAs and compliance audits	Organisational and processing data	Contract; Legal obligation
DPO-as-a-Service delivery	Staff, organisational, and regulatory data	Contract; Legal obligation
Delivering training and events	Participant registration and assessment data	Contract; Consent
Sending newsletters and legal updates	Name and email	Consent
Responding to enquiries and support requests	Contact data and enquiry content	Legitimate interests; Contract
Improving our website and services	Website analytics and usage data	Legitimate interests; Consent
Complying with legal and regulatory obligations	All relevant data	Legal obligation
Fraud prevention and security	Usage logs, IP addresses, payment data	Legitimate interests; Legal obligation
Recruitment and talent management	CV, portfolio, and reference data	Pre-contractual steps; Consent
Maintaining accounting and tax records	Billing and financial data	Legal obligation
Sharing thought leadership and publications	Attribution and contact data (with consent)	Consent; Legitimate interests

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.

We process personal data only when we have a valid legal basis to do so. Depending on the context, we rely on one or more of the following lawful bases under the NDPA 2023, and (where applicable) the GDPR:

• Consent: Where you have freely, specifically, and unambiguously given consent to processing for a stated purpose (e.g., newsletter subscription, event photography, cookies). You may withdraw consent at any time without detriment.
• Performance of Contract: Where processing is necessary to provide services you have requested or to take steps prior to entering a contract with you.
• Legal Obligation: Where processing is required to comply with applicable law, including the NDPA, CAMA, anti-money laundering regulations, and professional legal obligations.
• Legitimate Interests: Where processing is necessary for our legitimate business interests (e.g., improving services, fraud prevention, website security, business development), provided those interests are not overridden by your rights and interests.
• Vital Interests: In rare circumstances where processing is necessary to protect life.
• Public Task: Where applicable in the context of our regulatory advisory and public sector engagements.

Where we rely on legitimate interests, we conduct and document a Legitimate Interests Assessment (LIA) to ensure a proper balancing of interests. You may request details of any such assessment.

6.1 Third-Party Service Providers

We engage trusted third-party processors to assist in delivering our services. These providers process personal data only on our documented instructions and are subject to contractual data protection obligations. They include:

• Paystack payment processing for the Opti Consent Manager Pro Version;
• Cloud hosting and storage providers for website and data hosting;
• Website analytics providers for visitor traffic analysis (see Section 9);
• Document management and e-signature platforms used in client engagements;
• Video conferencing platforms used for training and consultancy delivery.

6.2 Professional Partners and Collaborators

In the course of delivering complex legal or compliance engagements, we may share relevant personal data with co-counsel, specialist consultants, or professional associates under appropriate confidentiality and data protection agreements.

6.3 Regulatory and Legal Disclosure

We may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by applicable law, court order, or professional obligation. We will notify you of such disclosure where legally permissible.

6.4 Business Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data may be transferred to the relevant parties as part of that transaction, subject to appropriate confidentiality protections. We will notify affected individuals of any such transfer.

6.5 No Sale of Personal Data

We do not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes. Your data is not a commodity.

6.6 Aggregated and Anonymised Data

We may share aggregated or anonymised insights (which cannot identify any individual) for industry research, thought leadership, and public reporting purposes.

DL Legal Consults is based in Nigeria and primarily processes personal data within Nigeria. Where it becomes necessary to transfer personal data outside Nigeria (for example, when using cloud service providers or international collaborators), we ensure appropriate safeguards are in place, including:

• Adequacy decisions issued by the Nigeria Data Protection Commission (NDPC) recognising the receiving country’s data protection framework as adequate;
• Standard Contractual Clauses (SCCs) or equivalent contractual safeguards approved under the NDPA;
• Binding Corporate Rules where applicable within group structures;
• Explicit consent of the data subject where no other mechanism applies.

We do not transfer personal data to jurisdictions that do not provide an adequate level of data protection without the safeguards described above.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, or as required for the establishment, exercise, or defence of legal claims. Our general retention guidelines are as follows:

Data Category	Retention Period	Basis
Client engagement files (legal/advisory)	7 years from the end of engagement	Legal obligation; Limitation Act
Plugin user account data (Pro)	Duration of subscription + 2 years	Contract: Legal obligation
Plugin user account data (Free)	Duration of active use + 1 year after last login	Legitimate interests
Payment and billing records	7 years	Tax and accounting legislation
Website contact form submissions	2 years from submission date	Legitimate interests
Training and event records	3 years from event date	Contract; Legitimate interests
Website analytics data	13 months (rolling)	Legitimate interests

Upon expiry of the applicable retention period, personal data is securely deleted, anonymised, or archived in accordance with our Data Retention and Deletion Policy.

9.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website. They enable us to recognise your browser, remember your preferences, and understand how visitors use our site.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function correctly. These cannot be disabled as they enable core features such as security and accessibility.
• Performance and Analytics Cookies: Help us understand how visitors interact with our website (e.g., pages visited, time on site). We use tools such as Google Analytics. Data collected is aggregated and anonymised where possible.
• Functionality Cookies: Enable personalisation and remember your preferences (e.g., language settings).

9.3 Cookie Consent

On your first visit to digitallord.com.ng, you will be presented with a cookie consent banner. Strictly necessary cookies are activated automatically. All other cookies are activated only upon your affirmative consent. You may withdraw cookie consent and manage your preferences at any time through your browser settings or our cookie management tool.

9.4 Third-Party Cookies

Our website may include third-party content or analytics tools that place their own cookies on your device. We recommend reviewing the privacy policies of those providers. We are not responsible for third-party cookies.

Subject to applicable law and verification of your identity, you have the following rights in respect of your personal data:

Right	Description
Right of Access	You may request a copy of the personal data we hold about you and information about how we process it.
Right to Rectification	You may request correction of inaccurate or incomplete personal data.
Right to Erasure	You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies.
Right to Restriction	You may request that we restrict processing of your data in certain circumstances (e.g., while accuracy is contested).
Right to Data Portability	You may request that we provide your data in a structured, machine-readable format, or transmit it to another controller.
Right to Object	You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
Right to Withdraw Consent	Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
Right Not to be Subject to Automated Decision-Making	You have the right not to be subject to decisions based solely on automated processing that produce significant legal effects, unless you have consented or it is necessary for a contract.
Right to Lodge a Complaint	You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, where the GDPR applies, with the relevant supervisory authority in your country.

To exercise any of the above rights, please submit a written request to info@digitallord.com.ng. We will respond within thirty (30) days of receiving a complete and verified request, or as required by applicable law. We do not charge a fee for processing reasonable requests. We may ask you to verify your identity before processing your request.

To lodge a complaint with the Nigeria Data Protection Commission (NDPC): Visit ndpc.gov.ng or write to the NDPC at its published address. You also retain the right to seek judicial redress through the courts.

SECTION 11: DATA SECURITY

We implement appropriate and proportionate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include: Encryption of data in transit using TLS/SSL protocols; Access controls and role-based permissions limiting access to personal data; Staff training on data protection and cybersecurity best practices; Secure deletion and disposal procedures for redundant data.

Despite these measures, no method of data transmission or storage is completely secure. We cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a high risk to your rights, we will notify you without undue delay as required by the NDPA.

SECTION 12: PROFESSIONAL CONFIDENTIALITY

Personal data shared with us in the context of legal advisory and compliance services is subject to legal professional privilege and strict confidentiality obligations in addition to data protection law. We will not disclose confidential client information except where required by law, court order, or with your express consent. Our confidentiality obligations extend to all staff, consultants, and sub-processors engaged in the delivery of our services.

SECTION 13: CHILDREN’S PRIVACY

Our services are directed at businesses and adult professionals. We do not knowingly collect, process, or store personal data of individuals under the age of 18 (or the applicable age of majority in the relevant jurisdiction). If we become aware that we have inadvertently collected personal data of a minor, we will take immediate steps to delete such data. If you believe we have inadvertently collected data relating to a minor, please contact us immediately at info@digitallord.com.ng.

SECTION 14: MARKETING COMMUNICATIONS

We may send you newsletters, legal updates, event invitations, and service announcements by email where you have: Subscribed via our website or registration forms; or Engaged us as a client and we reasonably believe our updates are relevant to your professional interests (legitimate interests basis, subject to your right to opt out).

Every marketing communication we send will include a clear and accessible unsubscribe mechanism. You may opt out at any time by: Clicking the ‘Unsubscribe’ link in any marketing email; Emailing info@digitallord.com.ng with the subject line ‘Unsubscribe’.

SECTION 16: LINKS TO THIRD-PARTY WEBSITES

Our website and publications may contain links to third-party websites, including regulatory bodies, legal databases, event platforms, and news sources. These sites have their own privacy policies and we are not responsible for their content or data practices. Visiting any linked third-party site is at your own risk and subject to their applicable terms and policies.

SECTION 17: CHANGES TO THIS PRIVACY POLICY

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in law, our services, or our data practices. Material changes will be communicated by: Posting the updated Policy on digitallord.com.ng with a revised ‘Effective Date’; Email notification to registered users and clients where the changes materially affect their rights; A prominent notice on our website for a period following any significant update.

SECTION 18: CONTACT AND COMPLAINTS

We are committed to handling all privacy-related enquiries, requests, and complaints promptly and fairly. To exercise your data subject rights, make a complaint, or raise any concern about how we handle your personal data, please contact: info@digitallord.com.ng.

Last updated by April 2026.