Your Data, Handled Like a Brief

Equibridge Attorneys ("EBA", "the firm", "we") is a law firm at 18, Godab Estate, Lifecamp, Abuja. For the purposes of the Nigeria Data Protection Act 2023, we are the data controller for the personal data described in this policy — meaning we decide why it is held and what is done with it, and we answer for that.

This policy covers this website, our case tracker, and the personal data we handle in the ordinary course of acting for clients.

Only what we actually need. In practice that falls into three buckets:

• Enquiry details. If you use the contact form or write to us: your name, email address, phone number, the service you selected, and whatever you choose to tell us about your matter.
• Client and matter data. Once you instruct us: identification and onboarding records, the documents and facts relevant to your brief, correspondence, and the fee and payment records we are required to keep.
• Class action registrations. If you register interest in a group action: your contact details, the flight and booking details, what the disruption cost you and the documents you hold. Section 06 sets out where that goes.
• Nothing behavioural. No cookies, no analytics, no advertising pixels, no session recording, no fingerprinting. We do not build a profile of you, because we have no use for one. The one item stored on your device is a flag remembering that you have dismissed an announcement — it identifies nothing and is never read by us.

Worth being precise about, because it is unusual: this website has no backend. The contact form does not transmit anything to a server of ours. When you press send, it opens a message in your own email application, pre-filled with what you typed — you remain in control, and nothing leaves your device until you choose to send it.

Under the NDPA 2023 we must have a lawful basis for every use. Ours are:

• Performance of a contract — to carry out the retainer or engagement you have instructed us on.
• Legal obligation — to meet the professional, regulatory, anti-money-laundering and record-keeping duties that bind legal practitioners.
• Legitimate interests — to respond to enquiries, run the firm, pursue or defend legal claims, and keep our systems secure.
• Consent — where we ask for it specifically, and which you may withdraw at any time without it affecting what was lawful before.

Clients whose matters are live can be given access to our case tracker — the internal business tool we use to monitor progress on each brief. Some specifics, since it holds the most sensitive data we have:

• Access follows onboarding. A tracker is released only after a client has been properly onboarded to the firm and the necessary payments have been made.
• Two parties, no one else. A matter's ledger is visible to that client and to the lawyers assigned to that brief. No other client, and no unassigned member of the firm, can open it.
• Access is granted deliberately. Adding or removing a person from a matter is a recorded act by the firm. It never happens automatically.
• Nothing is published. Tracker pages are not indexed by search engines and are not reachable by anyone who has not been given the link and the credentials.

If you register your interest in a group action — such as the Air Peace flight delay suit on our class actions page — this is what happens to what you give us.

• What we ask for. Your name and contact details, the flight and booking details, what the disruption cost you, which supporting documents you hold, and whatever else you choose to tell us. You are also asked whether you would consider standing as a lead claimant.
• It reaches us by email, and nowhere else. Registering opens a pre-written message in your own email application, addressed to admin@ebafirm.com. Nothing is submitted through this website and no third party stores your answers on the way — the message goes from your mail provider to ours, like any other email you send us.
• Why we hold it. To assess whether a viable group claim exists, to build and verify the claimant list, and to contact you about the action.
• Who sees it. The lawyers at this firm working on the action, and the non-governmental organisation bringing it, under equivalent duties of confidence. If the action is filed, the material necessary to your claim goes before the court.
• Registering is not instructing us. It does not, by itself, make you a client of this firm. We will tell you plainly, before anything is filed, if that is about to change.

Narrowly, and never for money:

• Courts, tribunals and registries — where conducting your matter requires a filing or a service.
• Counsel, experts and agents — instructed on your brief, under equivalent duties of confidence.
• Regulators and authorities — only where the law compels disclosure, and only so far as it compels it.
• Service providers — such as our email and document infrastructure, bound to process data only on our instructions.
• A co-claimant organisation — where a group action is brought with a non-governmental organisation, the claimant material necessary to that action, under equivalent duties of confidence.

We do not sell, rent or trade personal data. If a transfer outside Nigeria is ever necessary to conduct a matter, we do it only on a basis the NDPA 2023 permits.

Only as long as the purpose or the law requires — then it goes.

• Access on a need-to-know basis — matter data is available to the lawyers conducting that brief, not to the firm at large.
• Confidentiality obligations — every member of the firm is bound by professional duties of confidence that outlast their time with us.
• Secured infrastructure — our systems are the state-of-the-art technological structure the firm was built around, kept current deliberately.
• Breach response — if a personal data breach occurs and the NDPA 2023 requires notification, we notify the Nigeria Data Protection Commission, and you, within the time the law allows.

Under the NDPA 2023 these are yours to exercise. Tap any of them to see what it means in practice.

If you think we have handled your data badly, tell us first — we would rather fix it than have it escalated, and we will look at it seriously. You are equally entitled to go straight to the Nigeria Data Protection Commission (NDPC), the supervisory authority for data protection in Nigeria, and to seek a remedy through the courts. Coming to us first does not cost you either of those routes.

When the law moves or our practice changes, this policy changes with it. The revision date at the top of the page always reflects the current version. Where a change materially affects clients with live matters, we tell them directly rather than relying on them to notice.

Data protection questions go to the same people who handle our clients' data protection matters.