Legal

Privacy Policy

This Privacy Policy explains, in full, how Advocacy for the People through Law collects, uses, discloses, and protects personal

information across our website, our “Request Legal Help” intake process, and our broader advocacy work.

Effective Date: [Date] Last Updated: [Date] Version: 1.0

Nigeria Data Protection Act 2023 (NDPA) Aligned

GDPR-Informed Principles

End-to-End Encrypted Intake Form

01

Introduction & Scope

Advocacy for the People through Law (“AFPLAW,” “we,” “us,” or “our”) is a registered non-profit, non-political organisation committed to protecting the privacy and dignity of everyone we serve — a commitment that extends naturally to how we handle personal information.

This Privacy Policy applies to personal information we collect through:

1. Our website, www.afplaw.com, and any subdomains
2. Our “Request Legal Help” intake form and related legal correspondence
3. Our “Partner With Us” and general enquiry forms
4. Newsletter sign-ups and email communications
5. In-person or offline interactions where information is later stored digitally (e.g. legal aid clinics, training workshops)

By using our website or submitting information to us, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please do not submit personal information to us through the website, and contact us directly to discuss alternative arrangements.

02

Who We Are (Data Controller)

For the purposes of the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the EU General Data Protection Regulation (GDPR), the data controller responsible for your personal information is:

Advocacy for the People through Law (AFPLAW)

Registered as an Incorporated Trustee with the Corporate Affairs Commission of Nigeria · IT No. 9371200

Suit B13 Poly Plaza, Adetokunbo Ademola Crescent, Wuse 2, FCT, Nigeria

info@afplaw.org

03

Information We Collect

We collect only the personal information necessary to respond to you, provide our services, and operate our website responsibly. Depending on how you interact with us, this may include:

Examples

Purpose

Contact Information

Name, email address, phone number, postal address

Responding to enquiries, providing legal support

Case & Legal Matter Information

Details of your rights concern, supporting documents, location, affected community

Assessing and responding to “Request Legal Help” submissions

Partnership Information

Organisation name, role, area of interest

Evaluating and managing partnership enquiries

Newsletter Data

Email address, subscription preferences

Sending news and updates, only with consent

Technical Data

IP address, browser type, device type, pages visited

Website security, performance, and analytics

We do not knowingly collect sensitive personal data (such as health or biometric information) unless it is directly and necessarily relevant to a legal matter you have brought to us, in which case we apply heightened safeguards as described in Section 6.

04

How We Use Your Information

We use personal data to:

1. Respond to enquiries and provide legal, advisory, or consulting assistance
2. Assess, triage, and respond to “Request Legal Help” submissions
3. Evaluate and manage partnership and collaboration proposals
4. Send newsletters, case updates, and event announcements — only with your consent
5. Maintain internal records required for our accountability as a registered non-profit (e.g. annual reporting to the Corporate Affairs Commission)
6. Improve our website’s security, performance, and usability
7. Comply with applicable legal, regulatory, or judicial obligations

We do not use your personal information for automated profiling, targeted advertising, or any purpose unrelated to the reasons you provided it.

05

Legal Basis for Processing

We process personal data on one or more of the following legal bases, in line with the NDPA and, where relevant, the GDPR:

1. Consent — where you have actively agreed, such as subscribing to our newsletter or submitting the “Request Legal Help” form
2. Legitimate interest — our legitimate interest in providing legal aid, advocacy, and capacity-building services consistent with our registered mission
3. Legal obligation — where processing is required to comply with Nigerian law or regulatory reporting requirements
4. Vital interest — in rare circumstances, where processing is necessary to protect someone’s life, safety, or fundamental rights in an urgent rights violation matter

06

Data Security

We take data security seriously, particularly given the sensitivity of the legal matters people bring to us. Our safeguards include:

1. End-to-end encryption on all submissions through our “Request Legal Help” intake form
2. Restricted, role-based access to case-related personal data — limited to the legal and administrative staff directly handling a matter
3. Secure storage systems with regular access reviews
4. Confidentiality obligations for all staff, trustees, and volunteers handling personal data

All submissions through our secure intake form are encrypted end-to-end, from your browser to our legal team, in recognition of the sensitivity of rights violation matters.

While we take reasonable and industry-appropriate steps to protect your data, no system can guarantee absolute security. We encourage you to avoid sharing highly sensitive information over unsecured channels (such as public Wi-Fi) where possible.

07

Data Sharing & Disclosure

We do not sell, rent, or trade personal data. We may share limited personal information only in the following circumstances:

1. With trusted legal co-counsel, expert witnesses, or advisory partners directly involved in your matter, and only with your consent or as necessary to represent your interests
2. With courts, tribunals, regulatory bodies, or law enforcement where required by law or court order
3. With service providers who support our operations (e.g. email/newsletter platforms, secure form processors, hosting providers), each bound by confidentiality and data protection obligations
4. With the National Human Rights Commission or regional human rights bodies, where relevant to monitoring or reporting ESCR obligations, and consistent with our institutional collaboration mandate

08

International Data Transfers

Some of our service providers (such as email delivery, newsletter, or hosting platforms) may process data outside Nigeria. Where this occurs, we take reasonable steps to ensure such providers maintain data protection standards consistent with the NDPA’s cross-border transfer requirements, including contractual safeguards and, where applicable, adequacy assessments.

09

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including:

1. The duration of any legal matter or case, plus a reasonable period afterward for record-keeping and potential appeals
2. Any applicable statutory limitation periods under Nigerian law
3. Our own accounting, auditing, and annual reporting obligations as a registered non-profit

Newsletter subscriber data is retained until you unsubscribe or request deletion. Once retention periods lapse, personal data is securely deleted or anonymised.

10

Your Rights

Subject to applicable law, you have the right to:

1. Access the personal data we hold about you
2. Rectify inaccurate or incomplete data
3. Erase your data, where legally permissible (this may be limited for active or recently closed legal matters)
4. Restrict or object to certain processing activities
5. Withdraw consent for marketing communications or newsletter subscriptions at any time
6. Data portability, where technically feasible, for data you have provided to us directly
7. Lodge a complaint with the Nigeria Data Protection Commission (NDPC), or another applicable supervisory authority

To exercise any of these rights, please contact us using the details in Section 20. We will respond within a reasonable timeframe, consistent with applicable law.

11

Cookies & Tracking Technologies

Our website may use cookies and similar technologies to:

1. Remember your preferences and improve your browsing experience
2. Understand how visitors use our website, to improve its content and structure
3. Support essential website functionality (e.g. form submission, security)

You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of some parts of our website, such as form submissions

12

Request Legal Help Form

Our “Request Legal Help” form is designed with heightened care, given the sensitive nature of the matters it collects:

1. All submissions are transmitted using end-to-end encryption
2. Access is restricted to legal team members directly assessing intake requests
3. By submitting the form, you provide explicit consent for AFPL to collect and process the information provided, for the purpose of assessing and responding to your request
4. A clear consent checkbox accompanies the live form, separate from any other consent (such as newsletter sign-up)

If your matter is urgent, please contact us directly by phone rather than relying solely on the online form.

13

Newsletter & Marketing Communications

If you subscribe to our newsletter, we will use your email address only to send the updates you signed up for. You may unsubscribe at any time using the link in any email we send, or by contacting us directly. We do not share newsletter subscriber lists with third parties for their own marketing purposes.

14

Children's Privacy

Our website is not directed at children, and we do not knowingly collect personal data from children without appropriate parental or guardian consent. Where a legal matter directly involves a minor (for example, in cases of climate displacement or denial of healthcare access affecting a child), we apply additional safeguards, including obtaining consent from a parent, guardian, or appropriate representative wherever possible.

15

Third-Party Links

Our website may contain links to third-party websites, including partner organisations, social media platforms, or resource repositories. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

16

Automated Decision-Making

AFPLAW does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. All assessments of legal matters, partnership proposals, and case intake are reviewed by a member of our team.

17

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights or freedoms, we will notify the Nigeria Data Protection Commission (NDPC) and affected individuals without undue delay, in line with our obligations under the NDPA, and take prompt steps to contain and remediate the breach.

18

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Material changes will be indicated by updating the “Last Updated” date at the top of this page. We encourage you to review this Policy periodically.

19

Governing Law & Complaints

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 (NDPA). If you believe we have not handled your personal data in accordance with this Policy or applicable law, you have the right to lodge a complaint with:

Nigeria Data Protection Commission (NDPC)

www.ndpc.gov.ng

We would also welcome the opportunity to address your concerns directly before you escalate a complaint — please reach out using the contact details below.

20

Contact Us

Questions, requests, or concerns about this Privacy Policy or your personal data can be directed to:

Advocacy for the People through Law

Suite B13 Poly Plaza, Adetokunbo Ademola Crescent, Wuse 2, FCT, Nigeria