Privacy Policy
How Lummina handles personal data.
This Privacy Policy explains how Lummina Law Firm collects, uses, discloses and safeguards personal data when you interact with the website or the firm.
Last updated: 26 August 2026
1. Introduction
Lummina Law Firm ("Lummina," "we," "us," or "our") is a commercial law firm based in Plot 5, The Providence Street, Lekki Phase 1, Lagos State, Nigeria. We are committed to protecting the privacy and personal data of everyone who visits our website, engages our services, or otherwise interacts with us.
This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in accordance with the Nigeria Data Protection Act, 2023 ("NDPA") and the applicable regulations and guidance issued by the Nigeria Data Protection Commission ("NDPC"). By using our website, you acknowledge that you have read and understood this Policy.
2. Who We Are
Lummina Law Firm is the data controller responsible for personal data processed through this website.
Address: Plot 5, The Providence Street, Lekki Phase 1, Lagos State, Nigeria
Email: info@lumminalaw.com
3. Scope of This Policy
This Policy applies to personal data collected through our website, including when you fill out a contact or intake form, subscribe to updates, request a consultation, or otherwise communicate with us electronically. It does not govern personal data we process as part of an active client engagement, which is instead governed by the applicable engagement letter and our internal client confidentiality obligations.
4. Personal Data We Collect
Depending on how you interact with our website, we may collect:
- Identity data: full name, title, and organisation.
- Contact data: email address, phone number, and postal or business address.
- Enquiry data: details you provide in a contact form, intake form, or consultation request, including the nature of your legal matter.
- Technical data: IP address, browser type and version, device information, and general location derived from your IP address.
- Usage data: information on how you use our website, including pages visited and time spent, collected via cookies or similar technologies.
- Marketing data: your preferences in relation to receiving newsletters, alerts, or other communications from us.
5. How We Collect Your Data
We collect personal data directly from you when you interact with our website, for example by submitting a form; automatically as you navigate the site, via cookies and similar technologies; and, occasionally, from third parties such as referral partners, where you have consented to that referral.
6. Legal Basis for Processing
We rely on one or more of the following lawful bases recognised under the NDPA to process your personal data:
- Consent — where you have given clear consent, such as by submitting an enquiry or subscribing to communications.
- Contract — where processing is necessary to take steps at your request prior to entering into an engagement, or to perform an engagement with you.
- Legal obligation — where processing is necessary for us to comply with a legal or regulatory obligation, including anti-money laundering and know-your-client requirements.
- Legitimate interests — where processing is necessary for our legitimate interests in operating and improving our practice, provided this is not overridden by your rights and interests.
7. How We Use Your Data
We use personal data collected through our website to:
- Respond to enquiries and consultation requests.
- Assess potential conflicts of interest before accepting a new matter.
- Provide, manage, and communicate about our legal services.
- Send updates, newsletters, or thought leadership content, where you have opted in.
- Maintain and improve the security, functionality, and performance of our website.
- Comply with applicable legal, regulatory, and professional obligations.
8. Data Sharing and Disclosure
We do not sell personal data. We may share personal data with:
- Members of our legal and administrative team on a need-to-know basis.
- Service providers who support our operations, such as IT hosting, email, and practice management providers, under appropriate confidentiality and data processing terms.
- Regulators, courts, or other authorities, where required by law or professional obligation.
- Co-counsel or other advisers engaged on a matter, where necessary and, where appropriate, with your knowledge.
9. International Data Transfers
Where personal data is transferred outside Nigeria — for example, to a cloud service provider with servers in another country — we take steps to ensure the transfer complies with the NDPA, including verifying that the recipient jurisdiction offers an adequate level of protection or that appropriate safeguards, such as contractual clauses, are in place.
10. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements.
Enquiry data from individuals who do not become clients is ordinarily retained only for as long as needed to assess the enquiry, complete conflict checks, maintain appropriate records and comply with legal or professional obligations. It is then securely deleted or anonymised where appropriate, unless a longer period is required by law.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, secure storage, and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Your Rights Under the NDPA
Subject to applicable exceptions, you have the right to:
- Be informed about how your personal data is processed.
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete personal data.
- Request deletion of your personal data, where applicable.
- Object to or restrict certain processing, including direct marketing.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC).
13. Cookies and Tracking Technologies
Our website may use cookies and similar technologies to distinguish you from other users, remember your preferences, and understand how the site is used. Essential browser storage may be used to remember your analytics choice and support basic site functionality. Optional analytics are disabled unless you choose to allow them through the consent banner.
You can set your browser to refuse cookies or clear local browser storage, though some parts of the website may not function properly as a result. You can also continue using the website without allowing optional analytics.
14. Children's Privacy
Our website is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it.
15. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites and encourage you to review their privacy policies independently.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be indicated by a revised “Last updated” date, and we encourage you to review this Policy periodically.
17. Contact Us
If you have questions about this Privacy Policy, wish to exercise your rights, or wish to raise a concern, please contact us at:
Lummina Law Firm, Plot 5, The Providence Street, Lekki Phase 1, Lagos State, Nigeria
Email: info@lumminalaw.com
Telephone: 07060469068
Build with clarity
A legal partner for every stage of growth.
Whether you are building, investing, evolving or protecting what matters, Lummina provides clear, commercially intelligent guidance for what comes next.
Schedule a Consultation