Privacy Policy

Last Updated: 27 July 2026

Effective Date: 27 July 2026

This Privacy Policy applies to all personal data collected, used and processed by Ducex Solicitors Limited through our website, client portal, digital services, and legal practice. It should be read alongside our Cookie Policy, Terms of Use, Client Engagement/Retainer Agreement, Data Processing Agreements, and applicable jurisdiction-specific notices.

1. Introduction

Ducex Solicitors Limited(“Ducex Solicitors”, “Ducex”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal data and confidential information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise process personal data when you:

• Visit our website;
• Use our online platforms and digital services;
• Submit an enquiry;
• Use our Legal Navigator;
• Request a consultation or book an appointment;
• Contact us by email, telephone or other communication channels;
• Apply for employment or other opportunities;
• Use our client portal;
• Upload or exchange documents through our platform;
• Communicate with our lawyers, staff or representatives; or
• Otherwise interact with Ducex Solicitors.

This Privacy Policy applies to users located in Nigeria and internationally, subject to applicable local data-protection laws.

Ducex Solicitors generally acts as the data controller or equivalent responsible entity for personal data collected and processed through its website, legal enquiries, consultations, client relationships and business operations. Where we process personal data strictly on behalf of another organisation under its instructions, we may act as a data processor, service provider, or equivalent role under applicable law.

2. Important Information for Prospective Clients

2.1 Website enquiries do not automatically create a solicitor-client relationship

Submitting an online enquiry, using our Legal Navigator, sending an email or contacting Ducex Solicitors does not, by itself, establish a solicitor-client relationship. A solicitor-client relationship is established only where formally agreed in accordance with applicable professional and legal requirements.

2.2 Be careful when submitting confidential information

Until a formal professional relationship has been established, you should avoid submitting highly sensitive or confidential information through a general contact form. This is particularly important because:

• We may need to conduct conflict checks;
• We may not be able to accept your matter;
• Communications may not be protected by legal professional privilege until a professional relationship exists;
• General website communication channels may not provide the same security as our designated client communication systems.

3. Personal Data We May Collect

The personal data we collect depends on how you interact with us.

3.1 Identity and Contact Information

• Full name and preferred name
• Email address
• Telephone number
• Residential or business address
• Country and city
• Date of birth (where necessary)
• Nationality (where necessary)
• Preferred communication method

3.2 Enquiry and Consultation Information

• The legal area relevant to your enquiry
• General description of your legal issue
• Preferred consultation date, time and type
• Communication preferences
• Information required for conflict checks and client onboarding

3.3 Client and Matter Information

If you become a client, we may process information necessary to provide legal services, including matter details, legal instructions, correspondence, documents, contracts, property, corporate, financial, tax, litigation, court-related, family, estate, succession information, and information relating to opposing parties and other relevant individuals.

Where you provide us with another person's personal data, you should do so only where you have a lawful basis or authority to provide that information.

3.4 Sensitive and Special-Category Information

Depending on the nature of a legal matter, we may process data concerning:

• Health information (e.g. personal injury, employment, or family matters)
• Criminal allegations or proceedings (e.g. criminal defence matters)
• Biometric information
• Religious beliefs, political opinions, or sexual orientation where relevant to a matter
• Financial information
• Children's information (e.g. family, custody, or estate matters)
• Racial or ethnic origin where relevant

We process such information only where permitted by applicable law and where necessary for a legitimate legal, professional or business purpose. You should avoid submitting sensitive information unless reasonably necessary for your enquiry or legal matter.

3.5 Documents

You may provide identification documents, contracts, property documents, court documents, corporate documents, tax documents, estate documents, financial documents, correspondence, evidence and other documents relevant to a legal matter. Please do not upload unnecessary personal information.

3.6 Account and Authentication Information

For users of our client portal, we may process username, email address, account identifier, authentication information, password-related security information, login records, session information and multi-factor authentication information. We do not store passwords in readable plain text.

3.7 Communications

We may process information contained in emails, contact forms, portal messages, consultation communications, telephone records where lawfully recorded, customer-support communications and other communications with us.

3.8 Technical and Device Information

When you use our website or digital platforms, we may automatically receive: IP address, browser type, device type, operating system, approximate location derived from technical information, language preference, time zone, referring website, pages viewed, interaction information, error logs and security/diagnostic information.

We do not use technical information to identify you beyond what is reasonably necessary for legitimate purposes.

3.9 Cookies and Similar Technologies

We may use strictly necessary cookies, security and authentication cookies, preference cookies, analytics cookies and performance technologies. Non-essential cookies may require consent depending on applicable law. Please see our Cookie Policy for full details.

3.10 Employment and Recruitment Information

If you apply for employment, we may collect your CV, application information, qualifications, professional history, references, contact details, interview information and right-to-work information where legally required.

4. How We Collect Personal Data

Directly from you

For example when you complete a form, book a consultation, register an account, upload a document, contact us, communicate with a lawyer or apply for a position.

Automatically

Through website technologies, cookies, server logs, security systems, and device and browser information.

From third parties

Where lawful and necessary, we may receive information from clients, authorised representatives, referrers, professional advisers, courts, regulators, public authorities, publicly available sources, and other parties involved in a legal matter.

5. Why We Use Personal Data

5.3 Operating the Legal Navigator

Our Legal Navigator may process information you provide to identify a potentially relevant practice area, provide general educational information, suggest a possible next step, and direct you to relevant services. The Legal Navigator does not provide legal advice and should not be relied upon as a substitute for a qualified lawyer.

5.9 Business Administration

To manage our business, maintain records, manage accounts, process payments where applicable, manage suppliers and maintain internal operations.

5.10 Website Improvement

To understand how users interact with our website, improve usability, diagnose technical problems and improve our services.

5.11 Marketing

Where permitted by applicable law, we may send legal insights, firm news, educational materials, service updates and marketing communications. You may unsubscribe at any time. We do not condition the provision of legal services on your consent to receive marketing communications.

6. Legal Bases for Processing

Depending on the applicable law and circumstances, we may rely on:

• Consent — where you have freely given specific and informed consent. You may withdraw consent where applicable; withdrawal does not invalidate prior processing.
• Contract and pre-contractual steps — where processing is necessary to provide services, perform an agreement, or take steps you requested before entering into an agreement.
• Legal obligation — where processing is necessary to comply with a legal or regulatory obligation.
• Legitimate interests — for example cybersecurity, fraud prevention, business administration, conflict checks, service improvement and legal claims, where those interests are not overridden by your privacy rights.
• Vital interests — where necessary to protect life or physical safety.
• Legal claims — where necessary to establish, exercise or defend legal claims.
• Public interest — where recognised by applicable law.

7. Special Categories and Sensitive Personal Data

Some legal matters may involve information considered sensitive or specially protected under applicable law, including health, criminal, biometric, financial, religious, political, and children's information. We process such information only where it is necessary for a legitimate purpose, we have an appropriate lawful basis, applicable law permits the processing, and appropriate safeguards are applied.

8. Children's Privacy

Our general website and legal services are not intentionally directed at children unless a legal matter requires us to process information relating to a child (e.g. family, custody or estate matters). In those circumstances, information about children is processed where lawful and necessary for providing legal services, protecting the child's interests, or complying with legal obligations. We do not knowingly use children's personal data for targeted advertising.

9. How We Share Personal Data

We do not sell personal data as a business model. We may disclose personal data where necessary and lawful to:

9.1 Technology Providers

Our technology infrastructure includes:

The use of a technology provider does not mean that the provider may use client data for its own unrelated purposes. Where applicable law requires it, we enter into appropriate data-processing arrangements.

9.2 Professional Advisers

We may share information with accountants, auditors, insurers, consultants and other professional advisers where necessary and lawful.

9.3 Courts and Legal Authorities

Where necessary or legally required, we may disclose information to courts, tribunals, regulators, law-enforcement agencies and government authorities.

9.4 Other Parties Involved in Legal Matters

Where necessary to provide legal services, we may share information with opposing counsel, courts, expert witnesses, mediators, arbitrators, barristers, notaries and other authorised representatives.

9.5 Business Transactions

If Ducex Solicitors is involved in a merger, acquisition, restructuring, sale of assets or reorganisation, personal data may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

10. International Data Transfers

Because Ducex Solicitors serves international clients and uses technology providers that may process data in different countries, personal data may be transferred to or accessed from countries outside Nigeria or your country of residence.

Specifically:

• Data stored in Supabase may reside on AWS infrastructure in the United States or other AWS regions.
• Data processed by Netlify and Render is handled on servers in the United States.
• Data processed by our analytics tools may be transferred to and processed in the United States and other countries.

Where applicable law restricts international transfers, we will use appropriate lawful mechanisms, which may include adequacy decisions, Standard Contractual Clauses, approved contractual safeguards, or other legally recognised transfer mechanisms recognised under Nigeria's NDP Act, EU/UK GDPR, and other applicable frameworks.

11. Our Technology Infrastructure

USER
  ↓
DUCEX WEBSITE (www.ducexsolicitors.com)
  ↓
NETLIFY  (Frontend Hosting)
  ↓
NODE.JS BACKEND / API
  ↓
RENDER  (Backend Hosting)
  ↓
SUPABASE  (Database & Document Storage)

EMAIL: Business Webmail / SMTP

12. Legal Professional Confidentiality and Privilege

Ducex Solicitors is committed to maintaining appropriate confidentiality in relation to legal matters. However:

• Privacy protection is not identical to legal professional privilege;
• A Privacy Policy cannot create legal professional privilege;
• Privilege depends on applicable law and the circumstances of the communication;
• Communications before a professional relationship is established may not be privileged;
• We may be required to disclose information where legally required.

We apply appropriate confidentiality and access controls to legal information.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law. Indicative periods include:

When personal data is no longer required, we will delete it, anonymise it, aggregate it, or securely destroy it.

14. Data Security

We implement reasonable technical and organisational measures to protect personal data, including:

• HTTPS/TLS encryption for all data in transit
• Supabase database encryption at rest
• Role-based access controls on the client portal
• Password hashing (no plain-text password storage)
• Authentication controls on all portal accounts
• Activity logging and security monitoring
• Staff confidentiality obligations
• Incident-response procedures
• Backup and recovery controls

However, no internet transmission or storage system can be guaranteed to be completely secure. You should use strong passwords, avoid reusing passwords, protect your account credentials, log out of shared devices, and report suspicious activity promptly.

15. Data Breaches and Security Incidents

If we become aware of a personal-data breach, we will assess the incident and take steps required by applicable law. Depending on the circumstances, this may include containing and investigating the incident, assessing the risk, preserving evidence, notifying regulators (including the Nigeria Data Protection Commission), notifying affected individuals, and taking remedial action.

16. Your Privacy Rights

Depending on where you live and which law applies, you may have rights including:

• Right to be informed about how your personal data is processed;
• Right of access to personal data we hold about you;
• Right to rectification of inaccurate or incomplete personal data;
• Right to erasure (subject to lawful exceptions);
• Right to restrict processing in circumstances permitted by law;
• Right to object to certain processing activities;
• Right to data portability (where applicable);
• Right to withdraw consent where processing is based on consent;
• Rights relating to automated decision-making (where applicable);
• Right to complain to the relevant data-protection authority.

Rights may be subject to lawful exemptions, including obligations relating to legal professional confidentiality, legal claims, court proceedings, regulatory obligations and retention requirements.

17. How to Exercise Your Rights

To exercise a privacy right, contact us at: info@ducexsolicitors.com

Please include your full name, the right you wish to exercise, a description of your request, and sufficient information to help us verify your identity. We will respond within the timeframe required by applicable law. We may request additional information, apply lawful exemptions, restrict the scope of a response, or charge a lawful fee where permitted. If we cannot comply with a request, we will generally explain why, subject to legal restrictions.

18. California Privacy Rights

Where applicable California privacy law applies, California residents may have additional rights including the right to know or access personal information collected, request deletion or correction, and opt out of the sale or sharing of personal information. Ducex Solicitors does not sell personal information as a business model. We do not knowingly sell personal information of children. Where applicable California law (CCPA/CPRA) requires additional disclosures, we will provide those disclosures and rights mechanisms.

19. Marketing Communications

You may unsubscribe from marketing communications at any time by clicking the unsubscribe mechanism in any marketing email or by contacting us at info@ducexsolicitors.com. Opting out of marketing will not stop essential service communications, legal matter communications, security notifications, consultation management communications or other important service communications.

20. Cookies and Tracking Technologies

Our website may use cookies and similar technologies to operate essential website functions, maintain security, remember preferences, maintain authenticated sessions, understand website usage, and improve website performance. Where required, we will request consent before placing non-essential cookies. You may manage cookies through our cookie-consent mechanism, your browser settings or device settings. Blocking some cookies may affect website functionality. Please see our Cookie Policy for full details including specific cookies, purposes, providers, durations and consent controls.

21. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for their privacy practices, content, security or data-processing activities. You should review the privacy policy of each third-party website you visit.

22. Automated Processing and the Legal Navigator

Where applicable law provides rights relating to solely automated decisions that produce legal or similarly significant effects, those rights will be respected and appropriate human oversight applied.

23. Data Relating to Other People

If you provide personal data relating to another person, you should ensure that you are legally permitted to provide it, you have an appropriate lawful basis, the information is accurate, and you have informed the person where required by law. This is particularly important in family, property, corporate, litigation, criminal and estate matters.

24. Data Controller and Processor Roles

For personal data collected directly by Ducex Solicitors for our own purposes, we generally act as the controller or equivalent responsible entity. Where Ducex processes personal data on behalf of a client or another organisation under documented instructions, our role may be that of a processor or equivalent service provider. The legal role depends on the actual purpose and means of processing, not merely the label used in a contract.

25. Third-Party Processors

Our provider categories include website hosting, backend hosting, database infrastructure, secure document storage, email and SMTP, security services, analytics, communications and professional advisers. We seek to select providers that offer appropriate security and privacy safeguards and enter into appropriate data-processing arrangements where required by applicable law. Our provider list may change as our technology infrastructure evolves.

26. International Clients

If you access our services from outside Nigeria, your personal data may be processed in Nigeria and other jurisdictions where our service providers or professional advisers operate. Where applicable law requires a specific transfer mechanism, we will seek to use it.

27. Your Responsibility for Account Security

If you create an account, you are responsible for keeping your credentials confidential, using a strong password, and not sharing your login information. Notify us immediately at info@ducexsolicitors.com if you believe your password has been compromised, your account has been accessed without authorisation, or a document has been accessed improperly.

28. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, technology, providers, or data-processing practices. When we make material changes, we may provide additional notice where required. The “Last Updated” date at the top of this page indicates when the policy was most recently revised. The latest version will always be published on our website.

29. Contact Us

30. Supervisory Authorities

Depending on where you live, you may have the right to contact your local data-protection authority:

• Nigeria: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: Your local EU data-protection supervisory authority.
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd
• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au

31. Governing Privacy Principles

Ducex Solicitors seeks to process personal data in accordance with principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, accountability, privacy by design, and appropriate security. These principles are consistent with the direction of major data-protection frameworks, including Nigeria's NDP Act, the EU/UK GDPR, and other applicable legislation.

© 2026Ducex Solicitors Limited. All rights reserved.  |  Last Updated: 27 July 2026