This page is a draft. It has not been settled with counsel and it is not final. Items shown in brackets are outstanding.

Privacy notice

This notice sets out what personal data Chukwudaalu & Co. holds, why it holds it, how long it is kept, and what you may require of us under the Nigeria Data Protection Act 2023. The data controller is Chukwudaalu & Co., registered with the Nigeria Data Protection Commission under registration [NDPC registration number].

This website

This website carries no forms. It sets no cookie for tracking, measurement or advertising, it runs no analytics, and it makes no request to any third party: no webfont, no content delivery network, no embedded video, no social media component, no tag of any kind. Nothing on any page is loaded from another host, so no other party learns that you visited this site.

One item is stored on your device, and only if you choose it. Using the light and dark control in the footer writes a single theme preference to your browser's local storage. It stays in the browser, it is never sent to us, and clearing your browsing data removes it. Without it the site follows your operating system's colour-scheme setting.

The hosting arrangement for this site, and the retention period for any server access log kept by the host, are [hosting arrangement and server log retention].

What we hold

We hold personal data about the people we deal with in the course of an enquiry or a mandate: name, business, role, contact address, telephone number and the correspondence between us. Where a mandate proceeds we hold, in addition, the identification and source-of-funds records required of us as an institution registered with the Special Control Unit against Money Laundering. We ask for nothing at first contact beyond what an enquiry itself contains.

Why we hold it

We rely on three lawful bases under the Act. Performance of a contract, for the conduct of a mandate and the engagement letter that governs it. Compliance with a legal obligation, for the identification, record-keeping and reporting required of us under anti-money-laundering and tax legislation. Our legitimate interests, for correspondence with a person who has approached the firm and for the conflicts register against which every prospective engagement is checked. Where we rely on your consent we say so at the time, and consent may be withdrawn.

Who sees it

We do not sell personal data and we disclose none of it for marketing, by us or by anyone else. In the course of a mandate, data is disclosed to the parties working on the transaction — counsel, auditors, tax advisers and, where the client instructs it, a counterparty — and to a regulator or a court where we are required to disclose it. We do not disclose the fact of an approach. Where data is held or processed outside Nigeria, the arrangement is [cross-border transfer arrangement].

How long we keep it

Mandate files, including identification and source-of-funds records, are retained for [mandate retention period] from the conclusion of the mandate. Correspondence with a person whose approach did not become a mandate is retained for [enquiry retention period]. At the end of the period the record is destroyed.

Your rights

Under the Act you may ask us for a copy of the personal data we hold about you, ask us to correct it where it is wrong or incomplete, ask us to delete it, ask us to restrict what we do with it, object to processing carried out on the basis of our legitimate interests, ask for it in a portable form, and withdraw a consent you have given. Some of these rights are qualified where the law requires us to keep a record. Where that applies to your request we say so, and we say which obligation it is.

Making a request

Requests and questions under this notice are made in writing to [data protection contact] at [data protection address]. We acknowledge a request within two business days and answer it within [statutory response period].

You may complain to the Nigeria Data Protection Commission about our handling of your data at any stage, whether or not you have raised it with us first. Our own procedure is at Complaints.