Privacy Policy

UMA & UMA LP is a full-service law firm duly registered under the laws of the Federal Republic of Nigeria to provide legal services to local and international clients.

References in this policy to “we”, “us”, or "U&U" are references to Uma & Uma LP.

Reference in this notice to “personal data” means any information that identifies, or could reasonably be used to identify, a living individual, either on its own or with other information, in accordance with the Nigerian Data Processing Act 2023 (NDPA).

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data obtained in the course of our professional and business activities.

How We Obtain Personal Data

As a law firm, we obtain personal data in the ordinary course of providing legal and professional services. We may collect your personal data:

when you access or use our website;
when you complete a form on our website;
when you contact us by email, telephone, or through our social media platforms;
when you book an appointment with us;
when you subscribe to our publications, updates, or services; or
when personal data is provided to us by clients, counterparties, regulators, courts, or other third parties in connection with legal matters.

Scope of the Personal Data We Collect

The personal data that we collect and process may include:

basic information such as name, employer, title, age, and affiliations with a person or organisation;
contact information such as physical address, email address, and phone number(s);
technical information, i.e., information obtained from your visit to our website (including your IP address and related usage information);
confidential information provided to us by or on behalf of our clients or generated by us in the course of providing legal services;
details relating to your visits to our offices; and
any other information you voluntarily provide to us.

Legal Basis for Processing Your Personal Data

In accordance with the NDPA, we will only process your personal data for the following reasons:

To provide legal or professional services requested by you or your organisation.
To comply with applicable laws, regulations, court orders, or professional obligations.
To protect our legitimate interests or those of a third party, provided that such interests do not override your fundamental rights and freedoms.
To comply with your clear and explicit consent, which you may withdraw at any time.
To establish, exercise, or defend legal claims, or to administer justice for the public good.

How We Use Your Personal Data

Whether we obtain your personal data directly from you or from a third party, we will only use your personal data in connection with our professional activities (including the fulfilment of our legal or regulatory obligations). These “Authorised Uses” may include:

providing legal advice or other services to our clients;
managing our business relationship with you or your organisation, whether in connection with the delivery or procurement of goods and services or as your employer or former employer, including processing payments, accounting, billing and collection and related services;
complying with our statutory, regulatory, and professional obligations;
managing access to our offices, systems, and digital platforms;
responding to legal processes, court orders, and regulatory requests;
communicating updates, legal developments, events, or publications that may be of interest, where permitted by law;
Processing information that is necessary for the reasonable interest of U&U or third parties, provided that such interests do not override your interests or your fundamental rights and freedoms; and
for any purpose relating to the foregoing or for any purpose for which you provided the personal data to us.

If you have given us your express consent, we may process your personal data for additional purposes. Please note that you may withdraw your consent at any time, should you so wish.

Ways in which we may process your personal data may include:

communicating with you with respect to legal developments, announcements, events and our services which may be of interest to you;
issuing reviews or marketing materials;
gathering information regarding your preferences to improve the quality of our interaction with you, such as through website analytics or the tracking of our client publications; and
any other purpose for which you have given consent.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on data subjects.

Sharing Your Personal Data

Irrespective of how we obtain your personal data, it may be shared amongst our partners, associates, employees, and consultants strictly on a need-to-know basis. All members of our team will at all times ensure that a standard level of data protection is in place.
Where necessary, your personal data may be shared with third parties such as courts, regulators, professional advisers, service providers, or counterparties, in compliance with applicable data protection laws. Where we share or transfer your personal data outside Nigeria, we will ensure that appropriate safeguards are in place in accordance with the NDPA.

Keeping Your Personal Data Secure

We implement appropriate technical and organisational measures against unauthorised or unlawful processing of your personal data and against accidental loss or destruction of, or damage to, your personal data in accordance with our internal security procedures covering its storage, access and destruction. These measures include access controls, confidentiality obligations, secure storage systems, and internal data protection procedures. Personal data may be stored on our own technology systems or those of our vendors or in paper files.

Retaining Your Personal Data

We retain personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, to comply with legal or regulatory requirements, or to establish, exercise, or defend legal claims. Where consent is the sole legal basis for processing, your personal data will be deleted when you withdraw your consent, unless retention is otherwise required or permitted by law. We may retain your personal data for an additional period to the extent that deletion would require us to overwrite our automated disaster recovery backup systems or to the extent we deem it necessary to assert or defend legal claims during any relevant retention period.

Your Rights Regarding Your Personal Data

In accordance with the NDPA, you have the right to:

request confirmation as to whether we process your personal data;
access your personal data and obtain a copy of it;
request correction of inaccurate, incomplete, or outdated personal data;
request erasure of your personal data, subject to legal and professional retention obligations;
object to the processing of your personal data on grounds relating to your particular situation;
request restriction of processing in certain circumstances;
withdraw consent at any time where processing is based on consent;
request data portability, where applicable;
lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.

These rights may be limited where processing is required by law or professional obligations or where exemptions apply under the NDPA.

Privacy Policy Changes

This Privacy Policy is effective from November 2025. We reserve the right to amend this Privacy Policy from time to time to reflect changing legal requirements or our processing practices. Such changes will be operative upon the date any updated versions of our Privacy Policy are uploaded to our website.

How to Contact Us

If you have any questions or concerns about our Privacy Policy, please contact us via:

Email: contact@umaumalp.com

Tel: (+234) 706 390 6162

Thank you for working with us.