Effective Date: 9th September, 2026
This Privacy Policy explains how Forgiven Fourwinds Attorneys (“FFA,” “Forgiven Fourwinds,” “we,” “us,” or “our”) collects, uses, stores, discloses and protects personal data relating to individuals who interact with our Website, contact us, request or receive our legal services, subscribe to our publications, apply for employment or other opportunities, attend our events, or otherwise engage with the Firm.
This Policy applies to personal data processed in connection with:
This Policy should be read together with our Website Terms & Conditions, Cookies Policy, and any other applicable privacy notices issued by the Firm.
By using our Website or providing personal data to us, you acknowledge the processing described in this Policy. Where applicable law requires consent, we will obtain it in accordance with applicable law.
Forgiven Fourwinds Attorneys is a full-service Nigerian law firm delivering strategic legal and business solutions with a stated commitment to excellence, integrity and purpose. The Firm advises clients within and outside Nigeria across commercial, regulatory and dispute-related matters.
The Firm’s published areas of legal expertise include corporate, commercial and compliance matters; real estate and property development; litigation and dispute resolution; startup structuring and funding; sports law and advisory; and business development and specialist advisory, including intellectual property, data protection, technology transactions and policy advocacy.
For purposes of the Nigeria Data Protection Act 2023 (“NDPA”), Forgiven Fourwinds Attorneys may act as a Data Controller in respect of personal data processed for its own business, administrative, recruitment, marketing and client-management purposes.
Depending on the nature of a particular engagement, the Firm may also process personal data on behalf of a client or another organisation. It may therefore act as a Data Processor or otherwise process personal data pursuant to the documented instructions of another controller.
When processing personal data, we are guided by the following principles:
This Policy applies to personal data relating to:
Where the Firm processes personal data on behalf of a client or another Data Controller, the relevant client’s privacy notice or applicable contractual arrangement may also apply.
We collect different categories of personal data depending on the nature of your relationship with Forgiven Fourwinds Attorneys.
Category | Specific Data | When Collected |
Identity Data | Name, title, date of birth where necessary, nationality, photograph where provided | Client onboarding, recruitment, events and other interactions |
Contact Data | Email address, telephone number, residential/business address and correspondence details | Enquiries, client onboarding and communications |
Professional Data | Employer, job title, professional qualifications, professional memberships and business affiliations | Client onboarding, recruitment and professional engagements |
Client/Engagement Data | Information contained in instructions, correspondence, contracts, transaction documents, legal documents and other matter-related records | During legal engagements |
Identification & Verification Data | Identification documents, signatures, beneficial ownership information and other verification information | Client due diligence and regulatory/legal compliance |
Financial Data | Billing information, bank/payment details, transaction information and payment records | Billing, invoicing and payment administration |
Legal/Matter Data | Information relating to disputes, claims, transactions, regulatory matters, investigations, arbitration and court proceedings | Where relevant to a legal matter |
Sensitive/Confidential Information | Information contained in legal instructions or documents that may include sensitive personal data or other confidential information | Where necessary for a legal engagement |
Recruitment Data | CV, employment history, qualifications, references and information submitted during recruitment | Recruitment and employment processes |
Communications Data | Emails, messages, enquiries, consultation requests and correspondence with the Firm | Whenever you communicate with us |
Marketing Preferences | Newsletter subscription status, communication preferences and areas of interest | Newsletter and marketing subscription |
Event Data | Name, organisation, contact details and attendance information | Seminars, webinars and events |
Technical Data | IP address, browser/device information, operating system, pages visited, access times and related technical information | Automatically when using the Website |
Cookie Data | Information collected through cookies and similar technologies | Website use, subject to our Cookies Policy |
If you provide us with personal data relating to another person, for example, a director, employee, witness, beneficiary, family member, customer or other individual, you should ensure that you are authorised to provide that information and that the individual has been informed where required by applicable law.
We may collect personal data:
In the course of providing legal services, we may receive personal data from our clients, counterparties, witnesses, experts, professional advisers, regulators, courts, public authorities and other persons connected with a matter.
Where appropriate and lawful, we may obtain information from publicly available sources, corporate registries, court records, regulatory databases, professional directories and other legitimate sources.
When you use our Website, we may automatically collect certain technical information through cookies and similar technologies.
See our separate Cookies Policy for further information.
Under the NDPA, we must process personal data on a lawful basis. Depending on the circumstances, Forgiven Fourwinds Attorneys may rely on one or more of the following lawful bases:
Purpose | What We Do | Legal Basis |
Providing legal services | Receiving instructions, advising clients and carrying out legal work | Contract/legitimate interest |
Client onboarding and due diligence | Verifying identity, ownership, authority and other relevant information | Legal obligation/legitimate interest/contract |
Managing legal matters | Conducting transactions, litigation, arbitration, negotiations, regulatory matters and other engagements | Contract/legitimate interest/legal obligation |
Regulatory compliance | Complying with applicable laws, professional obligations, court requirements and regulatory requests | Legal obligation |
Conflict checks | Checking for actual or potential conflicts before accepting or continuing an engagement | Legitimate interest/legal/professional obligation |
Communicating with clients and contacts | Responding to enquiries and communicating regarding matters and services | Contract/legitimate interest/consent, where applicable |
Billing and accounting | Preparing invoices, receiving payments and maintaining financial records | Contract/legal obligation/legitimate interest |
Recruitment | Assessing applications and managing recruitment | Legitimate interest/contract/consent, where applicable |
Business development | Maintaining professional relationships and developing the Firm’s services | Legitimate interest/consent, where required |
Newsletters and publications | Sending legal updates, insights, publications and event information | Consent/legitimate interest, where permitted |
Events and seminars | Registering participants and administering events | Contract/legitimate interest/consent |
Website improvement | Analysing Website performance and improving content and functionality | Consent/legitimate interest, depending on the technology used |
Security and fraud prevention | Detecting, preventing and investigating security incidents, fraud and misuse | Legitimate interest/legal obligation |
Protecting legal rights | Establishing, exercising or defending legal claims | Legitimate interest/legal obligation |
Business administration | Managing the Firm’s operations, records, personnel and professional relationships | Legitimate interest/contract/legal obligation |
We will generally use personal data only for the purposes for which it was collected or for another purpose permitted by applicable law.
Where we intend to process personal data for a materially different purpose, we will provide appropriate information and, where required, obtain consent or establish another lawful basis before doing so.
As a law firm, Forgiven Fourwinds Attorneys recognises the importance of confidentiality in its professional relationships.
7.1 Information provided to us in connection with a legal engagement may be subject to professional confidentiality obligations and, where applicable, legal professional privilege.
7.2 Submission of information through a Website contact form, email, social media platform, WhatsApp or other communication channel does not automatically create a solicitor-client relationship or legal professional privilege.
7.3 You should avoid submitting highly confidential, privileged or commercially sensitive information through an unsecured or publicly accessible channel unless we have specifically requested that information.
7.4 Where the Firm acts for a client, information may be accessed by authorised lawyers, employees, consultants, experts, professional advisers and service providers where reasonably necessary to provide the relevant legal services, subject to applicable
confidentiality obligations.
7.5 Nothing in this Privacy Policy is intended to reduce or override any confidentiality or privilege protection applicable under Nigerian law or the professional obligations governing legal practitioners.
Subject to applicable law and the legitimate requirements of our professional practice:
Depending on the circumstances and subject to applicable confidentiality and legal obligations, personal data may be shared with:
Personal data may be accessed by partners, lawyers, employees, trainees, consultants and other authorised personnel where necessary to perform their functions.
Where necessary to perform an engagement, information may be shared with a client or persons authorised by the client.
We may disclose information where required or permitted by law, court order, regulatory requirement or applicable professional obligation.
We may engage or work with accountants, auditors, valuers, experts, consultants, investigators, foreign counsel and other professional advisers where reasonably necessary for a legal matter or Firm administration.
We may use third-party service providers for functions including:
Such providers will only receive information reasonably necessary for the services they provide and will be subject to appropriate contractual or other safeguards where required.
We may disclose personal data where required or permitted by applicable law, including where necessary to prevent or investigate unlawful activity.
We will not otherwise disclose personal data to unrelated third parties except where authorised by you, permitted or required by law, or otherwise supported by a lawful basis.
Forgiven Fourwinds Attorneys may use service providers, professional advisers, technology platforms or other resources that process personal data outside Nigeria.
Where personal data is transferred outside Nigeria, we will take reasonable steps to ensure that the transfer and subsequent processing comply with applicable Nigerian data protection requirements.
Depending on the circumstances, appropriate safeguards may include contractual protections, adequacy arrangements or other lawful transfer mechanisms recognised under applicable law.
Where the Firm acts as a Data Processor for a client, international transfers may also be governed by the client’s instructions and applicable contractual arrangements.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account our legal, regulatory, professional, contractual and legitimate business requirements.
Retention periods may therefore vary depending on the nature of the information.
Data Type | Retention Approach |
Client and matter records | For the duration of the engagement and thereafter for the period required by applicable law, professional obligations, limitation periods and legitimate record-keeping requirements |
Client identification/due diligence records | In accordance with applicable legal and regulatory requirements |
Legal correspondence and documents | For the duration of the matter and an appropriate post-matter retention period |
Accounting and billing records | For the period required by applicable law and legitimate financial/accounting requirements |
Recruitment records | For the duration of the recruitment process and an appropriate period thereafter, unless longer retention is justified or consent is obtained |
Newsletter/marketing data | Until you unsubscribe or withdraw consent, subject to limited suppression records |
Event registration data | For the period reasonably necessary to administer the event and related records |
Website/contact enquiries | For as long as reasonably necessary to respond to and administer the enquiry and any resulting relationship |
Technical/security data | For a period reasonably necessary for security, auditing, troubleshooting and legitimate business purposes |
Where information is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it, unless we are required or permitted by law to retain it.
Subject to applicable legal conditions and limitations, you may have the following rights in relation to your personal data:
Requests concerning your personal data should be directed to Forgiven Fourwinds Attorneys using the contact details in Section 16.
We may need to verify your identity before responding to a request.
We will respond to valid requests within the period required by applicable law.
Where we rely on consent to process personal data, for example, certain marketing communications or non-essential cookies, we will request consent appropriately.
You may withdraw consent at any time where processing is based on consent.
Withdrawal of consent does not affect processing that was lawful before withdrawal.
For detailed information about the cookies and similar technologies used on our Website, please see our separate Cookies Policy.
Forgiven Fourwinds Attorneys takes reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful processing.
Depending on the circumstances, these measures may include:
Access to confidential client and matter information is restricted to persons who require access for legitimate professional or operational purposes.
However, no method of electronic transmission or storage is completely secure. Accordingly, while we take reasonable precautions to protect personal data, we cannot guarantee absolute security.
If Forgiven Fourwinds Attorneys becomes aware of a personal data breach, we will take reasonable and appropriate steps to:
Where the Firm is processing personal data on behalf of a client or another Data Controller, we will follow the applicable contractual and legal requirements concerning breach notification.
If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have a privacy-related concern, please find our contact details on our contact page.
Our legal and business services are primarily directed towards adults, businesses and organisations.
The FFA Website is not specifically directed at children, and we do not knowingly seek to collect personal data from individuals under the age of 18 through general Website features.
However, in the course of legal practice, it may be necessary for Forgiven Fourwinds Attorneys to process personal data relating to a child, for example, where a child is a client, beneficiary, witness or otherwise involved in a legal matter.
Where we process children’s personal data, we will apply the additional protections required by applicable Nigerian data protection law and will process such information only where there is an appropriate lawful basis.
Where consent is required, we will obtain consent from a parent, legal guardian or other person legally authorised to provide it, subject to applicable law.
If you believe that a child has provided personal data to us through the Website without an appropriate lawful basis, please contact us using the details in Section 16.
We may update this Privacy Policy from time to time to reflect:
Where changes are material, we may provide additional notice through the Website, email or other appropriate communication channels where reasonably practicable
