Privacy Policy

LEGALWOX

Effective Date: 17th August, 2026

LegalWox values your privacy and is dedicated to safegarding and protecting any information we collect about you. This Privacy Policy outlines how LegalWox ("LegalWox", "we", "us", or "our") collects, uses, processes, stores, discloses, and protects personal data obtained through our website (the "platform") and in connection with the services we provide.

LegalWox provides digital workflow automation, case management, document drafting, time tracking, billing support, and related legal technology services to law firms and legal practitioners (collectively referred to as our "Users"). During operating the Platform and delivering our services, we may process personal data relating to users, legal professionals, and, where applicable, their clients.

We are committed to protecting the privacy, confidentiality, and security of personal data entrusted to us.

LegalWox processes personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable data protection and privacy laws. Depending on the context of processing:

Law firms using the Platform act as Data Controllers in respect of personal data relating to their clients and matters; and
LegalWox acts as a Data Processor, processing such data strictly on the documented instructions of the law firm.

In certain instances, LegalWox may act as a Data Controller in relation to personal data collected directly from users for account registration, platform administration, billing, security monitoring, and compliance purposes.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein.

Table of Contents

Categories of Personal Data Collected
Purpose of Processing
Legal Basis for Processing
Data Sharing
Data Retention
Data Subject Rights
Updates on Privacy Policy
Security Measures
Breach Notification
Contact Information

Categories of Personal Data Collected

In the course of operating the Platform and providing our services, LegalWox may collect and process different categories of personal data, depending on the nature of your interaction with us and the services being used.

i. Law Firm Information

We may collect information relating to law firms and other legal entities that register to use our services. This may include:

The name of the law firm or legal entity
Business address and contact details
Corporate registration details (including registration number where applicable)
Administrative contact information

This information is collected for account creation, verification, billing administration, regulatory compliance, and general service delivery purposes.

ii. Lawyer and Authorized User Information

Where individual lawyers, partners, associates, or staff members are granted access to LegalWox, we may process personal data relating to such authorized users, including:

Full name
Email address
Telephone number
Professional identification details (such as Nigerian Bar Association enrollment details or other licensing information, where applicable)
Login credentials and account activity information

This data is processed to manage user accounts, authenticate access, provide customer support, ensure platform security, and facilitate communication regarding the services.

iii. Client and Matter-Related Data (Uploaded by Law Firms)

Law firms and legal practitioners using LegalWox may upload or input personal data relating to their clients, opposing parties, witnesses, or other individuals in connection with legal matters ("User Content"). Such data may include:

Names and contact details
Identification information
Case or matter files
Correspondence
Contracts and legal documents
Financial or billing records
Other information necessary for legal representation

In relation to this category of data, the relevant law firm or legal practitioner acts as the Data Controller, and LegalWox processes such data strictly as a Data Processor in accordance with the Nigeria Data Protection Act, 2023 (NDPA).

iv. Technical and Usage Data

When users access or interact with the Platform, we may automatically collect certain technical information to maintain security, improve performance, and ensure proper functionality. This may include:

IP Address: The Internet Protocol (IP) address assigned to your device, which helps us identify the general location of access, detect suspicious activity, and enhance system security.
Browser Type and Version: Information about the web browser used to access the Platform(e.g., Chrome, Firefox, Safari), which assists us in optimizing compatibility and improving user experience.
Device Information: Details about the device used to access the Platform, such as device type, model, and unique identifiers, where applicable.
Operating System: Information about the operating system running on your device (e.g., Windows, macOS, Android, iOS) to ensure proper system functionality.
Date and Time of Access: Records of when users access the Platform, which help us monitor usage patterns, investigate incidents, and maintain audit trails.
Log Files and Usage Activity: Information relating to user interactions with the Platform, including pages visited, features accessed, session duration, and error reports.

This information helps us detect unauthorized access, prevent fraud, diagnose technical issues, and enhance user experience.

All personal data collected is processed in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and is handled with appropriate technical and organizational safeguards.

Purpose of Processing

LegalWox processes personal data for legitimate and lawful purposes connected to the operation of the Platform and the delivery of our services. The purposes for which we process personal data include the following:

i. Service Delivery

We process personal data to provide, operate, and maintain the services offered through the Platform. This includes creating and managing user accounts, enabling access to features, facilitating communication, and ensuring that the services function as intended. Personal data is necessary to identify authorized users, verify firm credentials, and deliver tools tailored to legal practice needs.

ii. Case Management

LegalWox processes data to enable law firms and legal practitioners to manage legal matters efficiently. This includes organizing case files, storing documentation, tracking matter progress, and maintaining structured records within the system. In relation to client and matter-related data uploaded by law firms, LegalWox acts strictly as a Data Processor under the Nigeria Data Protection Act, 2023 (NDPA), processing such information solely on the instructions of the relevant law firm.

iii. Time Tracking

Personal data may be processed to support time recording and activity tracking features within the system. This allows legal practitioners to log billable and non-billable hours, monitor productivity, and generate reports for internal or client-facing purposes. Such processing helps ensure accurate documentation of professional services rendered.

iv. Billing and Financial Administration

We process relevant personal and business information for subscription management, invoicing, payment processing, and financial record-keeping. This may include processing contact details, transaction records, and payment-related information. Such processing is necessary to fulfill contractual obligations and comply with applicable financial and tax regulations in Nigeria.

v. Platform Improvement

Technical and usage data may be processed to evaluate how the Platformis used, identify areas for improvement, and enhance functionality, reliability, and user experience. This enables us to refine system performance, develop new features, and ensure the platform remains responsive to the needs of legal professionals.

vi. Security Monitoring

Personal data, particularly technical and log information, may be processed to safeguard the integrity, confidentiality, and availability of the Platform. This includes detecting unauthorized access, preventing fraud, investigating suspicious activity, maintaining audit trails, and ensuring compliance with legal and regulatory obligations under Nigerian law. Security monitoring is essential to protect sensitive legal and client-related information handled through the system.

All processing activities are carried out in accordance with the Nigeria Data Protection Act, 2023 (NDPA), and are supported by appropriate legal bases and technical safeguards.

Legal Basis for Processing

We rely on one or more of the following legal grounds:

i. Performance of a Contract

We process personal data where it is necessary for the performance of a contract to which the user or law firm is a party, or in order to take steps at the request of a user prior to entering into a contract.

This includes processing personal data for:

Account registration and administration
Service delivery and platform access
Subscription management
Billing and payment processing
Customer support

Without such processing, we would be unable to provide the requested services.

ii. Compliance with Legal Obligations

We may process personal data where necessary to comply with applicable laws and regulatory requirements in Nigeria. This may include obligations relating to:

Financial record-keeping and taxation
Regulatory compliance
Lawful requests from public authorities
Security and fraud prevention measures

Where disclosure is legally required, we will limit such disclosure to what is necessary and lawful.

iii. Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided that such interests do not override the fundamental rights and freedoms of the data subject.

Our legitimate interests may include:

Improving and developing the Platform and services
Ensuring system security and preventing unauthorized access
Monitoring Platform performance
Conducting internal analytics
Protecting our legal rights and enforcing our terms

In assessing legitimate interests, we consider the potential impact on data subjects and implement safeguards to ensure fairness and proportionality.

iv. Consent

In certain circumstances, we may rely on the data subject's consent as a lawful basis for processing personal data. Where consent is required, it will be obtained in a clear and transparent manner.

Data subjects have the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

v. Processing on Behalf of Law Firms (Data Processor Role)

Where LegalWox processes client or matter-related data uploaded by law firms, we do so strictly on the documented instructions of the relevant law firm acting as the Data Controller. In such cases, the legal basis for processing is determined by the law firm, and LegalWox processes the data in accordance with its obligations under the NDPA.

All processing activities are conducted with appropriate technical and organizational safeguards to ensure the confidentiality, integrity, and availability of personal data.

Data Sharing

LegalWox does not sell, rent, or trade personal data. We only share personal data where it is necessary for legitimate business purposes, service delivery, or to comply with legal obligations, and always in accordance with the Nigeria Data Protection Act, 2023 (NDPA).

Personal data may be shared in the following circumstances:

i. Service Providers and Technology Partners

We may engage trusted third-party service providers to support the operation of the Platformand delivery of our services. These may include:

Cloud hosting and data storage providers

Payment processors and financial service providers

IT support and system maintenance vendors

Analytics and security monitoring providers

Where such third parties process personal data on our behalf, they do so strictly under contractual obligations requiring confidentiality, data protection, and compliance with applicable Nigerian data protection laws. They are permitted to process personal data only for specified purposes and not for their own independent use.

ii. Law Firms and Authorized Users

Where necessary for the proper operation of the services, personal data may be accessible to authorized users within the relevant law firm account. Access is restricted based on role and permissions within the system.

In respect of client and matter-related data uploaded by law firms, LegalWox acts solely as a Data Processor and does not disclose such data except:

On the documented instructions of the relevant law firm; or
As required by law.

iii. Legal and Regulatory Requirements

We may disclose personal data where required to do so by applicable Nigerian laws or in response to lawful requests from courts, regulatory authorities, law enforcement agencies, or other competent governmental bodies.

In such cases, we will ensure that disclosure is limited to what is legally required and proportionate to the request.

iv. Business Transfers

In the event of a merger, acquisition, restructuring, or transfer of assets, personal data may be transferred as part of the transaction, subject to appropriate confidentiality safeguards and compliance with the NDPA.

v. Protection of Rights and Security

We may disclose personal data where necessary to:

Enforce our legal rights or contractual terms;
Investigate fraud, security breaches, or unlawful activities;
Protect the rights, property, or safety of LegalWox, our users, or third parties.

Where personal data is transferred outside Nigeria, we will ensure that such transfer complies with the requirements of the NDPA and that appropriate safeguards are implemented to ensure an adequate level of data protection.

Data Retention

LegalWox retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, including the provision of our services, compliance with legal obligations, resolution of disputes, enforcement of contractual rights, and protection of legitimate business interests. In accordance with the Nigeria Data Protection Act, 2023 (NDPA), we ensure that personal data is not retained longer than necessary and that all retention decisions are based on lawful, fair, and justifiable grounds.

If you are an authorized user whose access to the platform is governed by a Subscription Agreement between your law firm or employer and LegalWox, your personal data will be retained and deleted in accordance with the terms of that Subscription Agreement and the documented instructions of the subscribing law firm acting as the Data Controller.

Personal data processed in connection with an active contractual relationship will be retained for as long as necessary to provide the services, manage the subscription, administer accounts, resolve disputes, enforce contractual rights, and protect legitimate business interests. Following termination or expiration of the contractual relationship, certain data may be retained where necessary for compliance, record-keeping, audit purposes, fraud prevention, or the establishment, exercise, or defense of legal claims.

Where LegalWox processes personal data on behalf of subscribing law firms in its capacity as a Data Processor, such data will be retained, returned, or deleted in accordance with the law firm's documented instructions and the applicable Subscription Agreement, unless continued retention is required by law.

Personal data that LegalWox is under a legal obligation to retain under applicable Nigerian laws, regulatory requirements, or lawful directives from competent authorities will be retained strictly in accordance with such obligations and will not be processed for incompatible purposes.

Where no legal, contractual, or legitimate basis for continued retention exists, LegalWox will securely delete, anonymize, or irreversibly de-identify the personal data. We implement appropriate technical and organizational measures to ensure that retained data remains protected against unauthorized access, accidental loss, destruction, or misuse.

Data Subject Rights

Under applicable data protection laws in Nigeria, you have the right to control how your personal data is collected, used, and retained. LegalWox is committed to facilitating the exercise of these rights in a professional, secure, and timely manner.

Your rights include:

Right of Access -- You have the right to request confirmation of whether we process your personal data, and if so, obtain a copy of the information we hold about you. This includes information regarding the purpose of processing, the categories of data involved, recipients of the data, and retention periods. LegalWox provides access to ensure transparency and to empower you to make informed decisions about your personal data.
Right to Rectification -- You may request correction of inaccurate or incomplete personal data. LegalWox will take reasonable steps to ensure that any personal data held is accurate and up to date, based on your request or on information provided by our law firm clients.
Right to Erasure ("Right to be Forgotten") -- You may request the deletion of personal data that is no longer necessary for the purposes for which it was collected, or where there is no legal, contractual, or regulatory reason to retain it. LegalWox will delete or anonymize personal data promptly, except where retention is required by applicable laws, contractual obligations, or legitimate business purposes.
Right to Restriction of Processing -- You may request that LegalWox limit the processing of your personal data under certain circumstances, such as while the accuracy of your data is being verified or while we assess lawful grounds for processing. During this period, your data will not be further processed beyond storage or other permitted purposes.
Right to Data Portability -- Where technically feasible, you may request a copy of your personal data in a structured, commonly used, and machine-readable format. This enables you to transfer your data to another service provider while maintaining security and integrity.
Right to Object -- You may object to the processing of your personal data when processing is based on our legitimate interests or for direct marketing purposes. LegalWox will consider your objection carefully and, where applicable, suspend or cease the processing of your personal data unless we have overriding legitimate grounds or are required by law to continue processing.
Right to Withdraw Consent -- Where processing is based on your consent, you may withdraw it at any time. LegalWox will ensure that withdrawal of consent is simple and will not affect the lawfulness of processing prior to withdrawal.

How LegalWox Facilitates Your Rights:

We handle all data requests securely and in strict accordance with applicable data protection laws in Nigeria.
Requests concerning client or matter-related data uploaded by law firms are referred to the respective law firm, as they act as the Data Controller; LegalWox, acting as Data Processor, executes instructions in line with the law and the law firm's documented directives.
Personal and technical data that we collect directly (e.g., for account management, billing, or platform access) can be accessed, corrected, restricted, or deleted by contacting us directly.

Residual Data Notice:

Please note that even after your personal data has been deleted from active systems, certain residual information may remain in our backup or archival systems for a limited period. This is necessary for business continuity, disaster recovery, and compliance with legal obligations under applicable data protection and regulatory laws in Nigeria. Such residual data is securely stored and not used for active processing.

Requests to exercise your rights or inquiries about data retention and deletion can be directed to our Privacy Officer at: privacy@lextechgroup.com

LegalWox will respond promptly, professionally, and in full compliance with Nigerian data protection requirements.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with: [Nigeria Data Protection Commission (NDPC]{.underline}

Updates to the Privacy Policy:

LegalWox may update this Privacy Policy from time to time to reflect changes in our services, practices, or legal requirements. Users will be notified of significant changes through email, announcements on LegalWox's Platform, or other appropriate communication channels. The updated Privacy Policy will take effect on the date indicated in the "Effective Date" at the top of the policy, unless otherwise specified.

Security Measures

LegalWox is committed to ensuring the confidentiality, integrity, and availability of personal data. To protect your information, we implement technical, organizational, and administrative safeguards, including:

Access Controls: Personal data is accessible only to authorized personnel who require it to perform their duties. Role-based permissions restrict access to sensitive information, including client and matter-related data uploaded by law firms.
Encryption: Data is encrypted both in transit and at rest using industry-standard protocols to prevent unauthorized access.
Network and System Security: Firewalls, intrusion detection systems, regular monitoring, and secure server configurations are in place to safeguard our systems from cyber threats.
Data Segregation: Client and matter-related data is logically separated to ensure that each law firm's data remains confidential and inaccessible to other users.
Regular Audits and Testing: Security audits, vulnerability assessments, and penetration testing are conducted periodically to identify and mitigate potential risks.
Employee Training: All personnel handling personal data receive regular training on data protection, privacy best practices, and incident response procedures.

While we implement stringent measures to protect personal data, no system is entirely risk-free. Users are encouraged to maintain the security of their accounts by using strong passwords and securing their devices.

Breach Notification

In the unlikely event of a personal data breach that may pose a risk to your rights or freedoms, LegalWox will act promptly and in full compliance with applicable data protection laws in Nigeria, including the NDPA and GAID guidelines:

Investigation and Assessment: We will immediately investigate the breach, assess its impact, and contain any risks to personal data.
Notification to Affected Parties: Where required by law, LegalWox will notify affected individuals without undue delay, providing clear information about the breach and steps they can take to protect themselves.
Regulatory Notification: If the breach meets the thresholds for reporting, we will notify the Nigeria Data Protection Commission and other relevant authorities as required.
Corrective Measures: LegalWox will take all reasonable steps to prevent recurrence, including strengthening security measures, reviewing access controls, and providing staff training where needed.

Our goal is to maintain transparency, protect user rights, and minimize any potential impact arising from a data breach.

Contact Information

For questions, complaints, or requests regarding this Privacy Policy or your personal data, please contact LegalWox's Privacy Officer:

LegalWox Privacy Officer
Email: privacy@lextechgroup.com

You may submit:

Requests to access, correct, or delete your personal data;
Concerns regarding data processing, storage, or transfer;
Queries about residual data retention and deletion practices; or
Reports of potential data breaches.

LegalWox will respond promptly, professionally, and in full compliance with applicable data protection laws in Nigeria, ensuring your rights are respected and your information is treated securely.