1. Our approach to privacy

myLooya is committed to protecting the privacy and security of personal information. This Privacy Policy sets out the categories of personal information we collect, how and why we use it, with whom we share it, how long we retain it, the safeguards we use, and the rights available to individuals. The Policy applies to the myLooya Software and any services we provide through the software. This Policy does not replace engagement or service agreements you may have with legal service providers using myLooya.

2. Personal information we collect about you and how we use it

2.1 Information you give us

We collect information you provide when you register for an account, create or manage matters/briefs, upload documents, submit requisitions or payments, communicate with other users through the Software, or otherwise provide information directly to myLooya. Categories include (but are not limited to): identity and professional information, contact details, account authentication data, matter/case data, documents and attachments, and financial/transactional information.

2.2 Information we receive from other sources

We may receive information about you from third parties such as clients, external counsel, vendors, third-party payment service providers, or other entities that interact with myLooya-related matters. We may also receive information from service providers that help us deliver other services on the Software (for example, identity verification providers or analytics services providers).

2.3 Information collected automatically

When you use the Software we collect technical and device data automatically (IP address, device identifiers, browser and OS, Software version, crash logs, usage metrics), and we may derive approximate location from IP or device location features when enabled. We also use cookies and similar tracking technologies. These information are collected with your consent first sought and obtained.

2.4 Sensitive categories

We do not routinely collect special category (sensitive) personal data. Where such data is submitted (for example identity documents or other narrowly required information), we process it only where strictly necessary and with appropriate safeguards and legal basis in place to safeguard them.

2.5 How we use personal information

We process personal information for the following core purposes (legal bases where applicable are shown where relevant):

• To provide, operate and maintain the Software — user registration, authentication, account management, role and permission assignment, matter and document management. (Performance of contract / legitimate interests).
• To deliver professional/matter services and administration — enable users to manage client matters, communicate with clients and third parties, and deliver legal or advisory work as instructed by a client. (Performance of contract / legal obligations).
• Financial administration — process requisitions, client payments, invoices and reimbursements. (Performance of contract / consent where required).
• Compliance, risk management and conflict checks — conflict-of-interest screening, AML/KYC checks and regulatory compliance. (Legal obligations/ legitimate interests).
• Security, fraud prevention and platform integrity — protect accounts, detect and prevent fraud, maintain audit logs and conduct security investigations. (Legitimate interests).
• Improvement and analytics — aggregate and anonymized analytics to improve product features and user experience. (Legitimate interests).
• Marketing and communications (limited) — where you consent or where permitted by law, we may send product updates or service-related notices. You can opt out of promotional messages.

3. Disclosure of your personal information

We share personal information only as necessary and appropriate. Typical recipients include:

• Internal users — authorized account holders and administrators who require access to carry out assigned tasks.
• Service providers — third-party processors (cloud hosting, payment processors, email providers, analytics, backup and support services) who process data under contract with myLooya and are only authorized to act on our instructions.
• Professional advisers — external counsel, auditors and consultants engaged to support myLooya operations.
• Legal and regulatory authorities — where required by law, court order or to protect rights, safety or property of myLooya, our clients or others within the ambits of the law or relevant regulatory agencies.
• Third parties you direct — for example, if you instruct myLooya to share matter files with external counsel or other service providers.

We do not sell personal information. When sharing with third parties, we implement contractual, technical and organizational safeguards to protect your data.

4. Storing and transferring your personal information

myLooya may store and process personal information in servers or systems located in jurisdictions outside the country where you reside (including cloud infrastructure providers). Where personal data is transferred cross-border we will implement appropriate safeguards and/or other legal mechanisms to protect your information. Such measures shall include, but are not limited to, having Data Processing Agreements with applicable subprocessors and ensuring that such subprocessors affords an adequate level of protection for the security of personal data in line with applicable data protection laws.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Service, you are responsible for keeping this password confidential. Subscribers should not share their password with anyone. If you wish to know more about specific safeguards or subprocessors, you can contact us at the details below.

5. Retaining your information

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to satisfy legal, tax and accounting obligations, for professional record-keeping, and to establish, exercise or defend legal claims. We apply retention schedules that reflect legal requirements and business necessity, including but not limited to:

• Active matter files — for the duration of the engagement and while active in the Software.
• Closed/inactive matter files — archived for a period consistent with applicable statute of limitations, professional rules, or other legal obligations (documented retention period).
• Financial, tax and accounting records — typically retained for a minimum period required by local tax/audit rules (commonly 6 years where applicable).
• AML/KYC and due diligence records — retained in line with applicable AML/CFT laws of Nigeria (commonly 5 years after the end of the relationship where required).
• Audit and security logs — retained as necessary for incident response and compliance (commonly 3-7 years depending on sensitivity).

When personal data is no longer required, we securely delete, destroy, pseudonymize or anonymize it in accordance with recognized industry practices.

6. Cookies, tracking & analytics

We and our service providers use cookies, web tokens and similar technologies to enable essential Software functionality, remember preferences, enable security features and collect analytics. This helps us enhance and personalize your user experience, to monitor and improve our Website, Software and other services, and for other internal purposes. As is true of most websites, we gather certain information automatically.You can control cookies through your browser or device settings; disabling certain cookies may affect Website, Software performance or features.

7. Your rights

In line with the provisions of the Nigeria Data Protection Act, 2023 and other extant laws on data protection, you have the following rights in relation to your personal information, including but not limited to:

• Right of access — request confirmation of processing and a copy of personal information in our care.
• Right to rectification — request corrections to inaccurate or incomplete information.
• Right to erasure/be forgotten — request deletion where processing is no longer necessary and no overriding legal basis exists.
• Right to restrict processing — request limitation of processing in certain circumstances.
• Right to object — object to processing based on legitimate interests or direct marketing.
• Right to data portability — receive data in a structured, machine-readable format where technically feasible.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

We may need to verify your identity before actioning requests and may refuse requests that are manifestly unfounded, illegal or excessive. To exercise any of these rights, contact us using the details below.

8. Children

The Software is intended for professional and authorized users. We do not knowingly collect or solicit personal data from children under the age of 18. If you believe we have collected information about a child in error or without appropriate consent, then please contact us using the details below so that we can take the appropriate steps in accordance with our legal obligations and this privacy policy.

9. Third-party websites and links

The Software may contain links to third-party websites, applications, or services not operated by myLooya. We are not responsible for the privacy practices or content of third parties and recommend you review their privacy policies before providing personal information.

10. Personal data breaches

We maintain incident response procedures to detect, contain and remediate personal data breaches. If a breach is likely to result in a risk to individuals' rights and freedoms, we will notify affected users and any applicable supervisory authority as required by law and take steps to mitigate harm. If you suspect a breach involving your data, contact us immediately.

11. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, Software features, legal requirements, or technology. When we make material changes, we will post a prominent notice on the Software and, where appropriate, notify affected users by email. The most recent version and effective date will always be available on the Software.

12. Notice

If we need to provide you with information about something, whether for legal, marketing or other business related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on our Website. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this privacy policy.

13. Contact us / Data Protection Officer

Regardless of your location, if you have any questions about this policy, wish to make a data subject request, or want to raise a privacy concern, please contact our Data Protection Officer via this email address:
Email: privacy@mylooya.com
You may also contact us through the Software's in-product support or the support/contact feature inside the myLooya Software.

Annex 1 - Personal information we collect
All disclosures listed below are made with service providers only and done in accordance with myLooya's Terms of Service and Privacy Policy respectively.

Annex 2 - Personal information collected automatically