KON & Associates Privacy and Data Protection Policy

1. About this Policy
Kon & Associates is committed to protecting and respecting your privacy in accordance with the Nigeria Data Protection Act, 2023 (“NDPA”), the General Application and Implementation Guidelines (GAID) 2025 and other applicable regulations. This Privacy Policy provides information on how KON & Associates collects and processes your personal data when you visit or use our website, social media, and office. It sets out the use of your personal data by KON & Associates and how we keep it secure and explains the rights that you have in relation to your personal data.  By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are
KON & Associates is a Nigerian law firm that leverages the combined experience of its dynamic team in corporate and commercial law. The firm is dedicated to delivering strategic legal solutions for public institutions, government agencies, and corporate entities operating in complex regulated environments.

Data Controller
KON & Associates is the Data Controller responsible for your personal data.
Registered Address: 94 Awolowo Road Ikoyi, Lagos, Nigeria.
Email: info@konassociate.com
Phone: +234 913 036 4839

3. The Data We Collect About You
Personal data means any information that can be used to identify directly or indirectly a specific individual. We collect and process personal data in order to provide legal services and comply with applicable laws and regulations. The personal information we collect may include names, contact details, identification information, and other information relevant to the services we provide.
You provide us with your personal data when you register your personal details on our website, social media, physical location and transact with the same.
The personal data we collect includes:
Information you provide to us: We receive and store information that you provide to us in the course of seeking legal advice, engaging our services, or interacting with our firm. This may include identity data, contact information, professional and corporate information, and other information necessary for the provision of legal services and client engagement management. These types of personal data may include but not limited to:

• Full name
• Email address
• Telephone number
• Residential or business address
• Government-issued identification details (e.g., passport, national ID, driver’s licence)
• Corporate affiliation details

Information we automatically collect/generate or obtain from third parties:
We automatically collect and store certain types of information regarding your use of the KON & Associates website including information about your visits, searches, and interactions with our legal resources and services. In addition, we may receive information about you from third parties including regulatory authorities, corporate registries, professional advisers, and service providers who assist us in delivering legal services. These types of personal data may relate to your use of our websites (as well as certain third-party websites with whom we have partnered), and/or your professional interests, legal inquiries, or geographic location. The personal data provided to third parties is only to facilitate the provision of requested legal services and no unauthorized use. Third parties are bound by confidentiality obligations and applicable data protection laws.

Examples of these types of information include:

• Name and age (or predicted age range).
• Information about your device, operating system, browser, and IP address.
• Details of web pages that you have visited.
• Information about legal services or resources you have viewed or searched for on our website.
• how long you spend on certain areas of a website or app together with the date and time of your visit/usage,
• Personal data contained within user-generated content (such as blogs and social media postings), social media user name or ID, and social media profile photo and other social media profile information (such as number of followers).

We strive to provide you with choices regarding the Personal Data that you provide to us. Where required by law, if you wish to have your Personal Data used by KON & Associates to provide you with a personalized experience, legal insights, updates or communications, you can indicate so through the relevant tick-box(es) located on the registration or contact form. If you decide that you no longer wish to benefit from this personalization, you may opt out at any time. You also have the following rights regarding your personal data: access your data, request corrections, request deletions, or restrict or object to processing, request data portability and lodge complaints with relevant authorities.

4. Cookies and Other Identifier
A cookie is a small file of letters and numbers that we put on your computer, mobile phone or tablet if you agree. Cookies allow us to distinguish you from other users of our website, which helps us to provide you with an enhanced browsing experience. You may adjust your browser settings to refuse cookies; however, this may affect certain website functionalities.

5. Purpose of Processing
We use your personal data to operate, provide, develop and improve the products and services that we offer, including the following:

• Registering you as a new client or contact.
• Processing and delivering your orders.
• Managing your relationship with our firm.
• Improving our website, legal resources and professional services.
• Provide client support
• Send communications (with your consent)
• Prevent fraud and ensure platform security
• Complying with our legal obligations, including verifying your identity where necessary.

6. Lawful Basis for the Processing of Personal Data
We will only process your personal data under one or more of the following lawful basis under the NDPA 2023 and GAID 2025:

• Consent: For example, where you have provided your consent for our communications. You can withdraw your consent at any time, including by clicking on the “unsubscribe” link at the bottom of any email we send you.
• Our legitimate business interests: Where it is necessary for us to understand your business and operate effectively, provided in each case that this is done in a legitimate way which does not unduly affect your privacy and other rights. Additionally for fraud prevention, website improvement and business analytics.
• Performance of a contract with you: This would also apply where we need to take steps prior to entering into a contract with you
• Compliance with law: Where we are subject to a legal obligation (tax, consumer protection) and need to use your personal data in order to comply with that obligation.

7. How We Share Your Personal Data
We may need to share your personal data with third parties for the following purposes:

• Payment service providers
• IT service providers and cloud hosting platforms
• Professional advisers
• Regulatory or law enforcement authorities (where required by law)

When we share your personal data with third parties:
We require them to agree to use your data in accordance with the terms of our Privacy Policy, the NDPA 2023, GAID 2025; and other applicable laws.
Only permit them to process your personal data for specified purposes and in accordance with our instructions. We do not allow our third-party service providers to use your personal data for their own purposes.

8. International Transfers
Where personal data is transferred outside Nigeria, we ensure adequate safeguards are in place in accordance with the NDPA, including contractual protections and verification of adequate data protection standards in the recipient jurisdiction.

9. Data Retention
We will take every reasonable step to ensure that your personal data is processed for the minimum period necessary for the purposes set out in this Privacy Policy. Your Personal Data may be retained in a form that allows for identification only for as long as:

Duration of provision of our product to you.
Completion of contractual obligations
Statutory retention periods (e.g., tax records)
Resolution of disputes
After the retention period we will actively review the personal data we hold and delete it securely or anonymize same.

10. Data Security
We implement appropriate technical and security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

In addition, we limit access to your personal data to employees, professional advisors and other necessary third parties. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

11. Your Legal Rights

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Under the Nigeria Data you have rights under data protection laws in relation to your personal data, including the right to access, correct or delete your personal data, object to or restrict processing of your personal data, right to ask that we transfer your personal data to a third party, lodge a complaint with the relevant authority; the Nigeria Data Protection Commission (NDPC).
Where you wish to permanently delete your data from our website and other applications, and discontinue your relationship with us, to the extent permitted by applicable law, request may be made via info@konassociate.com we will respond within the timeframe required by law.

12. Review to This Privacy Policy
We may update this Privacy Policy from time to time. Updates will be posted on our website with the revised “Last Updated” date.

Contact Us

For questions, complaints, or data subject requests, please contact:
Email: info@konassociate.com
Phone: +234 913 036 4839

We will investigate any complaint about the way we manage Personal Data and ensure that we respond to all substantiated complaints within prescribed timelines.