1. INTRODUCTION
This website, estherdavidajinya.com, and associated digital and social media platforms (the “Platform”) are operated for the publication of legal education content, commentary, and related professional materials.
In the course of operating the Platform, personal data relating to subscribers, readers, and other users may be collected and processed through newsletter subscriptions, contact forms, and general website usage. All such personal data is processed lawfully, fairly, and transparently, in full compliance with the Nigeria Data Protection Act, 2023 (“NDPA”), the Nigeria Data Protection Regulation (General Application and Implementation Directive) 2025 (“GAID 2025”), and all other applicable data protection laws.
This Privacy Policy (“Policy”) sets out the basis on which personal data is collected, held, processed, and protected in connection with the Platform. Users are encouraged to read this Policy carefully. Nothing in this Policy constitutes legal advice, and use of the Platform does not create a solicitor-client relationship.
2. SCOPE OF THIS POLICY
This Policy applies to all personal data processed in connection with the Platform, including the website, newsletter, social media platforms, and all related digital communications. It governs the processing of personal data relating to:
- Subscribers to the newsletter or mailing list;
- Visitors and readers of the website and associated content;
- Individuals who submit enquiries via the contact form;
- Followers and engaged users across social media platforms; and
- Any other individuals whose personal data may be obtained or processed in the ordinary course of operating this platform.
3. CATEGORIES OF PERSONAL DATA COLLECTED
Depending on the nature of interaction with the Platform, the following categories of personal data may be collected, received, or otherwise obtained:
3.1 Identity and Contact Data
Including full name, email address, and any other contact details voluntarily provided via the newsletter signup or contact form.
3.2 Enquiry and Correspondence Data
Including the content of messages submitted through the contact form, and any correspondence exchanged in response.
3.3 Technical and Usage Data
Including IP addresses, browser type, device information, website usage data, and cookies collected via the website (see Section 6 below).
3.4 Engagement Data
Including information relating to interaction with newsletters (such as open and click activity) and engagement with social media content, to the extent made available by the relevant platform.
3.5 Sensitive Personal Data
The Platform does not intentionally seek to collect sensitive personal data within the meaning of the NDPA 2023, such as health data or biometric data. Where such data is inadvertently provided, for example, within a contact form submission, it is handled with the heightened care mandated by the NDPA 2023 and GAID 2025, and is processed only where a specific lawful basis and appropriate safeguards exist.
4. PURPOSES OF PROCESSING
Personal data is processed only for specified, explicit, and legitimate purposes, in accordance with the principle of purpose limitation under the NDPA 2023. Personal data is processed for the following purposes:
- Delivery of newsletter content, legal education updates, and related communications to subscribers;
- Management and administration of the newsletter mailing list, including processing unsubscribe requests;
- Operation, maintenance, security, and improvement of the website and its digital infrastructure;
- Understanding audience engagement and improving the quality and relevance of content published; and
- Compliance with applicable legal and regulatory obligations.
5. LAWFUL BASIS FOR PROCESSING
In accordance with the NDPA 2023 and the GAID 2025, personal data is processed only where a lawful basis exists. Depending on the nature of the processing activity, processing is carried out on one or more of the following grounds:
Consent – Where processing requires the freely given, specific, informed, and unambiguous consent of the data subject, such as subscribing to the newsletter or submitting the contact form. Consent may be withdrawn at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.
Legitimate Interests – Where processing is necessary for the legitimate interests of the Platform, including the operation and security of the website, audience analytics, and the general administration of the Platform, provided such interests are not overridden by the rights and freedoms of the data subject.
Legal Obligation – Where processing is necessary for compliance with a statutory or regulatory duty.
Vital Interests – In exceptional cases, where processing is necessary to protect the vital interests of a data subject or another natural person.
6. COOKIES AND TRACKING TECHNOLOGIES
The website uses cookies and similar tracking technologies to ensure proper functionality, enhance the user experience, and analyse website performance, in compliance with the NDPA 2023 and GAID 2025. Cookies are small text files stored on a user’s device when the website is visited. They enable core functions such as page navigation, session management, and the efficient operation of the website.
Types of Cookies Used:
Necessary Cookies – Essential for the operation, security, and basic functionality of the website. These cannot be disabled without affecting website operation.
Functional Cookies – Enable the website to remember user preferences and improve usability.
Analytical Cookies – Help in understanding how visitors interact with the website, enabling improvements to performance and content. These are deployed only with consent.
Cookie Control
Cookie preferences may be managed through the website’s cookie consent tool or through browser settings. Disabling necessary cookies may impair the proper functioning of parts of the website. For analytical cookies, consent is obtained before deployment, consistent with GAID 2025 requirements.
7. DISCLOSURE AND SHARING OF PERSONAL DATA
Personal data is treated with the strictest confidence and is not sold, rented, or traded with third parties. Disclosure of personal data may occur in the following limited circumstances:
To courts, regulatory bodies, or government authorities where required by law, court order, or regulatory directive;
To third-party service providers (such as email newsletter platforms, website hosting providers, or cloud storage services) who process data on behalf of the Platform under appropriate data processing arrangements, as required by the NDPA 2023;
To social media and analytics platforms, to the extent necessary for the operation of the Platform’s associated accounts and pages; and
Where explicit consent has been provided for such disclosure.
All third parties engaged to process personal data on behalf of the Platform are required to maintain appropriate technical and organisational security measures and to process personal data only in accordance with documented instructions.
8. INTERNATIONAL TRANSFERS OF PERSONAL DATA
Personal data collected through the Platform is primarily processed within Nigeria. Where a transfer of personal data to a recipient outside Nigeria becomes necessary, for example, through the use of foreign-hosted newsletter, website, or cloud service providers, such transfer shall be carried out strictly in accordance with the NDPA 2023 and the GAID 2025.
Where applicable, data subjects will be informed of any proposed international transfer and the safeguards in place to protect their personal data.
9. DATA SECURITY
Appropriate technical and organisational measures are implemented to protect personal data against unauthorised access, accidental loss, destruction, alteration, or unlawful disclosure, in accordance with the NDPA 2023 and the GAID 2025. These measures include:
- Access controls and authentication protocols on website and email platforms;
- Encryption of personal data during transmission and, where appropriate, at rest;
- Use of reputable, secure third-party platforms for hosting and email management;
- Regular review of security practices; and
- Incident response procedures in the event of a data breach.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, the Platform shall notify the NDPC within the timeframe prescribed by the NDPA 2023 and GAID 2025 and, where required, inform affected data subjects without undue delay.
10. DATA RETENTION
Personal data is retained only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. In determining appropriate retention periods, regard is had to:
- The nature and sensitivity of the personal data;
- The purpose for which the data was processed, for example, active newsletter subscription or an open enquiry;
- Applicable statutory limitation periods; and
- Any specific retention period prescribed by applicable regulatory frameworks.
At the expiry of the applicable retention period, or upon unsubscription, personal data is securely deleted, destroyed, or anonymised.
11. RIGHTS OF DATA SUBJECTS
Under the NDPA 2023, the GAID 2025, and applicable data protection law, data subjects have the following rights in respect of their personal data held by the Platform:
Right of Access – The right to request confirmation of whether the Platform processes personal data relating to the data subject and, if so, to obtain a copy of such data and related information.
Right to Rectification – The right to request correction of any inaccurate, incomplete, or outdated personal data held by the Platform.
Right to Erasure – The right to request deletion of personal data where the grounds specified under the NDPA 2023 are satisfied, subject to any overriding legal obligations.
Right to Restriction of Processing – The right to request that processing of personal data be restricted in certain specified circumstances.
Right to Data Portability – The right to receive personal data provided to the Platform in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible.
Right to Object – The right to object to the processing of personal data on grounds of legitimate interests or for direct marketing purposes, including unsubscribing from the newsletter at any time.
Right not to be subject to automated decision-making – The right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Right to Withdraw Consent – Where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
Right to Lodge a Complaint – The right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). Data subjects are encouraged to raise concerns directly with the Platform in the first instance before contacting the NDPC.
To exercise any of the above rights, a written request should be submitted to the contact details provided in Section 16. Valid requests will be responded to within the timeframe prescribed by the NDPA 2023 (generally one month, subject to extension where permitted by law). Identity verification may be required before processing a request.
12. DATA PROTECTION PRINCIPLES
In accordance with the NDPA 2023 and the GAID 2025, personal data is processed in compliance with the following data protection principles, which govern all aspects of the Platform’s data processing activities:
Lawfulness, Fairness, and Transparency – Personal data is processed lawfully, fairly, and in a transparent manner vis-à-vis the data subject.
Purpose Limitation – Personal data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes.
Data Minimisation – Personal data collected and processed is adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which it is processed.
Accuracy – Personal data is kept accurate and, where necessary, up to date. Reasonable steps are taken to ensure that inaccurate personal data is erased or rectified without delay.
Storage Limitation – Personal data is retained only for as long as necessary for the purposes for which it is processed.
Integrity and Confidentiality – Appropriate technical and organisational measures are applied to ensure a level of security appropriate to the risk, protecting personal data against unauthorised access, loss, destruction, or unlawful processing.
Accountability – The Platform is responsible for, and can demonstrate compliance with, all applicable data protection principles and obligations under the NDPA 2023 and GAID 2025.
13. CHILDREN’S PERSONAL DATA
The Platform is not directed at children (persons under the age of 18 years), and personal data is not knowingly collected from children through the website, newsletter, or social media platforms. Where it becomes apparent that personal data has been inadvertently collected from a child without appropriate consent, reasonable steps will be taken to delete such data promptly.
14. THIRD-PARTY LINKS
The website and associated social media platforms may contain hyperlinks to third-party websites, platforms, or services. No responsibility is assumed for the privacy practices, content, or data protection compliance of such third-party sites. Users are encouraged to review the privacy policies of any third-party sites accessed via links on the Platform. The presence of a hyperlink does not constitute an endorsement of the linked website or its data practices.
15. CHANGES TO THIS POLICY
This Privacy Policy may be amended or updated from time to time to reflect changes in applicable law, regulatory guidance, or Platform practices. Where material changes are made, reasonable steps will be taken to notify affected data subjects, including by posting the updated Policy on the website with a revised “Last Updated” date. The current version of this Policy supersedes all prior versions.
16. CONTACT INFORMATION
For all enquiries, complaints, or requests relating to this Privacy Policy or the processing of personal data, please contact:
Website: estherdavidajinya.com
Email: info@esthetdavidajinya@gmail.com
Contact: Via the contact form at estherdavidajinya.com
Where a response to a request or complaint is unsatisfactory, a complaint may be lodged with the Nigeria Data Protection Commission (NDPC):
Nigeria Data Protection Commission (NDPC)
Website: www.ndpc.gov.ng
Email: info@ndpc.gov.ng
Telephone: +234 916 061 5551
Address: No. 12, Dr Clement, Isong Street, Abuja, FCT.