DRAFT for review by a Nigerian legal practitioner — not published. Built on
GAID 2025 (NDPC/NDP ACT-GAID/01/2025, 20 March 2025), read at the
Commission’s own website 13 August 2026. See NG-VERIFICATION-RECORD.md.

⚠ THE NIGERIAN SERVICE IS NOT RUNNING. The application instance was
terminated 12 August 2026. Part 2 is therefore written conditionally — as the
position that will apply when the service is provided, not as a description of
something happening now. Do not publish Part 2 in the present tense until the
instance is rebuilt.

⚠ THE NDP ACT ITSELF IS NOT PRIMARY-VERIFIED (G-NGDOC1). Where the Act’s
words appear below they are quoted as reproduced in GAID by the Commission,
and the GAID article is named. No other section of the Act is cited.

⚠ REGISTRATION (Q-NGDOC1). GAID Art 8(2) treats a controller who targets
data subjects in Nigeria as “operating in Nigeria” even if not domiciled there.
Whether TKJ must register as a controller/processor of major importance is an
open question that must be answered before this notice is published. A notice
that cites the NDP Act while the controller is unregistered is worse than no
notice at all.

Last updated: [[ date of publication ]]

Who we are

TKJ Global Media Ltd (“TKJ”, “we”) provides TKJ Legal Software, a practice
management application for law firms.

We are a United Kingdom company. We have no Nigerian entity or office. We say
so plainly because implying otherwise would mislead you.

We are not a legal practitioner and we are not regulated by the Nigerian Bar
Association or the General Council of the Bar. We supply software to firms that
are.

The two roles

Where we are the data controller — this website, our correspondence with you,
and the accounts your firm’s staff use to sign in. We decide why and how that
personal data is processed. Part 1 applies.

Where we are the data processor — the client, matter, document and financial
information your firm puts into the application. Your firm is the data
controller and we act on its instructions under a Data Processing Agreement.
Part 2 applies.

If you are a client of a law firm that uses our software, your relationship is
with that firm. Its notice governs, and your requests go to it, not to us.

Part 1 — where TKJ is the data controller

1.1 What we collect

Visiting this website. We set no cookies and use no analytics — see our
Cookie Notice. Our hosting provider logs each request: IP address,
page requested, date and time, and browser user-agent.

Contacting us, and the pilot scheme. Your name, e-mail address, firm name, and
the contents of your message.

Firm user accounts (when the service is available). Name, work e-mail
address, role and permissions, and sign-in and security records.

Billing (when the service is available). The information needed to invoice
your firm and keep our accounting records.

1.2 Why, and on what lawful basis

We process this data to operate and secure this website; to answer your enquiry and
assess whether we can work together; to create and secure user accounts; to provide
and support the application; and to invoice and keep lawful financial records.

Our lawful bases are those recognised under the NDP Act — principally consent,
performance of a contract with you or steps taken at your request before a
contract, compliance with a legal obligation, and legitimate interests.

[[ Section 25 of the NDP Act sets out the lawful bases. It has NOT been read at
source (G-NGDOC1), so this notice describes the bases in general terms rather than
citing subsection numbers. Complete this table with precise citations once the Act
is obtained. GAID Arts 16–26 elaborate each basis; Art 26 and Schedule 8 govern
legitimate interest, including a Legitimate Interest Assessment template — that
assessment should be completed and retained before relying on the basis. ]]

Where we rely on consent, you may withdraw it at any time.

1.3 How long we keep it

Enquiries that do not lead to a contract: destroyed within six months. This is
not our choice of period — GAID Article 21(2) provides that where a contract
did not materialise, personal data collected in relation to the data subject
“shall be destroyed within six (6) months unless there is a justifiable ground to
archive the data for the purposes of any future legal claim.” If we do archive
anything on that ground, we will be able to say why.

[[ Website logs — confirm the hosting provider's retention period. ]]
Account and billing records are kept for the subscription and for the period our
accounting obligations require.

1.4 Who receives it

We do not sell personal data and we do not use it for advertising.

1.5 Where your data is kept

The Nigerian service is not currently running, so no Nigerian client or matter
data is being processed at all. When it is rebuilt, the intended position is that
it will be hosted in Nigeria, with backups also held in Nigeria.

Why that matters to you. If the data stays in Nigeria there is no
cross-border transfer, and Part VIII of the NDP Act — the cross-border regime —
does not arise. We prefer that outcome to documenting our way around it.

What is outside Nigeria today, honestly:

1. This marketing website is hosted in the United Kingdom. Website request logs
   are therefore held in the UK.
2. Fonts on this website are loaded from Google, so Google receives your IP
   address and user-agent when a page loads.
3. Encrypted backups from the earlier Nigerian deployment remain in South Africa
   (Cape Town). They are the residue of an earlier hosting decision that has since
   been withdrawn, they contain no client or matter data (no firm was ever
   onboarded), and they are encrypted to a key held only by us — the storage
   provider holds ciphertext it cannot read.

If any Nigerian personal data is ever processed outside Nigeria, we will not
rely on convenience to justify it. Cross-border transfer is lawful only on an
adequacy decision by the Commission or a Commission-approved cross-border
data transfer instrument, or one of the narrow lawful bases in the Act — and the
Commission’s own guidance is explicit that commercial advantage is not one of
them: “Profit and personal business/organisational development considerations do
not fall within this category” (GAID Schedule 5). We will establish and record the
basis before any such transfer, not after.

[[ Internal — verified position, do not soften. GAID Schedule 5 was read at
primary on 12 Aug 2026 (docs/sources/GAID-Schedule-5-cross-border.txt): three
grounds only — adequacy decision, Commission-APPROVED CBDTI, or other lawful
bases. NO NDPC adequacy decision exists for the UK or South Africa (corroborated
three ways on file). Hosting position: DECISION-host-in-country.md, 12 Aug 2026;
the Cape Town decision is recorded WITHDRAWN in GO-LIVE-NIGERIA.md §3.
Update this section the moment the rebuild location is fixed. ]]

1.6 Your rights

Under the NDP Act you have rights to be informed about processing, to access your
personal data, to have inaccurate data rectified, to data portability, to
erasure (“the right to be forgotten”), to object to processing, and to lodge a
complaint with the Nigeria Data Protection Commission. GAID Articles 36–40 govern
how those rights are exercised, including a standard notice to address a
grievance (Art 40 and Schedule 9).

To exercise any of them, contact us at ops@tkjlegal.co.uk. Please raise a concern
with us first — we would rather fix it — but you may complain to the Commission at
any time.

The Nigeria Data Protection Commission
[[ Q-NGDOC3 — the Commission's current address, e-mail and complaint route must be
verified before publication. ]]

You may also seek redress in court. GAID Article 47(2) records that a data
subject may seek redress for the violation of the right to privacy at the closest
Federal or State High Court, in line with section 46 of the 1999 Constitution and
the Fundamental Rights Enforcement Procedure Rules.

1.7 Marketing

We will not send you electronic marketing without a proper basis, and every message
will identify us and give you a simple way to stop them.

Part 2 — where TKJ is the data processor for your firm

Written conditionally. The Nigerian service is not currently running. This
Part describes the position that will apply when it is provided.

2.1 Roles

Your firm will be the data controller of the client, matter, document and
financial information in the application. TKJ will be the data processor,
acting on your firm’s instructions under a Data Processing Agreement, which
GAID Article 34(1) requires (in line with section 29(2) of the NDP Act).

We will not use your firm’s client or matter data for our own purposes — not to
train or fine-tune models, not for benchmarks, not for market insight. That is a
term of the Data Processing Agreement, not a marketing statement.

2.2 Security

We maintain technical and organisational measures set out in a schedule to the Data
Processing Agreement, as GAID Art 34(2)(j) contemplates: database-level
isolation between firms, encryption in transit, encryption of backups before they
leave the host, restricted and logged access, append-only financial records, and a
service that refuses to start on an unsafe configuration. Restore and decryption
drills are performed and recorded.

2.3 If there is a data breach

Your firm, as data controller, must notify the Commission within 72 hours of
becoming aware of a breach likely to result in a risk to rights and freedoms — the
period in section 40(2) of the NDP Act, as quoted in GAID Art 33(1) — and must
notify affected data subjects immediately (GAID Art 33(3)).

Our job is to make that possible. We will tell your firm immediately, and give
it the content GAID Art 33(5) requires: the circumstances, the date or period, the
data involved, an assessment of the risk of harm, an estimate of the number of
individuals at real risk of significant harm, the steps we have taken to reduce
harm and to notify, and a named person who can answer the Commission’s
questions.

2.4 Sensitive and privileged material

Legal files routinely contain sensitive personal data and material protected by
legal professional privilege. The platform is built on that assumption. Deletion is
never automatic; records are released only on written instruction, because a
practice’s retention duties may outlive its subscription.

2.5 Your clients’ requests

If you are a client of a law firm using our software, please contact the
firm. It is the data controller, it holds the file and the privilege, and it must
answer you. We assist the firm; we cannot answer for it.

Changes

We will update this notice when what we do changes, and change the date above.

Contact

TKJ Global Media Ltd, 94 Queen Elizabeth Road, Wakefield, WF1 4RJ, United Kingdom ·
ops@tkjlegal.co.uk