How we look after personal information

Hukunci is operated by Brookstech Digital Solutions Ltd (RC 7723305), 2B Ola Adeshega Street, off Kudirat Abiola Way, Oregun, Lagos State, Nigeria (“Hukunci”, “we”, “us”). This policy explains how we handle personal information when you visit hukunci.com, use the Hukunci apps, or contact us. You can reach us about anything in it at support@hukunci.com.

Law firms use Hukunci to run their practice. The information a firm puts into Hukunci, including its clients, matters, documents, messages, finances and staff records, belongs to that firm. For that information the firm is the data controller and we are its data processor: we hold and process it only to provide the service to the firm and on its instructions.

If you are a client of a law firm, or work at one, and have a question about your information held in that firm’s account, please contact the firm first. We will help the firm answer your request.

We are the data controller for a smaller set of information that we use for our own purposes: website visitors and demo requests, the contact and account details of the people who sign up and manage firm accounts, and the security records described below.

On our website. If you request a demo we collect your name, firm, email address, and anything else you choose to give us, such as your phone number, firm size and message. We also collect information about how visitors use the website, described in Cookies and analytics.

When you use the apps. Depending on how a firm uses Hukunci, this includes:

• Account details: name, email address, phone number, role, and sign-in security details such as a scrambled (hashed) password and two-step sign-in settings. When a firm signs up, we also record that its administrator agreed to our terms and this policy: which versions, when, and the IP address and browser used.
• Client and matter information: client contact details, matters, court events, consultations, documents, messages, calls, calendar entries and tasks.
• Financial information: time entries, invoices, expenses, receipts and bank account details.
• Staff and HR information: payroll and salary details, leave requests (which may include health information such as sick or maternity leave), appraisals, training records and complaints.
• Security and usage records: sign-in times, IP addresses, browser and device type, an audit record of actions taken in the account, and information about how the apps are used, such as which pages are visited and which features are used.

From services you connect. If you connect a Google or Microsoft account, we receive the information described in Connected accounts.

• To provide, maintain and support the service a firm has signed up for.
• To keep accounts secure: confirming email addresses, two-step sign-in, detecting misuse and keeping an audit record.
• To send messages the service depends on, such as sign-in codes, password resets, invitations, invoices and matter updates a firm has chosen to send.
• To understand how the website and apps are used, so we can fix problems and improve them.
• To answer demo requests and support questions.
• To meet our legal obligations and enforce our terms.

We rely on the contract with the firm (or with you), our legitimate interest in running and securing the service, your consent where we ask for it, and our legal obligations. We do not sell personal information, use it for advertising, or use a firm’s information to train artificial intelligence models.

You can choose to connect a Google or Microsoft account so that Hukunci can show your existing calendar alongside your firm’s calendar, or so that you can import documents from Google Drive, OneDrive or SharePoint. Connecting is optional and you can disconnect at any time from your Hukunci settings or from your Google or Microsoft account settings.

• Calendar: we read your calendar events (titles, times, locations, attendees and descriptions) to display them in Hukunci.
• Documents: we access only the files you pick and copy them into your firm’s Hukunci account, where they are encrypted like any other document.
• Your account identity: the email address of the connected account, so you can see which account is linked.

We use this information only to provide these features to you. We do not use it for advertising, do not sell it, do not use it to train artificial intelligence models, and do not let anyone read it except where you ask us to (for example, for support), where it is needed for security or to comply with the law.

Hukunci’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Within a firm, information is visible to the people the firm gives access to. Clients only see what their firm chooses to share with them. Our own staff cannot see a firm’s clients, matters, documents or finances in the normal course of running the platform; they may access account information where needed to provide support you ask for, secure the service or comply with the law.

We use these service providers to run Hukunci:

• Railway: hosting for our servers and database.
• Cloudflare: storage for uploaded files and encrypted backups.
• Infisical: secure storage for encryption keys.
• Resend: delivery of emails such as sign-in codes, invitations, invoices and demo requests.
• LiveKit: audio and video calls.
• Analytics providers: measuring how the website and apps are used, as described in Cookies and analytics.
• Your browser’s push service (for example Google, Apple or Mozilla): delivery of notifications if you turn them on.

Each provider may only use the information to provide its service to us. We may also disclose information if the law requires it, to protect people’s rights and safety, or to a buyer of our business, who would have to honour this policy.

Some of our service providers store or process information outside Nigeria, including in the United States and Europe. Where that happens we rely on the safeguards allowed by the Nigeria Data Protection Act 2023, such as contractual protections, and we encrypt documents and the most sensitive details before they leave our servers.

Documents and attachments are encrypted with their own keys before they are stored, each firm has separate keys held in a key vault apart from the database, sensitive financial details are encrypted in the database, and every member of a firm’s staff must use two-step sign-in. Read more on our security page. No system is perfectly secure; if a breach affects your information we will notify the affected firm, and the regulator where the law requires, without undue delay.

We keep a firm’s information for as long as the firm has an account with us. A firm can delete clients and records, and set how long call recordings are kept.

A firm’s super admin can delete the firm’s account at any time. Deletion takes place 30 days after they ask. During those 30 days everyone else at the firm, staff and clients, is signed out and cannot sign in, and the super admin can still download the firm’s information or cancel. After that we delete all of the firm’s information: its records, documents, files and accounts. We also destroy the firm’s encryption keys, so anything of the firm’s left in an encrypted backup can no longer be read. Our backups expire automatically, so any copies in them are gone within 90 days of deletion.

After a firm is deleted we keep a short record that it existed and was deleted at its request: the firm’s name and its Hukunci address, the name and email address of the person who asked, and the dates. We keep it for six years, as evidence of the firm’s instruction and so that nobody else can take over the firm’s address, and then delete it.

Demo requests and support emails are kept for as long as needed to deal with them and any follow-up. We may keep some information for longer where the law requires it, for example for tax records.

Under the Nigeria Data Protection Act 2023 and similar laws, you can ask to access, correct, delete or receive a copy of your personal information, object to or restrict how it is used, and withdraw consent you have given. Where your information is held in a firm’s account, please ask the firm; you can also write to us at support@hukunci.com and we will help.

A firm’s super admin can download all of the firm’s information at any time from its settings: every record as CSV and JSON files, and every stored document and file. The download is kept for seven days.

If you are unhappy with how we have handled your information, you can complain to the Nigeria Data Protection Commission, or to the data protection authority where you live.

Cookies are small files a website stores in your browser. We use two kinds, on our website, in the Hukunci apps and in the client portal:

• Essential cookies and storage that the service needs to work: keeping you signed in, protecting forms against forgery, and remembering preferences such as your theme and layout. These cannot be switched off.
• Analytics cookies that help us understand how people use the website and apps, such as which pages are visited, how long they take to load, and where people get stuck. They collect information such as pages viewed, clicks, device and browser type, approximate location and IP address.

We only set analytics cookies with your consent where the law requires it, and you can change your choice at any time. We set up analytics in the apps so that they do not record the content of a firm’s data, such as client details, matters, documents or messages. We do not use advertising cookies, and we do not use analytics information to show you adverts.

Hukunci is a service for businesses and is not meant for anyone under 18. A firm may hold information about a minor who is a party to a matter; that information is controlled by the firm.

We will update this page when our practices change and show the date of the latest version at the top. If a change materially affects how we use personal information, we will tell account administrators by email before it takes effect.

Questions or requests about privacy: support@hukunci.com, or write to Brookstech Digital Solutions Ltd, 2B Ola Adeshega Street, off Kudirat Abiola Way, Oregun, Lagos State, Nigeria.