Privacy Policy

1. Who we are

Law Lab Africa LLC (“Law Lab Africa”, “we”, “us”) runs the learning platform at learn.lawlab.africa (the “platform”). We decide how and why personal data on the platform is used, so we are its data controller.

Law Lab Africa LLC is a limited liability company formed in Wyoming, United States, with its registered office at 30 N Gould St Ste N, Sheridan, WY 82801, United States. For anything about your personal data, write to course@lawlab.africa.

We offer courses in several countries. The data protection law of the country where you live applies to how we treat your personal data, although we are incorporated elsewhere. Section 17 names the law and the authority for each country where we offer an edition.

This policy covers the platform. Scholarship applications made on www.lawlab.africa are covered by the privacy policy on that site.

2. What we collect, and where it comes from

Most of what we hold, you give us, or it is created as you use the course.

• Your account: your name, email address and password. We never see or store your password: our sign-in provider keeps only a scrambled version of it that cannot be reversed. We also record when you agreed to our Terms and this policy, and which version you agreed to.
• Your enrolment: the course and edition you enrolled in, the type of licence, your cohort if you are part of one, and the date.
• Your learning record: the parts of each lesson you have read and when, your place in the course, your quiz attempts, answers and scores, your client file memos, your capstone drafts and submission, the reviewer’s mark and feedback, your notes and highlights, and your module ratings (how easy and how useful you found a module, how long it took you, and any comment you add).
• Your certificate: the name on it, the programme, the date and its credential ID.
• Payments: the amount, date and status of your payment and its reference. Card details go straight to our payment provider. We do not see or store them.
• Messages and help requests: what you send us through the platform’s Messages or Help pages, or to course@lawlab.africa, and our replies.
• Technical information: your IP address and basic browser information when you use the sign-up, sign-in, password and account deletion forms (to stop automated attacks), counts of repeated attempts, such as failed sign-ins, kept in a coded form that contains no IP address or email (to limit abuse), and error reports when something goes wrong.

Some information comes from elsewhere:

• Scholarships: if you hold a Law Lab Africa scholarship, we check the email address you sign up with against your scholarship application (including the course account email you chose when you accepted), so that your place is applied.
• Partner programmes: if a university or employer arranges your place, it gives us your name and email, or a code, so that we can enrol you.
• Your payment provider tells us whether your payment went through.

We do not ask for sensitive personal data such as health, religion or ethnicity, and the course does not need it. Please do not include it in your work or messages.

3. What you must give us

To create an account, you must give us your name, an email address and a password, and agree to our Terms. Without them we cannot create your account or deliver a course. Your name is also what appears on your certificate.

Everything else we ask, such as whether you want marketing emails or the Data Protection Digest, is optional, and saying no does not affect your enrolment.

4. Why we use it, and on what legal basis

• To run your account and deliver your course, including tracking your progress, opening each quiz and client file brief when you reach it, marking quizzes, having a reviewer mark your capstone and issuing your certificate. Basis: performance of our contract with you.
• To send you the emails that come with the course, such as your enrolment confirmation, course reminders, replies to your help requests, capstone feedback and your certificate. These are not marketing. Basis: performance of our contract with you.
• To take payments and handle refunds, and to keep the financial records the law requires. Basis: our contract with you, and our legal obligations.
• To keep the platform and your account secure, including the security check on account forms, limits on repeated attempts, error reports and investigating misuse. Basis: our legitimate interest in a safe platform.
• To check academic integrity where we have a concern about a submission (Terms, section 12). Basis: our legitimate interest in certificates that mean something.
• To improve the course, using figures that identify nobody, such as how many learners finish a module, which quiz question is most often missed, and how learners rate each module. Basis: our legitimate interest in a better course.
• To send you news about our courses and services, only if you ticked the box for it, and the Data Protection Digest, only if you asked for it. Basis: your consent, which you can withdraw at any time.
• To meet a legal obligation, or to establish, exercise or defend a legal claim. Basis: legal obligation, or our legitimate interest.

We never use your learning record for marketing, and we never build a marketing list from it.

5. Who receives it

We do not sell personal data, and we do not share it with advertisers.

• Our service providers, who process it for us under contract and only on our instructions: hosting, our database and sign-in service, video and file delivery, email delivery, the security check on account forms and error reporting. If you would like the names of our providers and the countries where they work, write to us and we will tell you.
• Our payment provider, which processes your card payment and decides for itself how to handle payment data under its own privacy policy and the law.
• The Data Protection Digest’s email provider, only if you ask for the Digest. Your email address goes to it, and it asks you to confirm before sending anything.
• Our reviewers and support staff, who see what they need to mark capstones and answer help requests, and are bound to keep it confidential.
• Organisations that arrange places. A university, employer or other partner never receives an individual learner’s progress, quiz results, answers, memos, capstone, notes or messages. It receives only figures that identify nobody, such as how many of its seats are in use.
• Authorities and advisers, where the law requires it, or where we need to establish, exercise or defend a legal claim.

6. Personal data that leaves your country

Our database is in Ireland, in the European Union. Some of our service providers work in the United States or use servers in several countries. So your personal data is transferred out of the country where you live.

Before we use a provider outside your country, we assess the protection it gives personal data. We use providers that commit by contract to protect it, and providers bound by European Union data protection law where we can. We keep a record of each transfer. The transfers are also necessary to provide the course you signed up for. To find out more about the safeguards for your data, write to us.

7. How long we keep it

• Your account and learning record: for as long as your account is open, because lifetime access depends on it. If you delete your account, we remove them 14 days later (section 8).
• Your certificate’s verification record: kept after you delete your account, in the reduced form described in section 9, so that anyone holding the credential ID can still confirm it. You can ask us to remove it, and the certificate will then no longer be confirmed by anyone who checks it.
• Payment records: our payment provider keeps them, and we keep the records the law requires us to keep for tax and accounting, for as long as that law requires.
• Help requests and messages: deleted with your account, and otherwise 24 months after the request is closed.
• Email delivery records (address, subject, and whether the email was delivered or opened): 12 months.
• Security and abuse records: counts of repeated attempts are deleted after two days. Error reports are deleted by our error-reporting provider after at most 90 days.
• Consent records (when you agreed to the Terms or to marketing, and the wording you saw): while your account is open, and deleted with it.

When we no longer need personal data, we delete it, or remove what identifies you.

8. Deleting your account

You can delete your account yourself from your Account page, or ask us to. Deletion happens 14 days after you ask, so that you can change your mind. Until then you can cancel the request, or download your data (your profile, progress, quiz results, memos and capstone) from your Account page.

After 14 days we delete your profile, enrolments, learning record, notes, memos, capstone, messages and help requests, and your access to your programmes ends. What we keep is set out in section 7: the reduced certificate record, payment records the law requires, and records that identify nobody.

9. Certificate verification

Each certificate has a credential ID and a web page. Anyone who has the ID or the link can open the page and see the holder’s name, the programme and the date of issue. Search engines are asked not to list these pages. When you share a certificate link, for example on LinkedIn, the preview shows your name and the programme.

If you delete your account, the page shows only your initials, the programme, the date and the credential ID. This record is still linked to you through the certificate you hold, so we treat it as personal data. You can ask us to remove it (section 7).

10. Quizzes and other automatic steps

Some steps happen automatically, by fixed rules: a quiz is marked against its answer key and pass mark, a quiz or client file brief opens once you have read the parts of a module it depends on, and a certificate becomes available once every requirement is met. The capstone is marked by a person.

If you think an automatic result is wrong, for example a quiz mark or a part that did not count as read, write to us. A person will look at your record, explain the result and correct it if it is wrong.

11. Your rights

Wherever you live, you have the right:

• to be told how your personal data is used, as in this policy;
• to see the personal data we hold about you, and receive a copy;
• to have inaccurate, incomplete or misleading data corrected;
• to have data deleted that we are no longer entitled to keep;
• to object to our processing of your data, and to ask us to restrict it while a question about it is settled;
• to receive your data in a structured, commonly used, machine-readable format, and have it sent to another organisation where that is technically possible;
• not to be subject to a decision based solely on automated processing that significantly affects you; and
• to withdraw your consent at any time, for anything we do on the basis of consent.

Your country’s law may give you further rights, and section 17 sets out the deadlines it gives us.

You can download your data and correct the name on your certificates from your Account page. For anything else, write to course@lawlab.africa. We may ask you to confirm who you are first. We answer within the time your country’s law sets (section 17), and within 30 days where it sets none.

If you are unhappy with how we have handled your data, you can complain to the data protection authority in your country (section 17).

12. Learners under 18

Our programmes are for adults unless a programme’s page says it is open to learners under 18. For a programme that is, a parent or guardian registers the learner and gives consent before we use the learner’s personal data, and we check the learner’s age. We never send marketing to a learner under 18, and we never use a younger learner’s name, image, work or words in our publicity. That programme’s own privacy notice gives the details.

13. Emails from us

Course emails (section 4) come with your enrolment and stop when your account is deleted.

Marketing emails, and the Data Protection Digest, are separate. You only receive them if you asked for them, each email has an unsubscribe link, and unsubscribing does not affect your course.

14. Cookies and what is kept on your device

The platform sets one cookie, which keeps you signed in. It is strictly necessary, so we do not ask for consent to it. We do not use advertising or tracking cookies.

We count page visits with an analytics service that sets no cookies and does not identify you. It tells us totals, such as how many people viewed a page and from which country. Web addresses are shortened before they are counted, so codes and sign-in links are never recorded.

The security check on the sign-up, sign-in, password and account deletion forms is provided by an outside service. It processes your IP address and technical details of your browser, only to tell people apart from automated programs.

Your browser also keeps a few things on your own device, which we cannot see until they are sent to your account: display settings, such as a collapsed sidebar and your highlighter colour; the ticks on your checklists and practitioner tasks; a copy of your capstone draft while you write it; and, if your connection drops, a short list of the lesson parts you have read, which is sent to your account when you are back online and cleared when you sign out.

15. How we protect your data

We protect personal data with technical and organisational measures. These include:

• encrypted connections;
• database rules that let each learner reach only their own records;
• access for our own staff limited to those who need it for their work;
• limits on repeated sign-in attempts and a security check against automated attacks; and
• error reports from which names, email addresses and form contents are removed before they leave the platform.

If someone gets unauthorised access to your personal data and there is a real risk of harm to you, we will tell the data protection authority within the time the law sets (72 hours in Kenya) and tell you in writing as soon as we reasonably can.

No system is completely secure. If you think your account has been misused, change your password and write to us at once.

16. Changes to this policy

We will update this policy when what we do with personal data changes. If we start to use your personal data for a new purpose, we will tell you before we do and ask for your consent where the law requires it. The date at the top shows when the policy last changed.

17. Your country

Kenya. The Data Protection Act, 2019 and its regulations apply. We answer within seven days for a copy of your data, 14 days for a correction or deletion, and 30 days for a transfer of your data to another organisation. If a breach puts you at real risk of harm, we tell the authority within 72 hours. The authority is the Office of the Data Protection Commissioner: www.odpc.go.ke.

Nigeria. The Nigeria Data Protection Act, 2023 applies. You may ask for a copy of your data, and we answer without unreasonable delay. If a breach is likely to put your rights at risk, we tell the Commission within 72 hours. You can complain to the Nigeria Data Protection Commission: ndpc.gov.ng.

Ghana. The Data Protection Act, 2012 (Act 843) applies. We answer a request for your data within 40 days. If you ask us to stop processing your data because it is causing or is likely to cause you unwarranted damage or distress, we tell you in writing within 21 days what we will do. We tell the Commission and you of a breach as soon as reasonably practicable. You can complain to the Data Protection Commission: dpc.gov.gh.

Botswana. The Data Protection Act, 2024 applies. We answer your request within one month. Where a request is complex, the Commission may allow us up to two more months, and we tell you within the first month if so. If a breach is likely to put your rights at risk, we tell the Commission within 72 hours. You can complain to the Information and Data Protection Commission.

Rwanda. Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy applies. We answer a request to correct your data, or to stop using it for direct marketing, within 30 days. If you are not satisfied with our answer, you can appeal to the supervisory authority, the National Cyber Security Authority, within 30 days of receiving it. We tell the authority of a breach within 48 hours. Under Rwandan law, you can also name in your will an heir who may exercise rights over your personal data after you.

If you live in another country, the data protection law of that country applies, and you can complain to its data protection authority.

18. Contact

Law Lab Africa LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Email: course@lawlab.africa.