Privacy Notice

Last Updated: 1 October 2025

1. Introduction

COF Chambers ("we", "our", "us", or "the Firm") is a boutique public interest law firm committed to providing exceptional legal services and protecting the rights of our clients. We are equally committed to protecting the privacy and security of your personal data.

This Privacy Notice explains how we collect, use, store, and share your personal information when you use our services, visit our website at www.cof-law.com, or interact with us. It also sets out your rights in relation to your data under Zambian law.

We are a 'data controller' for the purposes of the Data Protection Act No. 3 of 2021 of the Laws of Zambia. This means we are responsible for deciding how we hold and use your personal information.

By engaging our services, visiting our website, or providing your information to us, you acknowledge the practices described in this notice.

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped as follows:

  • Identity Data: Includes first name, maiden name, last name, National Registration Card (NRC) number, passport number, marital status, title, date of birth, and gender.

  • Contact Data: Includes physical address, postal address, email address, and telephone numbers.

  • Special Category Data: In the course of providing legal services, we may need to process more sensitive data. This includes details about your:

    • Race or ethnicity

    • Religious or philosophical beliefs

    • Sex life or sexual orientation

    • Political opinions

    • Trade union membership

    • Health information

    • Criminal convictions and offences

  • Financial and Transaction Data: Includes bank account details, payment details, details about payments to and from you, and other details of services you have purchased from us.

  • Technical Data: Includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.

  • Usage Data: Includes information about how you use our website and services.

  • Marketing and Communications Data: Includes your preferences in receiving marketing from us and your communication preferences.

3. How We Collect Your Personal Data

We use different methods to collect data from and about you, including:

  • Direct Interactions: You may give us your Identity, Contact, Financial, and Special Category Data by filling in forms or by corresponding with us by post, phone, email, or in person. This includes personal data you provide when you:

    • instruct us to provide legal services;

    • subscribe to our publications or mailing lists;

    • request marketing to be sent to you;

    • or give us feedback or contact us.

  • Automated Technologies or Interactions: As you interact with our website, we may automatically collect Technical and Usage Data using cookies and similar technologies. Please see our Cookie Policy for more information.

  • Third Parties or Publicly Available Sources: We may receive personal data about you from various third parties and public sources, such as:

    • Advocates, medical professionals, or other experts.

    • Courts, tribunals, or government bodies (e.g., the Patents and Companies Registration Agency (PACRA), Zambia Revenue Authority).

    • Opposing parties and their legal representatives in the context of legal proceedings.

4. How We Use Your Personal Data (Our Lawful Bases)

We will only use your personal data when the law allows us to. Our primary lawful bases for processing, in accordance with the Data Protection Act No. 3 of 2021, are:

  • Performance of a Contract: Processing is necessary for the performance of our contract with you to provide legal services.

  • Legal and Regulatory Obligations: Processing is necessary for compliance with our legal and regulatory obligations, such as those under the Legal Practitioners Act, anti-money laundering regulations, and our duties to the courts.

  • Legitimate Interests: Processing is necessary for our legitimate interests (or those of a third party), such as for administrative purposes, network security, and business development, provided your interests and fundamental rights do not override those interests.

  • Consent: In limited circumstances, we may ask for your explicit consent to process your data, for example, to send you certain types of marketing communications.

Where we process Special Category Data or data relating to criminal convictions, we do so under the additional specific conditions set out in the Data Protection Act, which include:

  • The establishment, exercise, or defence of legal claims.

  • Reasons of substantial public interest, in line with our public interest mandate.

  • With your explicit consent.

5. Data Sharing and Disclosures

We may have to share your personal data with the parties set out below for the purposes outlined in section 4.

  • Service Providers: Such as IT and system administration services, secure document disposal services, and cloud-based storage providers operating within or outside Zambia.

  • Professional Advisers: Including advocates, experts, accountants, auditors, and insurers.

  • Courts, Tribunals, and Regulatory Authorities: As required by law or in the course of legal proceedings.

  • Opposing Parties and their Legal Representatives: As necessary for the conduct of your case.

  • Third Parties to whom we may choose to transfer or merge parts of our business.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

6. International Transfers

We will only transfer your personal data outside Zambia if one of the following conditions is met:

  • The recipient country is prescribed by the Minister under the Data Protection Act as having adequate data protection laws.

  • Appropriate safeguards are in place (e.g., standard contractual clauses approved by the Zambian authorities).

  • You have provided explicit consent to the transfer.

  • The transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken at your request.

7. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

We have procedures to deal with any suspected personal data breach and will notify you and the Office of the Data Protection Commissioner of a breach where we are legally required to do so.

8. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. In particular, we are required to retain client files and financial records for a minimum period as stipulated by Zambian law, including the Legal Practitioners Act and regulations issued by the Law Association of Zambia. We retain data in accordance with our internal data retention policy.

9. Your Legal Rights

Under the Data Protection Act No. 3 of 2021, you have the following rights:

  • The right of access – You have the right to request copies of your personal data.

  • The right to rectification – You have the right to request correction of inaccurate or incomplete information.

  • The right to erasure – You have the right to request that we erase your personal data, in certain circumstances.

  • The right to restrict processing – You have the right to request that we restrict the processing of your personal data, in certain circumstances.

  • The right to object to processing – You have the right to object to our processing of your personal data, in certain circumstances.

  • The right to data portability – You have the right to request the transfer of your data to another organisation, or directly to you, in certain circumstances.

You will not have to pay a fee to exercise your rights. If you make a request, we have thirty (30) days to respond to you. Please contact us using the details below to make a data subject request.

10. How to Complain

If you have any concerns about our use of your personal information, you can make a complaint to us at the contact details below.

You also have the right to lodge a complaint with the Zambian data protection regulator:

The Office of the Data Protection Commissioner
Under the Ministry of Technology and Science
Lusaka, Zambia

We would, however, appreciate the chance to deal with your concerns before you approach the Regulator.

This privacy notice was drafted for COF Chambers (cof-law.com) with compliance with the Data Protection Act No. 3 of 2021 of the Laws of Zambia in mind.