Chamber by Bilma

Privacy Policy

Table of contents

Effective Date: 1 October 2026
Last Updated: 1 October 2026
Controller/Platform Operator: Bilma Technologies Ltd
Product: Chamber by Bilma (“Chamber”, “we”, “us”, or “our”)
Jurisdiction: Nigeria

Important: This Privacy Policy describes Chamber’s intended data practices for practitioners, clients/customers, website visitors, and users who connect third-party services such as Google Calendar. Bilma Technologies Ltd should have this Policy reviewed by its legal/privacy adviser before publication and update it whenever its data practices, vendors, or features materially change.

1. About Chamber

Chamber by Bilma is a professional technology platform for legal practitioners. It provides tools that may include practitioner profiles and public professional pages, legal-practitioner discovery, consultation booking, smart client intake, appointment and availability management, calendar synchronization, virtual consultation links, client/practitioner relationship management, matter-management workflows, conflict-screening assistance, case studies, reviews, ratings, notifications, and reminders.

Chamber is a technology platform. Chamber is not a law firm and does not itself provide legal advice or legal representation.

A legal practitioner who uses Chamber remains responsible for their professional relationship with clients, the legal services they provide, and their own professional, ethical, confidentiality, and data-protection obligations.

2. Who This Policy Applies To

This Privacy Policy applies to:

Legal Practitioners who create or manage a Chamber professional account;
Clients/Customers who discover, contact, book, or communicate with a legal practitioner through Chamber;
Visitors to Chamber’s public website and public practitioner profiles;
Users who connect third-party services, including Google Calendar; and
individuals whose personal information is submitted to Chamber by an authorized user where applicable.

This Policy does not replace a legal practitioner’s own privacy notice or professional confidentiality obligations. Where a practitioner has their own privacy notice governing their client relationship, that notice may also apply.

3. Our Role in Personal Data Processing

Depending on the activity, Bilma Technologies Ltd may act as a data controller, data processor, or another legally recognized processing role.

3.1 Chamber platform data

For information we collect and use to operate Chamber itself — such as account registration, authentication, security, platform analytics, support, and administration — Bilma Technologies Ltd generally determines the purposes and means of processing and acts as the controller, subject to applicable law.

3.2 Practitioner-managed client and matter data

A legal practitioner may use Chamber to collect and manage information relating to clients, enquiries, consultations, matters, conflict checks, notes, and other professional activities.

For such information, the practitioner may determine the purposes and means of processing. Depending on the circumstances and applicable law, Bilma may process that information on the practitioner’s behalf as a processor/service provider.

The practitioner is responsible for determining the appropriate lawful basis for their processing and for meeting applicable professional confidentiality, legal, and regulatory obligations.

3.3 Independent responsibilities

Nothing in this Policy creates a lawyer-client relationship between Chamber and a client.

Chamber does not make legal decisions on behalf of practitioners, determine whether a person should receive legal representation, or independently determine the outcome of a legal matter.

4. Personal Information We Collect

We collect information according to the user’s relationship with Chamber and the features they use.

4.1 Information provided by practitioners

A legal practitioner may provide:

full legal/professional name;
email address;
phone number;
profile photograph;
professional biography;
username/public profile URL;
location;
firm or chambers name;
professional title or rank;
year of call to the Nigerian Bar, where provided;
years of practice;
practice areas;
professional qualifications and credentials;
education and memberships;
professional website;
LinkedIn, X, or other professional links;
services offered;
service descriptions;
consultation prices and currency;
service duration;
virtual/physical consultation options;
professional consultation location;
availability and booking rules;
case studies that the practitioner chooses to publish;
responses to reviews;
account credentials and authentication information; and
communications with Chamber support.

Some professional information may be displayed publicly when the practitioner chooses to publish their profile.

4.2 Information provided by clients/customers

A client may provide:

full name;
email address;
phone number;
profile photograph, where provided;
account and authentication information;
consultation requests;
selected practitioner;
selected service;
consultation mode;
appointment date and time;
legal matter category;
information about the nature of their legal enquiry;
names of other persons or organizations relevant to an enquiry;
urgency or deadlines;
information voluntarily submitted during smart intake;
documents or other information submitted through supported features;
communications with the practitioner through Chamber;
reviews and ratings;
saved practitioners; and
support requests.

Clients should provide only information reasonably necessary for their request and should avoid submitting highly sensitive information unless it is necessary for the legal service or specifically requested by the practitioner.

4.3 Practitioner-client relationship information

Chamber may maintain records showing that a client has interacted with a practitioner, including relationship status, first interaction date, most recent interaction date, enquiries, appointments, services selected, reviews, and other platform activity associated with that professional relationship.

A customer’s global Chamber identity is separate from their relationship with any individual practitioner.

4.4 Matter and legal-intake information

Where enabled by a practitioner, Chamber may process information relating to a legal enquiry or matter, including matter category, description of the issue, relevant parties, adverse parties, related parties, deadlines, urgency, documents or information voluntarily submitted, appointment information, and practitioner-generated matter information.

Legal matter information can be highly sensitive. Chamber uses access controls and tenant isolation so that private information belonging to one practitioner or professional workspace is not made available to another practitioner.

4.5 Information collected automatically

When you use Chamber, we may collect technical and usage information such as IP address, browser and device information, operating system, approximate location derived from technical information where necessary, pages or screens viewed, actions taken within Chamber, timestamps, referring URLs, error and diagnostic information, security and authentication logs, and cookie or similar technology identifiers.

We use this information for security, service operation, troubleshooting, analytics, and product improvement, subject to applicable law and user choices.

5. Google Calendar and Google Account Data

Practitioners may connect a Google account to Chamber to use calendar-powered booking features.

5.1 Why Chamber requests Google Calendar access

When a practitioner connects Google Calendar, Chamber may access the minimum Google Calendar information necessary to provide features such as:

checking calendar availability;
preventing double bookings;
creating Chamber consultation events;
updating consultation events when appointments are rescheduled;
cancelling Chamber-created calendar events when appointments are cancelled; and
creating Google Meet conferencing for virtual consultations where supported.

Chamber does not need access to a practitioner’s entire calendar for these purposes.

5.2 Google Calendar information we may access

Depending on the permissions authorized by the practitioner, Chamber may receive:

Google account identifiers needed to establish the connection;
Google account email address;
calendar identifiers and calendar metadata;
calendar availability/free/busy information;
identifiers for calendar events created by Chamber;
conference information associated with Chamber-created virtual consultations; and
OAuth authorization information required to maintain the connection.

Chamber does not intentionally copy or permanently store the practitioner’s unrelated personal calendar events merely to provide availability.

5.3 How Google Calendar data is used

Google Calendar data is used only to provide the calendar and booking functionality described in the Chamber interface and this Policy, including determining whether a requested consultation slot is available, creating a calendar event for a confirmed consultation, associating a Google Meet link with a virtual consultation, updating or cancelling a Chamber-created event, and maintaining the connection required to perform these functions.

5.4 What Chamber does not do with Google data

Chamber does not:

sell Google user data;
use Google Calendar data for advertising;
use Google Calendar data to build advertising profiles;
use Google Calendar data to determine creditworthiness;
use Google Calendar data for lending decisions;
use Google Calendar data to train a general-purpose artificial intelligence model;
use Google Calendar data for unrelated services; or
disclose Google user data to third parties except as permitted by applicable law and Google’s applicable policies and as necessary to provide the authorized functionality.

We do not allow human access to Google user data except where permitted by applicable law and Google’s applicable policies, including where necessary for security, compliance, troubleshooting with appropriate authorization, or other permitted circumstances.

5.5 Google Limited Use commitment

Chamber’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request only permissions that are necessary for the features being provided. If the scope or purpose of Google data access changes materially, we will update this Policy and the relevant in-product disclosures as required.

5.6 Disconnecting Google Calendar

A practitioner may disconnect Google Calendar through Chamber’s integration settings, subject to security or legal requirements.

When the connection is disconnected or revoked, Chamber will stop using the authorization to access the practitioner’s Google Calendar.

OAuth credentials and other Google authorization data will be deleted or invalidated in accordance with our security, retention, and legal obligations. Chamber-created appointment records may continue to be retained as ordinary Chamber records where necessary to provide the service, maintain accounting/audit records, resolve disputes, or comply with legal obligations.

Unrelated Google calendar event content is not retained as part of Chamber’s ordinary appointment records.

6. How We Use Personal Data

We may process personal data for the following purposes:

Account and authentication

create and maintain user accounts;
authenticate users;
verify email addresses;
maintain secure sessions;
recover accounts; and
prevent unauthorized access.

Practitioner services

create practitioner profiles;
publish professional information at the practitioner’s direction;
display services and pricing;
make practitioners discoverable where they have elected to publish;
manage availability;
facilitate consultations;
manage professional relationships;
support reviews and case studies; and
provide practitioner analytics.

Client services

allow clients to discover practitioners;
facilitate enquiries;
collect and route intake information;
allow clients to select services;
facilitate appointment scheduling;
provide booking confirmations;
send reminders and notifications;
facilitate virtual consultations;
allow clients to manage their Chamber profile; and
allow clients to review completed consultations where enabled.

Security and integrity

detect and prevent fraud and abuse;
protect accounts;
detect suspicious activity;
investigate security incidents;
enforce platform rules;
maintain audit logs; and
protect the rights, safety, and property of users and Bilma.

Product operations

maintain and troubleshoot Chamber;
monitor reliability and performance;
understand product usage;
improve user experience;
develop and maintain platform features; and
provide customer support.

Legal and regulatory purposes

We may process or disclose information where necessary to comply with applicable laws, respond to lawful requests, establish, exercise, or defend legal claims, enforce agreements, protect users or the public, investigate security incidents or abuse, or meet regulatory or professional obligations.

7. Lawful Bases for Processing

Depending on the processing activity and applicable law, Chamber may rely on one or more lawful bases, including:

Performance of a contract: where processing is necessary to create an account, provide requested services, facilitate a booking, or perform an agreement.
Consent: where we ask for consent and applicable law requires or permits consent as the lawful basis.
Legal obligation: where processing is necessary to comply with applicable law or a valid legal requirement.
Legitimate interests: where permitted by applicable law, including security, fraud prevention, service administration, and responsible product improvement, while taking account of applicable rights and interests.
Protection of vital interests or public interest: where recognized and applicable under law.

Where we rely on consent, users may withdraw consent where legally available. Withdrawal does not affect processing that occurred lawfully before withdrawal or processing that has another lawful basis.

8. Public Practitioner Profiles

A practitioner may choose to publish a professional profile.

Public information may include professional name, professional photograph, professional biography, title/rank, location, practice areas, years of practice, professional qualifications and credentials, professional links, services and prices, consultation formats, published case studies, eligible reviews and ratings, and configured professional availability information where the feature is designed to expose available booking slots.

Private information is not intended to appear on a public profile.

Public profiles must not contain confidential client information. Practitioners are responsible for ensuring that case studies, testimonials, photographs, and other information they publish are appropriate for public disclosure and do not violate professional confidentiality or applicable law.

9. Client Confidentiality and Practitioner Responsibilities

Chamber provides technical controls designed to separate practitioner workspaces and limit unauthorized access.

However, Chamber is a technology platform and does not determine the professional confidentiality obligations applicable to a particular legal engagement.

Practitioners are responsible for collecting information lawfully, providing appropriate privacy notices to clients where required, maintaining professional confidentiality, determining appropriate retention periods for client records, ensuring public case studies and testimonials are appropriately sanitized and authorized, complying with applicable legal-professional rules, and configuring Chamber in a manner consistent with their obligations.

Clients should understand that submitting information through Chamber does not, by itself, create a lawyer-client relationship with Bilma Technologies Ltd.

We do not sell personal data.

We may share or permit access to personal data only as reasonably necessary for the purposes described in this Policy and as permitted by applicable law.

10.1 Service providers

We may use third-party providers for functions such as cloud hosting and infrastructure, database and authentication, email and notifications, security and monitoring, analytics, customer support, calendar and virtual meeting services, payment processing where applicable, and other technology services required to operate Chamber.

These providers are expected to process information only for authorized purposes and subject to appropriate contractual, security, and legal safeguards.

10.2 Google

If a practitioner connects Google Calendar, Google processes information under Google’s own privacy terms and policies. Chamber’s use of information received from Google APIs is subject to the Google API Services User Data Policy and applicable Google Workspace policies.

10.3 Practitioners and clients

Information may be shared between a practitioner and their client where necessary to facilitate a professional relationship, enquiry, appointment, consultation, or other user-requested service.

A customer’s private information associated with Practitioner A is not automatically made available to Practitioner B merely because the customer has a global Chamber account.

10.4 Legal and regulatory disclosures

We may disclose information when required or permitted by applicable law, regulation, court order, lawful governmental request, or to protect legal rights, safety, security, or the integrity of Chamber.

10.5 Business transfers

If Bilma Technologies Ltd undergoes a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable law and appropriate notice.

11. Cross-Border Processing and International Transfers

Some service providers used to operate Chamber may process information outside Nigeria.

Where personal data is transferred across borders, we will take steps required by applicable Nigerian data-protection law and other applicable laws, including using appropriate safeguards where required.

Users may contact us for information about applicable transfer safeguards.

12. Data Security

We use technical and organizational safeguards designed to protect personal information against unauthorized access, alteration, disclosure, loss, destruction, or misuse.

Depending on the type of information and feature, safeguards may include encryption in transit, secure authentication, access controls, tenant isolation, role-based permissions, row-level security where supported by the platform architecture, server-side handling of sensitive credentials, secure OAuth token storage, audit logging, monitoring and incident detection, least-privilege access, backups and recovery controls, and security reviews and operational procedures.

Google OAuth access and refresh credentials are not intended to be exposed to browser clients.

No internet-based service can guarantee absolute security. Users should also protect their account credentials and notify us of suspected unauthorized access.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods may depend on the type of information, purpose for processing, account status, practitioner and client relationships, appointment and transaction history, legal or regulatory requirements, dispute resolution, security and fraud prevention, professional recordkeeping obligations, and backup/disaster-recovery cycles.

Different categories of data may therefore have different retention periods.

When information is no longer required, we will delete, anonymize, or securely dispose of it in accordance with applicable law and our retention procedures.

14. Account Deletion and Data Deletion Requests

Users may request deletion of their Chamber account or personal information, subject to applicable law and legitimate retention requirements.

Deletion may not immediately remove information that we are legally required to retain or that is necessary for legal claims, fraud and security investigations, regulatory compliance, accounting or transaction records, dispute resolution, professional or contractual recordkeeping, or other lawful purposes.

Where deletion is not possible for one of these reasons, we will explain the applicable limitation where required.

Deleting a customer’s global Chamber account does not necessarily erase records that a legal practitioner is independently required or permitted to retain as part of their professional records.

15. Your Data Protection Rights

Subject to applicable law and relevant exceptions, data subjects may have rights including:

Right to be informed about how personal data is processed;
Right of access to personal data held about them;
Right to rectification of inaccurate or incomplete information;
Right to object to certain processing;
Right to restrict processing in applicable circumstances;
Right to data portability where applicable;
Right to erasure/forgetting where applicable;
Right to withdraw consent where consent is the lawful basis;
Rights relating to automated decision-making, where applicable; and
Right to lodge a complaint with the relevant supervisory authority.

The Nigeria Data Protection Commission identifies these rights under the Nigeria Data Protection Act 2023.

To exercise a right, contact us using the details in Section 23.

We may need to verify your identity before fulfilling certain requests.

16. Automated Decision-Making and AI

Chamber may use automation to assist with operational workflows, such as categorizing enquiries, extracting or normalizing information, suggesting relevant intake questions, summarizing information for authorized practitioners, identifying potential duplicate or matching names for conflict-review assistance, or improving workflow efficiency.

These tools are intended to assist users and do not replace professional legal judgment.

Chamber does not intend for automated systems to provide legal advice as a substitute for a qualified practitioner, independently determine that a legal conflict exists, independently reject a client, determine a person’s legal rights, make final professional decisions on behalf of a practitioner, or make other legally significant decisions about a person without an appropriate lawful basis and safeguards.

Where applicable law provides rights concerning automated decision-making, users may exercise those rights.

17. Cookies and Similar Technologies

Chamber may use cookies, local storage, session technologies, and similar mechanisms for authentication and session management, security, remembering preferences, maintaining application functionality, performance monitoring, analytics, and understanding how users interact with the platform.

Where required by law, we will provide appropriate cookie choices and obtain consent for non-essential technologies.

Blocking certain cookies may affect functionality.

18. Communications

We may send users account verification messages, password/account security messages, booking confirmations, appointment reminders, rescheduling and cancellation notifications, service-related notices, security alerts, support responses, and other operational communications.

Where legally permitted and subject to applicable consent requirements, we may also send product or marketing communications.

Users can unsubscribe from non-essential marketing communications without affecting essential service communications.

19. Third-Party Links and Services

Chamber may contain links to third-party websites or services.

Third parties operate under their own terms and privacy policies. We are not responsible for the privacy practices of third-party services that we do not control.

Where Chamber integrates with a third-party service, such as Google Calendar or Google Meet, that provider may independently process information under its own policies.

20. Children’s Privacy

Chamber is intended for adults and professional/legal-service use.

We do not knowingly design Chamber to collect personal information from children without a lawful basis and appropriate safeguards.

If we become aware that we have collected personal data from a child in circumstances where collection was not lawful, we will take appropriate steps to address the information in accordance with applicable law.

21. Data Breaches and Security Incidents

We maintain procedures intended to identify, investigate, contain, and respond to personal-data security incidents.

Where applicable law requires notification of a personal-data breach to affected individuals, regulators, or other parties, we will make the required notifications within the applicable timeframes.

22. Changes to This Privacy Policy

We may update this Privacy Policy when Chamber introduces new functionality, our data-processing practices change, our service providers change, applicable law or regulatory requirements change, Google or another integrated service changes its applicable requirements, or security and privacy practices are improved.

When changes are material, we will provide an appropriate notice through Chamber or another reasonable communication channel.

The “Last Updated” date at the beginning of this Policy will indicate when it was most recently revised.

23. Contact Us

Bilma Technologies Ltd

5 Kwaji Close,
Maitama, Abuja 904101,
Federal Capital Territory, Nigeria.

Privacy and Data Protection Contact:
support@bilmapay.com

Telephone:
+234 912 525 6272

When submitting a privacy request, please include your full name, email address associated with your Chamber account, the nature of your request, and any information reasonably necessary for us to identify and process the request.

We may request additional information to verify your identity and protect your information from unauthorized disclosure.

24. Complaints and Regulatory Recourse

We encourage users to contact us first so that we can investigate and address privacy concerns.

Where a user believes their rights under applicable data-protection law have been infringed and the matter cannot be resolved directly with us, they may have the right to lodge a complaint with the applicable supervisory authority.

For users in Nigeria, the relevant supervisory authority is the Nigeria Data Protection Commission (NDPC).

Official website: https://ndpc.gov.ng/

25. Google API and Google User Data Disclosure

For clarity, Chamber’s use of Google user data is limited to providing the calendar and meeting features requested by the practitioner.

Google data accessed through authorized Google APIs will not be sold or used for advertising, creditworthiness, lending, or unrelated purposes.

Chamber will not use Google user data to train or improve a general-purpose artificial intelligence or machine-learning model.

Google user data will only be transferred where necessary to provide or improve the authorized user-facing functionality, for security purposes, to comply with applicable law, or in another circumstance expressly permitted by Google’s applicable policies.

Chamber’s handling of Google user data is intended to comply with the Google API Services User Data Policy and its Limited Use requirements.

26. Platform Privacy Principles

Chamber is designed around the following principles:

Data minimization

We aim to collect only information reasonably necessary for the feature being used.

Purpose limitation

Personal data should be used for the purposes for which it was collected or other purposes permitted by applicable law.

Tenant isolation

Private legal-practice data is separated by practitioner/tenant and is not intended to cross between independent practitioners.

Customer identity separation

A customer may have one Chamber identity while maintaining separate professional relationships with multiple practitioners.

Professional confidentiality

Chamber is designed to support practitioners’ professional workflows without making private legal information publicly discoverable.

Security by design

Access controls, authentication, encryption, auditability, and least-privilege principles are incorporated into the platform architecture.

Transparency

We aim to clearly explain what data is collected, why it is needed, and how it is used.

27. Summary for Practitioners

When you use Chamber as a legal practitioner:

You control what professional information you publish.
You decide which services are offered through your profile.
You decide whether and how your public profile is published.
You control whether to connect Google Calendar.
Google Calendar access is used to support availability, booking, calendar events, and virtual meeting functionality.
Chamber does not intentionally expose your private calendar events to clients.
Your private client and matter information is tenant-scoped.
You remain responsible for your professional confidentiality and data-protection obligations.
You can disconnect Google Calendar through Chamber.
You can contact us regarding privacy or data-protection requests.

28. Summary for Clients

When you use Chamber as a client:

You may use one Chamber account to interact with multiple legal practitioners.
Your account identity is separate from each practitioner relationship.
Information you provide for one practitioner is not automatically made available to another practitioner.
Information required for a legal enquiry or consultation may be shared with the practitioner you choose so they can provide the requested service.
Chamber does not provide legal advice itself.
You can request access, correction, deletion, restriction, portability, or other rights where available under applicable law.
You can contact us if you have concerns about how Chamber processes your information.

29. Governing Framework

This Policy is intended to operate consistently with applicable privacy and data-protection requirements, including the Nigeria Data Protection Act 2023, applicable regulations and guidance issued by the Nigeria Data Protection Commission, and applicable requirements governing third-party integrations such as Google’s API and user-data policies.

Where mandatory law provides greater protection or imposes additional obligations, the mandatory requirements will apply.