Privacy Policy

1. Who We Are

EnergyLucid Limited (“EnergyLucid”, “we”, “us” or “our”) recognises the importance of privacy, the sensitivity of personal data, and the need to comply with applicable data protection laws, including the Nigeria Data Protection Act, 2023 (the “NDPA”), the General Application and Implementation Directive, 2025, the General Data Protection Regulation (GDPR) of the European Union, and other applicable data privacy laws and regulations.

We put you first and are committed to protecting and respecting your privacy. We are committed to being transparent about how we collect, process, share and manage data about you, including our customers and other natural persons where applicable.

Please read this Policy together with our Terms of Service and Cookie Policy.

This Privacy Policy regulates how EnergyLucid can process the personal information of its customers and other natural persons, where applicable. In line with the provisions of the NDPA, 2023, the GDPR, and other applicable data privacy laws and regulations, EnergyLucid maintains the following privacy principles, which govern how we collect, use, record, organise, structure, store, adapt or alter, retrieve, consult, disclose, disseminate, align, combine, restrict, erase or destroy and generally manage your personal data (“processing” or “process” of your Personal Data).

Personal Data under this Privacy Policy is as defined by the NDPA, 2023, the GDPR, and the Nigeria Data Protection Commission (NDPC), which is the body empowered to make regulations or directives prescribing categories of sensitive personal data, further grounds for processing same, and the safeguards that must apply.

2. Types of Personal Data We Collect

We may collect the following types of Personal Data in the course of providing our Services to you, whether through the Platform, forms, phone calls, correspondence by mail or email, service point interfaces, or any other channels we may make available to you from time to time.

2.1 Types of Information You Provide to Us

• Identity and Contact Information: Your name, email address, telephone/mobile phone number, physical or postal address, account details, communication preferences, username and other information necessary to identify or contact you.
• Property and Energy Information: The location and address of your property, property type, physical attributes of your property, energy systems, energy use, quantities of fuels consumed, electricity consumption, appliances, budget, project timelines, photographs, map coordinates, and financing preferences.
• Account and Service Information: Information provided when you create an account, use our Services, contact us, register or claim a business, or otherwise interact with the Platform, including information about your service requirements and preferences.
• Utility and Account Information: Identifying numbers associated with your utility or other accounts, including account numbers, meter numbers, and copies of utility bills, where applicable.
• Project and Business Information: Quotes, contracts, project milestones, messages, issues, reviews, business registration information, certifications, licences, warranties, and other information relating to projects or businesses registered or claimed through the Platform.
• Financing Information: If you apply for financing, your Bank Verification Number (BVN), together with documents and other information required by the relevant financing partner. Your BVN may be used for lawful purposes and in accordance with Applicable Law.
• Payment and Transaction Information: Billing details, transaction references, transaction amounts, payment status, and other information necessary to process or administer payments. We do not store full card numbers.
• Communications and Content: Records of your correspondence and communications with us or third parties using our system, including support requests, conversations with Energy Advisors, feedback, reviews, messages, photographs, documents, and other content or materials you upload or submit through the Platform.
• Information About Other Persons: If you provide us with Personal Data relating to another person, such as a team member, director, employee, representative, or other individual, you represent that you have the authority or lawful basis to provide that information and that you have informed the relevant person about this Privacy Policy and the applicable processing of their Personal Data.
• Information Authorized by You: Information that you authorize third parties to release or provide to us, including information provided by utility providers, financing partners, payment providers, businesses, installers, or other service providers.

2.2 Types of Information We Collect Through Technology

When you use our Platform or Services, we may use cookies, analytics tools, security technologies, and similar technologies to collect information about how you access and use the Platform. This may include:

• IP address;
• Device type and device identifiers;
• Internet connection information;
• Browser type and version;
• Time zone;
• Operating system and platform;
• Referring and exit pages;
• Pages viewed and resources accessed;
• Account access date and time stamps;
• Information about your interactions with the Platform;
• Security and access logs; and
• Cookie data stored on or accessed from your device.

An IP address is a number automatically assigned to a device when it connects to the Internet. We collect IP address information to help manage and secure our systems, understand how the Platform is used, and monitor traffic and usage. Your IP address may be associated with records containing Personal Data.

We may also collect information about your visits to and use of the Platform, including traffic volumes, logs, pages viewed, resources accessed, and other interactions with our Platform.

Please also see our Cookie Policy for further information about our use of cookies and similar technologies. Non-essential cookies will only be set where required consent has been obtained.

2.3 Location Information

We may collect location information associated with addresses or properties that you provide to us, including map coordinates. We may also collect your device's precise location where you have provided the necessary permission or consent.

2.4 Types of Information We Collect from Third Parties

We may receive Personal Data from third parties where permitted by Applicable Law. These sources may include official registries, businesses registered or listed on the Platform, installers, financing partners, payment providers, utility providers, advertising platforms, and other business or service partners.

Such information may include publicly available information, business registration and licensing information, identity or verification information, demographic or property-related information, financing-related information, and other information necessary to provide, improve, secure, or administer our Services.

Our business partners and other third parties may provide information about you or your property to help us understand the suitability of properties for energy products and Services, facilitate financing or installations, verify information, prevent fraud, conduct risk assessments, and conduct research and analysis to improve our Services.

Where permitted by Applicable Law, we may also obtain identity verification information, including information such as driver's licence information, from third-party vendors for identity verification and other lawful purposes.

We process Personal Data obtained from third parties in accordance with this Privacy Policy and Applicable Law.

3. How and Why We Use Your Information

We only collect and use Personal Data that is reasonably necessary to provide, administer, improve, and secure our Platform and Services, communicate with you, conduct our business operations, and comply with our legal and regulatory obligations. Depending on the nature and purpose of the processing, we process your Personal Data on one or more of the lawful bases described below and in accordance with Applicable Law.

We may use your Personal Data for the following purposes:

3.1 Providing and Administering Our Services

• To provide you with price quotations and information about the Services in which you have indicated an interest or for which you have registered;
• To process applications, provide financing where applicable, coordinate installations, and deliver and administer our Services;
• To perform our contract with you where you become a Registered User or authorized user;
• To manage your account and provide you with notices, updates, and other information relating to your account or Services;
• To respond to your questions, requests, complaints, and support inquiries and improve our customer service;
• To record and maintain your name, contact information, property information, and other Personal Data necessary to provide and administer our Services;
• To authorize, authenticate, and manage access to our Platform and Services; and
• To communicate with you about Services, transactions, applications, projects, or other matters relevant to your relationship with EnergyLucid.

3.2 Business Development, Marketing, and Communications

• To conduct business development activities, establish and maintain business relationships, and manage actual and prospective users and Registered Users;
• To provide newsletters, articles, alerts, announcements, and other information that may be relevant to you;
• To provide marketing and promotional information about our Services, where permitted by Applicable Law and, where required, based on your consent;
• To understand your interests and preferences and tailor our communications and Services accordingly; and
• To conduct surveys, research, and similar activities to understand the needs and experiences of our users and improve our Services.

You may opt out of marketing communications at any time, without affecting other communications or processing that are necessary to provide our Services or fulfil our legal or contractual obligations.

3.3 Improving Our Platform, Products, and Services

• To analyze how you interact with our Platform and Services;
• To compile statistics and conduct analysis regarding the use of our Platform;
• To improve the functionality, content, layout, accessibility, and user experience of our Platform;
• To understand how users navigate and interact with our Platform, including analyzing click paths and other usage patterns;
• To develop, test, improve, upgrade, and personalize our products, Services, programs, and other offerings; and
• To conduct research and analysis that helps us improve our business and develop new products and Services.

3.4 Security, Fraud Prevention, and Risk Management

• To verify your identity and authenticate users;
• To conduct internal audits, reviews, risk assessments, and quality or safety checks;
• To detect, prevent, investigate, and respond to fraud, security incidents, unlawful or criminal activity, abuse, or unauthorized access to or use of our Platform, Services, Personal Data, or information systems;
• To debug, troubleshoot, maintain, and improve the quality, security, and functionality of our Platform and Services; and
• To protect the rights, property, safety, and security of EnergyLucid, our users, business partners, service providers, and other persons.

3.5 Legal, Regulatory, and Compliance Purposes

• To comply with applicable laws, regulations, court orders, regulatory requirements, and professional responsibilities;
• To satisfy applicable identity verification (KYC), anti-money laundering and countering the financing of terrorism, credit reporting, tax, financial services, and data protection requirements;
• To respond to lawful requests from government authorities, regulators, courts, law enforcement agencies, or other authorized bodies;
• To establish, exercise, or defend our legal rights and claims; and
• To enforce our Terms of Service, Privacy Policy, contracts, and other agreements.

3.6 Other Legitimate Business Purposes

We may also use Personal Data where necessary for our legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms. Such purposes may include:

• Managing and maintaining our business operations and records;
• Managing relationships with customers, prospective customers, installers, financing partners, businesses, and other service providers;
• Planning and administering our business activities;
• Creating aggregated or de-identified information for analytical, statistical, research, and business purposes;
• Managing and protecting our technology, systems, networks, and information assets; and
• Supporting corporate transactions, including mergers, acquisitions, financing, restructuring, sale of assets, or similar business activities, subject to Applicable Law.

3.7 Lawful Bases for Processing

Our processing of Personal Data may be based on one or more of the following lawful bases:

• Consent: Where you have provided consent as the Data Subject. This may include activities that require your explicit permission, such as certain marketing communications. You may withdraw your consent at any time; however, withdrawal will not affect processing carried out before the withdrawal or processing based on another lawful basis.
• Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party, including providing financing, processing applications, coordinating installations, managing your account, and delivering our Services.
• Legal and Regulatory Obligations: Where processing is necessary for compliance with a legal obligation applicable to EnergyLucid, including identity verification (KYC), anti-money laundering and countering the financing of terrorism requirements, credit reporting, tax and financial services compliance, and obligations under applicable data protection laws, including the Nigeria Data Protection Act (NDPA), where applicable.
• Vital Interests: Where processing is necessary to protect the vital interests of you or another person, in accordance with Applicable Law.
• Public Interest: Where processing is necessary for the performance of a task carried out in the public interest, where permitted by Applicable Law.
• Legitimate Interests: Where processing is necessary for the legitimate interests of EnergyLucid or a third party, except where those interests are overridden by your fundamental rights and freedoms as a Data Subject. These legitimate interests may include protecting and securing the Platform and our Services, preventing fraud and abuse, improving user experience, conducting risk assessments, maintaining internal business operations, developing and improving our Services, and managing our business relationships.
• Employment: Where applicable, where processing is necessary in connection with an application for, offer of, or relationship arising from employment with EnergyLucid.

4. Sharing of Personal Data

We may disclose aggregated or de-identified information that does not identify any individual and therefore does not constitute Personal Data, without restriction, subject to Applicable Law.

We may share Personal Data with the following categories of recipients where necessary for the purposes described in this Privacy Policy, to provide our Services, or as otherwise permitted by Applicable Law:

4.1 Third-Party Service Providers

We may share Personal Data with affiliated and non-affiliated third-party service providers that provide services to or on behalf of EnergyLucid, including hosting and information technology services, cloud infrastructure, customer support, telephony, email delivery, text messaging, payment processing, auditing, analytics, security, research, and other related services.

Such providers may only process Personal Data in accordance with our instructions, applicable contractual obligations, and Applicable Law, and where appropriate are required to maintain the confidentiality and security of Personal Data.

4.2 Businesses and Service Providers You Engage

Where you submit a request for a quotation, project, installation, or other Service, we may share relevant project and property information with businesses or service providers matched to or selected by you.

Where applicable, and where necessary to facilitate the Services you request, we may share your name, contact details, property information, exact address, project requirements, and other relevant information with the business or service provider you choose to engage.

4.3 Financing Partners

Where you request an introduction to or apply for financing through our Platform, we may share the Personal Data reasonably required to facilitate your request with the financing partner you select.

The financing partner may process your Personal Data in accordance with its own privacy policy and Applicable Law.

4.4 Professional Advisers and Consultants

We may share Personal Data with professional advisers and consultants, including lawyers, accountants, auditors, compliance advisers, licensed Data Protection Compliance Organisations, and other professional service providers, where reasonably necessary for legal, regulatory, compliance, audit, accounting, risk management, or business purposes.

4.5 Strategic and Channel Partners

We may share Personal Data with strategic, commercial, or channel partners where necessary to provide, improve, market, or facilitate our Services, conduct research, develop products, or establish and maintain business relationships, subject to Applicable Law and any required consent.

4.6 Corporate Affiliates

Where applicable, we may share Personal Data with our corporate affiliates for purposes consistent with this Privacy Policy, including providing and administering our Services, maintaining systems and infrastructure, conducting business operations, managing risks, preventing fraud, and complying with legal and regulatory obligations.

4.7 Advertising and Marketing Partners

Where permitted by Applicable Law, we may share limited Personal Data or information derived from your use of our Platform with third parties that provide advertising, marketing, analytics, or campaign management services to us or that assist us in displaying or measuring advertising on our Platform or on third-party websites, applications, or devices.

We will not share your Personal Data with advertising partners for purposes requiring your consent unless the required consent has been obtained.

4.8 Business Transfers

Where applicable, we may share Personal Data in connection with a substantial corporate transaction, including a merger, acquisition, consolidation, financing, restructuring, sale or transfer of all or part of our business or assets, or a similar transaction, including in connection with insolvency or bankruptcy proceedings.

In such circumstances, Personal Data may be transferred as part of the relevant transaction, subject to Applicable Law and appropriate confidentiality and data protection requirements.

4.9 With Your Consent or at Your Direction

We may share Personal Data for any other purpose disclosed to you at the time we collect the information or where you have provided your consent or otherwise directed us to make the disclosure.

4.10 Other Legal and Protective Reasons

We may use or disclose Personal Data where we reasonably believe it is necessary or appropriate to:

• comply with Applicable Law, regulations, court orders, or other legal or regulatory requirements;
• respond to lawful requests from public, governmental, regulatory, or law enforcement authorities;
• establish, exercise, or defend our legal rights or claims;
• pursue available remedies or limit damages that EnergyLucid or its affiliates may sustain;
• protect the rights, privacy, safety, security, or property of EnergyLucid, our affiliates, users, employees, service providers, or other persons;
• protect or maintain the security, integrity, and operations of our Platform, systems, and Services;
• detect, prevent, investigate, or respond to fraud, security incidents, unlawful activity, or unauthorized access or use; or
• enforce our Terms of Use, Privacy Policy, and other applicable agreements.

5. Cookies and Similar Technologies

EnergyLucid uses cookies and similar technologies to operate, secure and improve the Platform.

Cookies may be used for:

• essential Platform functionality;
• authentication;
• security;
• preferences;
• analytics;
• performance measurement; and
• marketing or advertising, where applicable.

Where required by Applicable Law, we will obtain your consent before using non-essential cookies.

Further information is available in our Cookie Policy.

6. How Long Do We Keep It

We will retain your personal data as may be required by regulation in the country under consideration, after which it will be disposed of as required under the respective Government laws and regulations.

Please note that regulations may require EnergyLucid to retain your personal data for a specified period, even after the end of your relationship with us.

7. International Data Transfers

Some of our service providers, technology providers, partners or infrastructure may be located outside Nigeria.

Where Personal Data is transferred to, stored in, or accessed from another country, EnergyLucid will take reasonable steps required by Applicable Law to ensure that the transfer is lawful and that appropriate safeguards are implemented.

These safeguards may include contractual protections, appropriate data processing agreements, recognised transfer mechanisms or other safeguards required by Applicable Law.

8. Data Security

EnergyLucid is committed to ensuring that your Personal Data is secure. We implement appropriate physical, electronic, technical and organisational measures to protect your Personal Data against unauthorised or unlawful access, processing, disclosure, modification, loss, destruction or damage.

These measures may include encryption, firewalls, secure sockets layer (SSL) technology, role-based access, authentication controls, secure data storage, system monitoring and access controls. Access to Personal Data is limited to authorised staff, agents, contractors and service providers who are required to keep such information secure and confidential.

Where access to our Platform requires authentication, you are responsible for the security and confidentiality of your authentication credentials, including usernames, passwords, PINs, One-Time Passwords (OTPs) and tokens. You should not share or reuse your passwords or other authentication credentials.

We will take reasonable steps to ensure that Personal Data is not retained for longer than necessary and is handled in accordance with applicable statutory and regulatory requirements.

While we take reasonable measures to protect your Personal Data, no data transmission or storage system can be guaranteed to be completely secure at all times. Email and text messaging may not be secure forms of communication, and you should avoid using them to send information you consider confidential.

If you have reason to believe that your interaction with us or your Personal Data is no longer secure, please notify us promptly in accordance with the “Contact Us” section of this Privacy Policy. Where a data breach occurs that may compromise the privacy or security of your Personal Data, we will take the steps required under the NDPA, including notifying the NDPC within 72 hours where required and notifying you without undue delay where the breach is likely to pose a high risk to you.

EnergyLucid will not be responsible for any outcome resulting from your circumvention of applicable privacy settings or security measures.

9. Capacity / Children's Privacy

This Platform is only intended for individuals who are at least 18 years of age. We do not knowingly encourage or solicit visitors to this Platform who are under the age of 18.

The NDPA defines a child as a person under the age of 18. We do not knowingly collect Personal Data from children. Where it becomes necessary to process a child's Personal Data, we will do so only with the consent of the child's parent or legal guardian, as required by the NDPA. If we discover that we have received Personal Data from a child without such consent, we will promptly delete it.

10. Your Privacy Rights and Responsibilities

You have certain rights in relation to your Personal Data under the NDPA, GDPR and other applicable Data Protection Laws. These include the right to:

1. Request access to the Personal Data we hold about you.
2. Request that inaccurate or incomplete Personal Data be corrected or updated.
3. Request deletion of your Personal Data, subject to applicable legal and regulatory requirements.
4. Request restriction of the processing of your Personal Data.
5. Object to the processing of your Personal Data where applicable.
6. Request the transfer of your Personal Data to another organisation in a commonly used and machine-readable format, where applicable.
7. Withdraw your consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
8. Object to decisions based solely on automated processing, including profiling, where applicable.
9. Lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe your data protection rights have been violated.

Some rights may be subject to limitations under applicable law. For example, we may retain certain Personal Data where required to comply with legal, regulatory or other applicable obligations.

Where you provide Personal Data to EnergyLucid, you are responsible for ensuring that the information you provide is accurate and that you have the lawful authority to provide Personal Data relating to another person.

You should notify us if information associated with your account is inaccurate or requires updating.

Where access to our electronic services requires authentication, you are responsible for keeping your login credentials confidential and for notifying us promptly if you believe that your credentials have been compromised or used without authorisation.

11. Complaints and Data Protection Requests

If you have concerns about how EnergyLucid processes your Personal Data, or wish to exercise any of your rights under this Privacy Policy, please contact us using the details provided in the “Contact Us” section.

We will make reasonable efforts to respond to your request or complaint within the timeframe required by applicable Data Protection Laws.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe that your Personal Data has been processed in violation of applicable Data Protection Laws.

12. Data Breach Management

If EnergyLucid becomes aware of a Personal Data breach, we will take reasonable and appropriate steps in accordance with Applicable Law.

Depending on the nature and severity of the incident, these steps may include:

1. Promptly assessing the nature, scope and impact of the breach.
2. Notifying the NDPC without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, where required by Applicable Law.
3. Notifying affected individuals as soon as practicable where required.
4. Investigating the cause and extent of the breach.
5. Taking corrective and mitigating measures to contain the breach and prevent further incidents.
6. Addressing identified vulnerabilities and implementing additional security measures where required.
7. Documenting breach-related activities and maintaining records as required by Applicable Law.

Where Applicable Law requires notification to the NDPC within a specified period, EnergyLucid will make the required notification within that period, including within seventy-two (72) hours where that requirement applies.

13. Third-Party Websites and Services

Our Services may contain links to websites, applications or services operated by third parties.

EnergyLucid does not control and is not responsible for the privacy practices, content, security or policies of third-party websites or services.

You should review the privacy policy of any third-party service before providing Personal Data to it.

Where EnergyLucid integrates a third-party service into the Platform, that service may process information in accordance with its own terms and privacy practices.

14. Updates to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in our business or applicable legal and regulatory requirements. Where updates are made, we will update the “Last Updated” date of this Privacy Policy.

Where a change materially affects your rights or how we process your Personal Data, we will provide additional notice where appropriate. We encourage you to review this Privacy Policy periodically.

15. Governing Law

This Privacy Policy is made pursuant to the Nigeria Data Protection Act, 2023 (NDPA), the General Application and Implementation Directive, 2025, and other applicable laws and regulations in Nigeria, as may be amended or replaced from time to time (“Applicable Law”).

Where any provision of this Privacy Policy conflicts with a mandatory requirement of Applicable Law, the applicable law shall prevail to the extent of the inconsistency.

16. Contact Us

If you have questions, requests or concerns about this Privacy Policy or the way EnergyLucid processes Personal Data, please contact us:

EnergyLucid Limited

Privacy enquiries: privacy@energylucid.co
General support: support@energylucid.co
Telephone: +234 816 828 2838

When submitting a privacy request, please clearly describe the request and provide sufficient information for us to identify the relevant account or information.