1. Introduction

Kenpetrus Energy Resources Limited ("we", "our", or "the Company") is committed to protecting the privacy and personal data of all individuals whose information we process. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our meter sales operations and our Staff Portal system.

This policy is compliant with the Nigerian Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR).

2. Data We Collect

In the course of processing meter purchase orders, we collect the following personal data from customers:

• Full name
• Email address
• Phone number
• Meter type and quantity ordered
• Payment reference information (Remita RRR)
• Order amount and transaction date

For staff members using the portal, we collect:

• Full name and email address
• Encrypted login credentials
• Login timestamps and IP addresses for security purposes
• Activity records within the portal

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• Processing and fulfilling meter purchase orders
• Generating and transmitting payment invoices via Remita
• Confirming payments to the Enugu Electricity Distribution Company (EEDC)
• Sending order confirmation and payment receipt communications
• Maintaining accurate records of all transactions
• Ensuring the security and integrity of our portal
• Complying with applicable laws and regulations

4. Legal Basis for Processing

We process personal data on the following legal bases under the NDPA 2023:

• Contract performance — processing is necessary to fulfil meter purchase orders
• Legitimate interests — maintaining security logs and audit trails to protect our systems and customers
• Legal obligation — compliance with applicable Nigerian laws and regulatory requirements

5. Data Sharing

We share personal data only where necessary and with the following third parties:

• EEDC (Enugu Electricity Distribution Company) — to confirm meter payments and update order status on their platform
• Remita Payment Services — to generate payment invoices and process customer payments
• Email delivery service — solely for the purpose of sending transactional emails to customers

We do not sell, rent, or trade personal data to any third party for marketing or commercial purposes.

6. Data Retention

We retain customer order data for a minimum of seven (7) years in accordance with Nigerian financial record-keeping requirements. Staff activity logs are retained for a minimum of two (2) years. Data is securely deleted after the applicable retention period.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted through our systems
• Encrypted storage of all passwords and sensitive credentials
• Role-based access control limiting data access to authorised staff only
• Web Application Firewall (WAF) and DDoS protection
• Continuous login monitoring and security alerting
• Regular security audits and access reviews

8. Your Rights

Under the Nigerian Data Protection Act 2023, you have the following rights regarding your personal data:

• The right to access your personal data
• The right to correct inaccurate personal data
• The right to request deletion of your personal data
• The right to object to processing of your personal data
• The right to lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, please contact us using the details below.

9. Cookies

The Kenpetrus Energy Staff Portal is an internal staff system and does not use tracking cookies. Session tokens used for authentication are stored locally in the browser and are automatically cleared upon logout or expiry.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or applicable law. The date of the most recent update is shown at the top of this page. Continued use of our services following any update constitutes acceptance of the revised policy.