Privacy Policy

BrightPath Energy Ltd. is the data controller responsible for your personal data.

RC Number

RC 8234439

General enquiries

info@brightpathenergy.co

Privacy enquiries

datapl@brightpathenergy.co

Information you give us

• Waitlist and newsletter sign-ups: your full name and email address.
• Enquiries: your name, email address, phone number, and anything you include in messages to us through our contact form, email, or social media.
• Customer account and onboarding: your name, phone number, email address, installation address, property type (home or business), account login credentials, and any identity or eligibility information we request during sign-up.
• Payments and top-ups: transaction amounts, dates, top-up history, auto top-up settings, and payment references. Card and bank details are processed by our payment partners; we do not store full card numbers.
• Support and service requests: details of issues you report, site visit notes, and communications with our team.

Information collected automatically

• Smart meter and system data: energy consumption (kWh) over time, credit balance, system performance and fault data, battery and inverter status, and on/off or remote control commands.
• App and website usage: device type, operating system, browser type, IP address, approximate location derived from your IP address, pages viewed, and actions taken in the app.
• Cookies and similar technologies: see Section 8.

Information from third parties

• Payment confirmations from our payment processors.
• Information from partners, installers, or referrers who introduce you to us, where you have agreed to this.

Where we rely on legitimate interests, we have considered your rights and interests and are satisfied they are not overridden. You can ask us for more information about this assessment.

We do not sell your personal data. We share it only as follows:

• Service providers who act on our instructions, including cloud hosting, payment processing, SMS and email delivery, customer support tools, analytics, and meter and IoT platform providers.
• Installation and maintenance partners who need your address and contact details to carry out work at your property.
• Regulators, law enforcement, and courts where required by law or to protect our rights, property, or safety, or those of our customers.
• Professional advisers such as lawyers, auditors, and insurers, under duties of confidentiality.
• A buyer or successor in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.

We require all third parties who process personal data on our behalf to protect it and use it only for the purposes we specify.

Some of our service providers may store or process data outside Nigeria. Where this happens, we transfer personal data only where the NDPA permits it, such as where the recipient country has an adequate level of protection, where appropriate safeguards such as contractual clauses are in place, or where another lawful basis for transfer applies.

We keep personal data only for as long as necessary for the purposes described above:

• Waitlist and newsletter data: until you unsubscribe or ask us to delete it, or 2 years after the waitlist closes.
• Customer account data: for the duration of your service agreement and 7 years afterwards.
• Payment and transaction records: for at least 7 years, as required by tax and financial record-keeping laws.
• Smart meter data: for the duration of your service and up to 10 years afterwards, after which it is deleted or anonymised.
• Enquiries and support records: 2 years from our last interaction.

We may keep aggregated or anonymised data that no longer identifies you for longer.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls limited to staff who need access, secure authentication for app accounts, and regular review of our security practices. No system is completely secure, so please keep your login details confidential and tell us immediately if you suspect unauthorized access to your account.

If a personal data breach occurs that is likely to put your rights at risk, we will notify the NDPC as required by law and inform you where required.

Our website and app use cookies and similar technologies to keep you logged in, remember your preferences, keep our Services secure, and understand how our Services are used.

You can control cookies through your browser settings. Blocking essential cookies may affect how the Services work. Where required, we will ask for your consent before setting non-essential cookies.

Under the NDPA, you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted in certain circumstances;
• restrict or object to certain processing, including direct marketing;
• receive your data in a commonly used, machine-readable format and have it transferred to another controller;
• withdraw consent at any time, without affecting processing already carried out;
• not be subject to decisions based solely on automated processing that significantly affect you; and
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, contact us at datapl@brightpathenergy.co. We may need to verify your identity before acting on a request. We will respond within the time required by law.

Some data, such as billing records, may need to be kept to meet legal obligations even if you ask us to delete it. Deleting certain data may also mean we can no longer provide your service.

You can unsubscribe from marketing emails at any time using the link in any email. Service alerts related to your energy account are part of the service and are not marketing.

Our Services are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Our website contains links to third-party sites, including our social media pages on X and Instagram. Those sites have their own privacy practices, and we are not responsible for them.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date, and where changes are significant we will notify you by email or through the app.

If you have questions about this policy or how we handle your personal data, contact:

BrightPath Energy Ltd.

Privacy enquiries

datapl@brightpathenergy.co

General enquiries

info@brightpathenergy.co

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).