Privacy Policy

1. Introduction & Scope

Mind Colony Limited operates EnergiEase, an automated utility technology platform that enables consumers across Nigeria to purchase prepaid and postpaid electricity tokens via WhatsApp, web applications, and related digital interfaces (collectively, the “Services”).

We are committed to safeguarding the privacy and personal data of our users in compliance with the Nigeria Data Protection Act (NDPA) 2023, General Data Protection Regulation principles where applicable, and directives of the Nigeria Data Protection Commission (NDPC). This Privacy Policy describes how we collect, use, process, store, disclose, and protect your personal data when you interact with our WhatsApp bot (+234 913 993 2585), website (https://energiease.ng), or customer support channels.

2. Data Controller & Data Protection Officer (DPO)

Mind Colony Limited is the Data Controller responsible for deciding how and why your personal data is processed.

3. Personal Data We Collect

We practice strict Data Minimization under Section 24 of the NDPA 2023. We only collect information essential to verify your meter, fulfill electricity vending, generate receipts, and resolve payment exceptions:

• Identity & Contact Data: WhatsApp phone number (MSISDN), customer name registered with the relevant Electricity Distribution Company (DISCO), and email address when provided for receipt dispatch.
• Utility & Metering Data: Electricity Meter Number (11 or 13-digit identifier), DISCO code (AEDC, EKEDC, IKEDC, IBEDC, EEDC, PHED, KEDCO, JED, KAEDCO, BEDC, YEDC, APLE), service/installation address retrieved from DISCO national metering databases, and meter type (prepaid or postpaid).
• Transaction & Financial Metadata: Amount recharged (NGN), 20-digit generated electricity token, transaction reference codes, dedicated virtual account numbers, units vended (kWh), VAT, and tariff breakdown.
• Payment Card Notice: EnergiEase does NOT collect, store, or process debit card numbers, PINs, or CVVs. Card transactions are processed directly through CBN-licensed, PCI-DSS Level 1 compliant payment gateways (Paystack / Monnify).
• Technical Interaction Data: WhatsApp message timestamps, interaction state, IP address, and browser headers when accessing web receipt portals.

4. Legal Bases for Processing Under NDPA 2023

We process your personal data under the lawful bases defined in Section 25 of the NDPA 2023:

• Performance of a Contract: Processing is required to verify your meter, collect settlement, vend your 20-digit token, and deliver receipts.
• Legal Obligation: Compliance with Nigerian financial accounting, anti-money laundering (AML) laws, and directives of the Nigerian Electricity Regulatory Commission (NERC) and Central Bank of Nigeria (CBN).
• Legitimate Interests: Operating automated stuck-payment reconciliation engines, monitoring DISCO grid availability, and safeguarding against fraud.
• Consent: When you voluntarily opt in to receive transactional utility notifications, billing reminders, or operational updates.

5. Disclosure & Third-Party Data Sharing

We do not sell, rent, or trade your personal data. We disclose personal data solely to authorized third parties strictly bound by statutory confidentiality and data processing agreements:

• Electricity Distribution Companies & Aggregators: NERC-licensed DISCOs and authorized technical aggregators (e.g., BuyPower) to query meter validity and vend official electricity units.
• Payment Solution Service Providers (PSSPs): CBN-licensed payment gateways (Monnify / Paystack / commercial banking switches) to generate virtual accounts and verify incoming payments.
• Cloud Infrastructure & Communications: Secure cloud database instances and the Meta WhatsApp Cloud API for automated messaging delivery.
• Law Enforcement & Regulators: When compelled by a valid court order, subpoena, or mandatory directive issued by a competent Nigerian regulatory body (NDPC, CBN, NERC, EFCC, or NPF).

6. Data Security & Retention

All data in transit is protected using Transport Layer Security (TLS 1.3), and stored data is encrypted at rest using AES-256 bit encryption. Access is restricted to authorized engineers under multi-factor authentication (MFA).

Transaction and meter records are retained for a minimum statutory period of six (6) years to comply with Nigerian financial, tax, and anti-money laundering regulations. Temporary WhatsApp session interaction buffers are automatically purged upon transaction completion.

7. Your Rights as a Data Subject Under NDPA 2023

Under the Nigeria Data Protection Act 2023, you have the right to:

• Request access to the personal data we hold about you.
• Request rectification of inaccurate or outdated personal data.
• Request erasure of your data where retention is not legally mandated.
• Object to processing or restrict processing on legitimate grounds.
• Request data portability in a structured, machine-readable format.
• Lodge a formal grievance with the Nigeria Data Protection Commission (NDPC) (https://ndpc.gov.ng).

To exercise any of your statutory rights, email our Data Protection Officer at dpo@energiease.ng. Requests are resolved within thirty (30) days without administrative charge.

8. Minors

Our Services are intended strictly for persons aged eighteen (18) years or older. We do not knowingly collect personal data from minors under Nigerian law.

9. Policy Updates

We may periodically revise this Privacy Policy to reflect regulatory directives or technical evolutions. Any updates will be posted on this page with an updated Effective Date. Continued engagement with our WhatsApp bot or website signifies your agreement to the revised terms.