Privacy Policy | The Grid Gas Network

1. Introduction

The Grid Gas Network Limited ("The Grid," "we," "us," or "our"), a company duly registered under the laws of the Federal Republic of Nigeria, is committed to protecting your privacy and ensuring the security of your personal data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.

This Privacy Policy explains how we collect, process, store, disclose, and safeguard your personal information when you access or use our platform, mobile applications, websites, and related services (collectively, the "Services").

By accessing or using The Grid Gas Network Services, you acknowledge that you have read, understood, and consent to the collection and processing of your personal data in accordance with this Policy. If you do not agree with any provision of this Privacy Policy, please discontinue use of our Services immediately.

2. Definitions

For the purposes of this Privacy Policy:

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under the NDPR and NDPA.
"Data Subject" means any person whose personal data is being collected, held, or processed by The Grid.
"Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or destruction.
"Data Controller" refers to The Grid Gas Network Limited, which determines the purposes and means of processing personal data.
"Third Party" means any natural or legal person, public authority, agency, or body other than the Data Subject, Data Controller, or persons authorized to process data under the Data Controller.

3. Legal Basis for Processing

In accordance with the NDPR and NDPA, we process your personal data on the following lawful bases:

Consent: Where you have given clear and unambiguous consent for us to process your personal data for specific purposes.
Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract.
Legal Obligation: Where processing is necessary for compliance with a legal obligation to which The Grid is subject under Nigerian law.
Legitimate Interests: Where processing is necessary for the purposes of legitimate interests pursued by The Grid, except where such interests are overridden by your fundamental rights and freedoms.
Vital Interests: Where processing is necessary to protect your vital interests or those of another natural person, particularly in emergency safety situations.

4. Information We Collect

4.1 Personal Information Provided by You

We collect personal information that you voluntarily provide when you:

Register for an account (as a tenant, facility manager, building operator, or vendor)
Complete your Know Your Customer (KYC) verification
Make a payment, top-up, or other financial transaction
Submit a support request, complaint, or enquiry
Request a building assessment or infrastructure installation
Apply for vendor registration and onboarding
Subscribe to our newsletters or marketing communications

Categories of personal information collected may include:

Full legal name, date of birth, gender, and nationality
Contact information including email address, telephone number, and residential/business address
Government-issued identification (National Identification Number (NIN), passport, driver's licence, or voter's card)
Bank Verification Number (BVN) for payment verification where applicable
Bank account details and payment card information (processed through PCI-DSS compliant payment processors)
Business registration documents, CAC certificates, and Tax Identification Number (TIN) for vendors
Building ownership or tenancy documentation
Photographs or biometric data where required for identity verification

4.2 Automatically Collected Information

When you access or use our Services, we automatically collect:

Device information including device type, operating system, unique device identifiers, and mobile network information
Log data including Internet Protocol (IP) address, browser type, access times, pages viewed, and referring URLs
Location data (with your consent) to facilitate service delivery and vendor dispatch
Transaction history and payment records
App usage patterns, preferences, and interaction data

4.3 Telemetry and Metering Data

Our smart infrastructure collects operational data including:

Real-time and historical gas consumption readings from smart meters
Tank level measurements and refill event logs
Valve status, pressure readings, and safety sensor data
System alerts, fault notifications, and maintenance records
Building-level aggregated consumption statistics

4.4 Information from Third Parties

We may receive information about you from:

Payment service providers regarding transaction status and verification
Identity verification services for KYC compliance
Facility managers or building administrators regarding tenancy status
Regulatory bodies as required by law

5. How We Use Your Information

We process your personal data for the following purposes:

5.1 Service Provision

To create, maintain, and manage your user account
To process prepaid gas top-ups, payments, and refunds
To monitor gas consumption and provide usage analytics
To facilitate vendor order dispatch, fulfillment, and settlement
To provide building management dashboards and reports
To deliver customer support and respond to enquiries

5.2 Safety and Operational Excellence

To monitor infrastructure for safety compliance and fault detection
To send emergency alerts and safety notifications
To maintain audit trails for regulatory compliance
To improve service reliability and operational efficiency

5.3 Legal and Regulatory Compliance

To verify identity and conduct KYC/AML checks as required by Nigerian law
To comply with tax obligations and financial reporting requirements
To respond to lawful requests from regulatory authorities
To enforce our Terms of Service and protect our legal rights

5.4 Communications and Marketing

To send transactional notifications regarding your account and services
To provide service updates, security alerts, and important announcements
To send promotional communications where you have provided consent

5.5 Analytics and Service Improvement

To analyze usage patterns and optimize platform performance
To conduct research and development for new features
To generate anonymized, aggregated statistical reports

6. Information Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share your information only in the following circumstances:

6.1 Within The Grid Gas Network Ecosystem

Information is shared between parties as necessary for service delivery:

Facility managers receive tenant information and consumption data for buildings under their management
Vendors receive order details necessary to fulfill refill requests (delivery address, order quantity, timing)
Building operators receive aggregated consumption and operational reports

6.2 Service Providers and Processors

We engage trusted third-party service providers who process data on our behalf, including:

Payment processors (Paystack, Flutterwave, or similar licensed payment service providers)
Cloud infrastructure providers for secure data hosting
Communication service providers for SMS and email delivery
Analytics providers for platform performance monitoring
Customer support tools and ticketing systems

All service providers are contractually bound to protect your data in accordance with the NDPR and maintain appropriate security measures.

6.3 Legal and Regulatory Disclosure

We may disclose your personal data where required by law or in response to:

Valid court orders, subpoenas, or legal processes under Nigerian law
Requests from the Nigeria Data Protection Commission (NDPC) or its authorized agents
Lawful requests from law enforcement agencies (Nigeria Police Force, EFCC, ICPC)
Regulatory bodies such as the Department of Petroleum Resources (DPR) or the Standards Organisation of Nigeria (SON)
Tax authorities (Federal Inland Revenue Service) as required for compliance

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will provide notice before your personal data becomes subject to a different privacy policy.

6.5 With Your Consent

We may share your information for other purposes with your explicit consent.

7. Data Security

We implement robust technical, administrative, and physical security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

7.1 Technical Measures

Encryption of data in transit using TLS/SSL protocols and at rest using AES-256 encryption
Secure, access-controlled data centers with redundancy and disaster recovery capabilities
Regular security assessments, penetration testing, and vulnerability scanning
Intrusion detection and prevention systems
Secure coding practices and regular code reviews

7.2 Organizational Measures

Role-based access controls limiting data access to authorized personnel on a need-to-know basis
Employee background checks and confidentiality agreements
Regular data protection training for all staff
Documented security policies, procedures, and incident response plans

7.3 Payment Security

All payment processing is handled by PCI-DSS compliant payment service providers
We do not store full payment card details on our systems
Tokenization is used for recurring payment functionality

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security against all threats.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

Active Accounts: Personal data is retained for the duration of your active account relationship with us.
Transaction Records: Financial transaction records are retained for a minimum of six (6) years as required by Nigerian tax and financial regulations.
Consumption Data: Metering and consumption data is retained for the period necessary for billing, dispute resolution, and operational analysis.
Legal Compliance: Data may be retained longer where required by law, regulation, or for the establishment, exercise, or defense of legal claims.
Anonymized Data: We may retain anonymized, aggregated data indefinitely for research and analytical purposes.

Upon account closure or at your request, we will delete or anonymize your personal data within a reasonable timeframe, except where retention is required by law.

9. Your Rights Under Nigerian Law

In accordance with the NDPR and NDPA, you have the following rights regarding your personal data:

Right of Access: You have the right to request confirmation of whether we process your personal data and to obtain a copy of such data.
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure: You have the right to request deletion of your personal data, subject to legal retention requirements and legitimate business needs.
Right to Restrict Processing: You have the right to request limitation of processing in certain circumstances.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw such consent at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, please submit a written request to our Data Protection Officer at dpo@gridgas.network. We will respond to your request within thirty (30) days, or such extended period as permitted by law where the request is complex.

10. International Data Transfers

Your personal data is primarily stored and processed within Nigeria. Where we transfer personal data to countries outside Nigeria (for example, to cloud service providers with international infrastructure), we ensure that:

The receiving country provides an adequate level of data protection, or
Appropriate safeguards are in place, such as Standard Contractual Clauses approved by the NDPC, or
Your explicit consent has been obtained for the specific transfer

All international transfers are conducted in compliance with the NDPR and NDPA requirements for cross-border data transfer.

11. Cookies and Tracking Technologies

Our website and applications may use cookies and similar tracking technologies to enhance your experience. These include:

Essential Cookies: Necessary for the operation of our Services, including session management and security.
Analytical Cookies: Help us understand how users interact with our platform to improve functionality.
Preference Cookies: Remember your settings and preferences for a personalized experience.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

12. Children's Privacy

The Grid Gas Network Services are not directed at, and we do not knowingly collect personal data from, individuals under the age of eighteen (18) years. Account registration requires users to confirm they are at least 18 years of age.

If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact our Data Protection Officer immediately.

13. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes:

We will update the "Last updated" date at the top of this Policy
We will provide prominent notice through our platform or via email
For significant changes affecting your rights, we may seek your renewed consent

Your continued use of our Services after the effective date of any changes constitutes acceptance of the revised Privacy Policy.

14. Data Protection Officer

In accordance with the NDPR, we have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance. You may contact our DPO for any privacy-related enquiries or to exercise your data subject rights.

15. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our data processing practices, please contact us:

Data Protection Officer: dpo@gridgas.network
General Privacy Enquiries: privacy@gridgas.network
Postal Address: The Grid Gas Network Limited, Lagos, Nigeria
Telephone: +234 705 466 7373

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng if you are not satisfied with our response to your concerns.

Privacy Policy Content