Powergas Privacy Notice
Issued pursuant to the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).
| Document title | Powergas Privacy Notice |
|---|---|
| Version | 1.0 |
| Effective date | 24th of July 2026 |
1. Introduction
CE Power Solutions Limited, together with the companies within its group, including Power Gas Global Investments Nigeria Limited and Powergas Ebedei Limited (collectively, "CE Power Solutions", "the Group", "we", "us" and "our"), respects the privacy of every individual whose personal data it handles. This Privacy Notice explains what personal data we collect about you, why we collect it, the legal basis on which we rely, who we share it with, how long we keep it, and the rights available to you in respect of it.
This Notice is issued in accordance with the Nigeria Data Protection Act 2023 (the "NDPA"), the Nigeria Data Protection Act General Application and Implementation Directive 2025 (the "GAID"), which took effect on 19 September 2025 and superseded the Nigeria Data Protection Regulation 2019, and every other applicable data protection law and regulatory instrument in force in Nigeria from time to time.
We have written this Notice to be read and understood. If any part of it is unclear, or if you would like it explained to you in another language or format, please contact our Data Protection Officer using the details in paragraph 3.
1.1 Scope of this Notice
This Notice applies to personal data we collect:
- through your use of www.powergas.com and any of its sub-pages, forms and functionality (the "Website");
- when you contact us by any channel, including our contact form, email, telephone, social media or in person;
- when you subscribe to our newsletters, alerts or other marketing communications;
- when you deal with us as a customer, supplier, contractor, consultant, distributor, investor or other business counterparty, or as an employee, officer or representative of such a counterparty; and
- when you visit our offices, plants, stations or other facilities.
Separate privacy notices govern the processing of personal data relating to job applicants (see the Powergas Recruitment Privacy Notice) and to employees and other members of our workforce (see our internal employee data privacy notice). Our use of cookies and similar technologies on the Website is explained in the Powergas Cookie Notice, which forms part of this Notice.
2. Who we are
For the purposes of the NDPA, the data controller in respect of the personal data described in this Notice is:
| Data controller | Powergas Global Investment Nigeria Limited (RC 1088277) and Powergas Ebedei Limited (RC 1437848), together referred to in this Notice as "Powergas", "we", "us" and "our" |
|---|---|
| Registered / principal office | 21 Adeniyi Jones, Ikeja, Lagos State, Nigeria |
| Website | www.powergas.com |
| Nature of business | Production, compression, distribution and supply of compressed natural gas (CNG) and related energy solutions |
Powergas Global Investment Nigeria Limited and Powergas Ebedei Limited determine jointly the purposes and means of the processing described in this Notice and are accordingly joint data controllers in respect of it. Each of them is responsible for compliance with the NDPA in respect of that processing, and you may exercise your rights, and raise any complaint, against either of them.
Where personal data is shared with other companies within our group of companies, those companies process it either as data controllers in their own right or as our data processors, in each case as described in paragraph 8.
3. Our Data Protection Officer
We have designated a Data Protection Officer in accordance with section 32 of the NDPA and Article 6 of the GAID. The Data Protection Officer is responsible for overseeing our compliance with data protection law and is the first point of contact for you and for the Nigeria Data Protection Commission (the "Commission" or "NDPC") on all matters relating to the processing of your personal data.
| Data Protection Officer | The Data Protection Officer, Powergas |
|---|---|
| info@powergas.com | |
| Postal address | 21 Adeniyi Jones, Ikeja, Lagos State, Nigeria |
| Response commitment | We aim to acknowledge every communication within five (5) working days |
You may contact the Data Protection Officer to ask a question about this Notice, to exercise any of the rights described in paragraph 11, to withdraw a consent you have given, or to complain about the way we have handled your personal data.
4. The personal data we collect
"Personal data" means any information relating to an individual who can be identified, directly or indirectly, from that information. Depending on how you interact with us, we may collect the following categories of personal data about you.
4.1 Data you give us directly
| Category | Examples | Collected through |
|---|---|---|
| Identity data | Full name, title, salutation, job title, employer or organisation | Contact form, email, correspondence, business meetings, visitor registers |
| Contact data | Email address, telephone or mobile number, postal or business address | Contact form, subscription form, email, business cards |
| Enquiry and correspondence data | The content of your message to us, the nature of your enquiry, records of our correspondence and calls with you, notes of meetings | Contact form, email, telephone, meetings |
| Subscription and marketing data | Your email address, your marketing preferences, and your consent to or withdrawal of consent for receiving communications from us | Newsletter subscription form on the Website |
| Commercial relationship data | The details of the individuals who represent our customers, suppliers, contractors and other counterparties, including their role, contact details and, where relevant, signature and identification details | Contracts, onboarding and due diligence processes, purchase orders, delivery records |
| Site access data | Name, organisation, vehicle particulars, time of entry and exit, and identification presented at our premises | Visitor registers and access control at our offices, plants and stations |
4.2 Data collected automatically when you use the Website
When you visit the Website, we and our service providers may automatically collect certain technical information about your device and your visit. This includes your Internet Protocol (IP) address, browser type and version, operating system and platform, device type, time zone and language settings, the pages you viewed, the date and time of your visit, the length of your visit, the links you clicked, and the website from which you arrived at ours.
This information is collected through cookies, server logs and similar technologies. Where it is collected through cookies that are not strictly necessary for the operation of the Website, we collect it only where you have given your active consent through our cookie banner. Full details are set out in the Powergas Cookie Notice.
4.3 Data we obtain from other sources
We may receive personal data about you from sources other than you, including from your employer or the organisation you represent, from publicly accessible registers and sources such as the Corporate Affairs Commission register, from professional and business networking platforms, from our group companies, from referrals and introductions, and from third parties who provide business information, credit reference and sanctions or politically exposed person screening services in connection with our counterparty due diligence.
4.4 Sensitive personal data
"Sensitive personal data" is defined in section 65 of the NDPA and includes data relating to a person’s genetic or biometric data, race or ethnic origin, religious or similar beliefs, health status, sex life, political opinions or affiliations, trade union membership, and any other personal data prescribed by the Commission as sensitive.
We do not seek to collect sensitive personal data through the Website, and you should not submit sensitive personal data to us through the Website unless we have specifically asked for it. Where we do process sensitive personal data, we do so only in the circumstances permitted by section 30 of the NDPA, and we apply enhanced safeguards to it.
4.5 Children’s data
The Website is directed at businesses and adult users and is not intended for children. We do not knowingly collect personal data relating to a child or any other person lacking legal capacity through the Website. Where we become aware that we hold such data without the consent of a parent or guardian as required by section 31 of the NDPA, we will delete it promptly. If you believe that a child has provided personal data to us, please contact our Data Protection Officer.
5. Why we process your personal data, and our lawful basis
Section 25 of the NDPA requires us to have a lawful basis for every processing activity we carry out. The table below sets out, for each purpose for which we process personal data, the categories of data involved and the lawful basis on which we rely.
| Purpose | Data used | Lawful basis (section 25 NDPA) |
|---|---|---|
| To respond to your enquiry, request or correspondence, and to provide you with the information you have asked for | Identity data, contact data, enquiry and correspondence data | Consent, where you have voluntarily submitted your enquiry to us; and our legitimate interest in responding to enquiries about our business and services |
| To send you newsletters, alerts, invitations and other marketing communications about Powergas and its activities | Identity data, contact data, subscription and marketing data | Consent. You may withdraw your consent at any time, without affecting the lawfulness of anything we did before you withdrew it |
| To negotiate, enter into, perform and administer contracts with our customers, suppliers, contractors and other counterparties | Identity data, contact data, commercial relationship data | Performance of a contract to which you are party, or taking steps at your request prior to entering into a contract; and, where you act for a corporate counterparty, our legitimate interest in managing that relationship |
| To carry out counterparty due diligence, know-your-customer, sanctions, anti-bribery and credit checks | Identity data, contact data, commercial relationship data, data obtained from third party screening sources | Compliance with a legal obligation to which we are subject; and our legitimate interest in protecting our business from financial crime, fraud and regulatory exposure |
| To operate, secure, maintain and improve the Website, and to understand how it is used | Technical and usage data collected through cookies and server logs | Consent, in respect of all cookies other than strictly necessary cookies; and our legitimate interest in maintaining the security and availability of the Website, in respect of strictly necessary cookies and server logs |
| To manage access to and security at our offices, plants, stations and other facilities | Site access data | Our legitimate interest in the security of our people, assets and operations; and compliance with our legal and regulatory obligations relating to health, safety and site security |
| To comply with our legal, regulatory, tax and reporting obligations, including responding to lawful requests from regulators, courts and law enforcement | Any of the above categories, as applicable | Compliance with a legal obligation to which we are subject |
| To establish, exercise or defend legal claims, and to obtain legal, audit and other professional advice | Any of the above categories, as applicable | Our legitimate interest in protecting and enforcing our legal rights; and compliance with a legal obligation, where applicable |
| To respond to and manage requests, grievances and complaints made under data protection law, including a Standard Notice to Address Grievance | Identity data, contact data and the data to which the request relates | Compliance with a legal obligation to which we are subject |
| To protect the vital interests of any person, including in an emergency at any of our facilities | Identity data, contact data, site access data and, where strictly necessary, health information | Protection of the vital interests of the data subject or another person |
5.1 Where we rely on your consent
Where we rely on your consent, that consent is freely given, specific, informed and unambiguous, and is given by a clear affirmative action. We do not treat silence, inactivity or a pre-ticked box as consent. We do not make the provision of a service conditional on consent to processing that is not necessary for that service.
You may withdraw your consent at any time by contacting our Data Protection Officer, or, in the case of marketing communications, by using the unsubscribe link contained in every such communication. Withdrawing consent is as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before it was withdrawn.
5.2 Where we rely on legitimate interests
Where we rely on our legitimate interests, we have carried out an assessment balancing those interests against your interests, rights and freedoms, and we process your personal data only where our interests are not overridden by them. You have the right to object to processing carried out on this basis, as described in paragraph 11. You may ask our Data Protection Officer for further information about any such assessment.
5.3 Automated decision-making and profiling
We do not make decisions about you that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing, including profiling. If this position changes, we will update this Notice, notify you, and put in place the safeguards required by section 37 of the NDPA, including your right to obtain human intervention, to express your point of view and to contest the decision.
6. Providing your personal data to us
Where we collect personal data from you in order to perform a contract with you, or in order to comply with a legal obligation, the provision of that data is a necessary requirement, and if you do not provide it we may be unable to enter into or perform the contract or to meet the obligation in question. We will tell you at the point of collection where this is the case.
In all other cases, the provision of your personal data is voluntary, and there is no adverse consequence to you if you choose not to provide it, save that we may be unable to respond to your enquiry or to send you the communications you have asked for.
7. How we protect your personal data
In accordance with section 39 of the NDPA, we implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of data subjects. These measures include:
- encryption of personal data in transit and, where appropriate, at rest;
- access controls that restrict access to personal data to those personnel who need it to perform their duties, on a least-privilege basis;
- authentication controls, including strong password requirements and, where appropriate, multi-factor authentication;
- network security measures, including firewalls, endpoint protection and monitoring;
- physical security measures at our offices and facilities;
- regular backup of data and tested arrangements for restoring availability and access following an incident;
- contractual and technical controls over the third parties who process personal data on our behalf;
- training and awareness programmes for our personnel on data protection and information security; and
- periodic testing, assessment and evaluation of the effectiveness of these measures.
7.1 Personal data breaches
We maintain a documented data breach response procedure. Where a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Commission within seventy-two (72) hours of becoming aware of it, in accordance with section 40 of the NDPA. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, without undue delay, in clear and plain language, describing the nature of the breach, its likely consequences, the measures we have taken or propose to take, and the steps you may take to protect yourself.
8. Who we share your personal data with
We do not sell your personal data, and we do not disclose it to third parties for their own independent marketing purposes. We may share your personal data with the following categories of recipient:
| Recipient | Purpose and basis of sharing |
|---|---|
| Companies within the Powergas group | For internal administration, the coordinated management of customer, supplier and stakeholder relationships, shared corporate services, and group reporting and governance. Sharing within the group is subject to internal data sharing arrangements. |
| Information technology and hosting providers | To host, operate, maintain, support and secure the Website, our email systems, our business applications and our data storage. These providers act as our data processors. |
| Website developers and digital agencies | To develop, maintain and support the Website and its forms. These providers act as our data processors and may have access to submissions made through the Website in the course of that work. |
| Marketing and communications platform providers | To distribute newsletters and other communications you have asked to receive, and to manage subscription lists. These providers act as our data processors. |
| Professional advisers | Our legal advisers, auditors, accountants, insurers and consultants, where necessary for them to provide their services to us, subject to duties of confidentiality. |
| Regulators, courts and public authorities | Where we are required or permitted to disclose personal data by law, by an order of a court of competent jurisdiction, or by a lawful request from a regulator, including the Nigeria Data Protection Commission, the Nigerian Midstream and Downstream Petroleum Regulatory Authority, the Federal Inland Revenue Service and law enforcement agencies. |
| Counterparties to a corporate transaction | Where we sell, transfer, merge or reorganise any part of our business or assets, or acquire another business, we may disclose personal data to the counterparty and its advisers, subject to confidentiality undertakings and, where required, appropriate safeguards. |
| Banks and payment providers | Where necessary to process payments to or from you or the organisation you represent. |
8.1 Our data processors
Where a third party processes personal data on our behalf, it acts only on our documented instructions and is engaged under a written contract containing the provisions required by section 29 of the NDPA. Those provisions include obligations of confidentiality, obligations to implement appropriate security measures, restrictions on the engagement of sub-processors without our authorisation, obligations to assist us in responding to data subject requests and in dealing with personal data breaches, and obligations to delete or return personal data at the end of the engagement.
9. Transfers of personal data outside Nigeria
Some of the service providers described in paragraph 8, in particular our information technology, hosting and marketing platform providers, are located outside Nigeria or use infrastructure located outside Nigeria. Your personal data may therefore be transferred to, stored in, or accessed from a country other than Nigeria.
We transfer personal data outside Nigeria only where the conditions in sections 41 to 43 of the NDPA and the corresponding provisions of the GAID are satisfied. In practice, this means that we transfer personal data outside Nigeria only where one or more of the following applies:
- the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism that affords an adequate level of protection consistent with the NDPA;
- the Commission has determined that the destination country, sector, international organisation or specific recipient provides an adequate level of protection;
- you have been informed of the possible risks of the transfer in the absence of adequate protection and have given your explicit consent to it;
- the transfer is necessary for the performance of a contract to which you are party, or for the implementation of pre-contractual measures taken at your request;
- the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and another person;
- the transfer is necessary for reasons of public interest, or for the establishment, exercise or defence of legal claims; or
- the transfer is necessary to protect the vital interests of you or another person where you are physically or legally incapable of giving consent.
Before any transfer, we assess whether the recipient is able to provide the necessary protections, and we document that assessment. You may request further information about the safeguards applied to any specific transfer, and a copy of the relevant contractual arrangements, by contacting our Data Protection Officer.
10. How long we keep your personal data
We keep personal data only for as long as is necessary for the purpose for which it was collected, or for such longer period as is required by law or as is necessary for the establishment, exercise or defence of legal claims. When personal data is no longer needed, we delete it securely or irreversibly anonymise it.
The periods set out below are our standard retention periods. They are indicative and may be extended where a legal, regulatory, audit or litigation requirement applies.
| Category of data | Retention period | Rationale |
|---|---|---|
| Website enquiry and contact form submissions | Twenty-four (24) months from the date of the last communication with you | To enable us to deal with follow-up correspondence and to evidence how an enquiry was handled |
| Newsletter and marketing subscription data | Until you withdraw your consent or unsubscribe, and thereafter a suppression record only, kept indefinitely | To honour your withdrawal of consent and to ensure we do not contact you again in error |
| Contract and commercial relationship records | Six (6) years from the end of the contract or relationship | The limitation period for contractual claims in Lagos State, together with our tax and audit obligations |
| Counterparty due diligence and screening records | Six (6) years from the end of the relationship | Anti-money laundering, anti-bribery and regulatory record-keeping obligations |
| Accounting, tax and financial records | Six (6) years from the end of the relevant financial year, or such longer period as tax legislation requires | Companies and Allied Matters Act 2020 and applicable tax legislation |
| Website server logs and technical data | Twelve (12) months | Security monitoring, incident investigation and troubleshooting |
| Cookie data | As stated in the Powergas Cookie Notice for each cookie | The lifespan of each cookie is set by reference to its purpose |
| Visitor and site access records | Twelve (12) months | Site security and health and safety investigation |
| Records of data subject requests and grievances | Six (6) years from the date the request is closed | To demonstrate our accountability and compliance to the Commission |
| Personal data breach records | Six (6) years from the date of the breach | Section 40 NDPA accountability and record-keeping |
11. Your rights
The NDPA gives you the following rights in relation to your personal data. These rights are not absolute, and in some cases we may be entitled or required to refuse a request in whole or in part. Where we do so, we will explain why.
| Right | What it means |
|---|---|
| Right to be informed | To be told, in clear terms, who is processing your personal data, what data is being processed, for what purposes, on what lawful basis, with whom it is shared, for how long it is kept and where it is transferred. This Notice is intended to give you that information. |
| Right of access | To obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data together with the supporting information described above. |
| Right to rectification | To have inaccurate personal data about you corrected without undue delay, and to have incomplete data completed. |
| Right to erasure | To have your personal data deleted where it is no longer necessary for the purpose for which it was collected, where you withdraw the consent on which the processing was based and there is no other lawful basis, where you successfully object to the processing, or where the data has been unlawfully processed. |
| Right to restrict processing | To require us to suspend the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have contested or consider an objection you have raised. |
| Right to object | To object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time and without giving reasons to the processing of your personal data for direct marketing purposes. |
| Right to data portability | To receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible, where the processing is based on consent or on a contract and is carried out by automated means. |
| Right to withdraw consent | To withdraw, at any time, any consent you have given, without affecting the lawfulness of processing carried out before the withdrawal. |
| Rights in relation to automated decisions | Not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, and to obtain human intervention, express your point of view and contest such a decision. |
| Right to lodge a complaint | To complain to us and to the Nigeria Data Protection Commission, and to seek redress before the courts. |
11.1 How to exercise your rights
You may exercise any of these rights by contacting our Data Protection Officer using the details in paragraph 3. There is no fee for making a request. We may, however, charge a reasonable fee based on our administrative costs, or refuse to act, where a request is manifestly unfounded or excessive, in particular because it is repetitive.
We may need to ask you for information to confirm your identity before we act on a request. This is a security measure to ensure that personal data is not disclosed to a person who has no right to receive it. We will not use information provided for identity verification for any other purpose.
We will respond to your request without undue delay and in any event within one (1) month of receipt. Where a request is complex, or where you have made a number of requests, we may extend that period by up to a further two (2) months, in which case we will tell you within the first month and explain why the extension is necessary.
11.2 Standard Notice to Address Grievance
Article 47 of the GAID provides for a Standard Notice to Address Grievance ("SNAG"), which is a standard form of notice that a data subject may serve on a data controller or data processor where the data subject reasonably believes that his or her right to privacy has been violated. A SNAG may be served on us by email to info@powergas.com, by post or courier to the address in paragraph 3, or by delivery to that address.
We will investigate every SNAG we receive, communicate our decision to you, and report the outcome to the Commission through the platform designated by the Commission for that purpose. Serving a SNAG on us is not a precondition to complaining directly to the Commission or to commencing proceedings, and does not limit any other right or remedy available to you.
11.3 Complaints to the Commission and to the courts
If you are dissatisfied with the way we have handled your personal data or your request, you may lodge a complaint with the Nigeria Data Protection Commission. We would, however, be grateful for the opportunity to address your concerns first, and we encourage you to contact our Data Protection Officer before approaching the Commission.
| Regulator | Nigeria Data Protection Commission |
|---|---|
| Website | www.ndpc.gov.ng |
| info@ndpc.gov.ng | |
| Address | No. 5 Chad Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja, Federal Capital Territory, Nigeria |
You may also enforce your right to privacy directly before a Federal or State High Court under the Fundamental Rights (Enforcement Procedure) Rules and section 46 of the Constitution of the Federal Republic of Nigeria 1999 (as amended), and you may seek compensation for any damage suffered as a result of a contravention of the NDPA.
12. Third party websites and content
The Website contains links to, and embedded content from, third party websites and platforms, including video hosting and social media services. Where you follow such a link or interact with such content, the relevant third party may collect personal data about you in accordance with its own privacy notice. We do not control those third parties and we are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit.
13. Changes to this Notice
We keep this Notice under review and will update it whenever our processing activities change or the law requires. The current version is always available at www.powergas.com. Where we make a material change, we will bring it to your attention by a prominent notice on the Website and, where we hold your contact details and the change is significant, by direct communication to you.
This Notice was last reviewed on the effective date stated on the first page.
14. Contact us
Any question, request or concern about this Notice or about the way we handle personal data should be directed to:
The Data Protection Officer
Powergas
21 Adeniyi Jones, Ikeja, Lagos State, Nigeria
Email: info@powergas.com
Winning awards
Best Compressed Natural Gas Production Company of the Year
There was no awards from 2019 -2022 due to Covid
