Privacy Policy
How Goletrik protects and manages your data under the NDPA 2023
Definitions
- •OpCo / Operator: 0 Emission Technologies Limited (RC 6929125) — the platform operator and data controller for most Platform data.
- •AssetCo: Goletrik Energy Assets Limited (RC 9897370) — the asset-owning SPV and joint data controller for data relating to CPSAs and IPAs.
- •Goletrik / We / Us: Collectively, OpCo and AssetCo, and either of them as the context requires.
- •Personal Data: Any information relating to an identified or identifiable natural person, as defined under the NDPA 2023.
- •Processing: Any operation performed on Personal Data, including collection, storage, use, disclosure, or erasure.
- •KYC: Know Your Customer — the identity verification process.
- •Platform: The Goletrik digital platform, including the website, web application, and mobile application.
- •NDPA: Nigeria Data Protection Act 2023.
- •NDPC: Nigeria Data Protection Commission.
- •Data Protection Contact: The person designated by Goletrik to handle data protection inquiries and requests.
- •Data Processor: A third party that processes personal data on behalf of Goletrik.
- •Consent: The user's free, specific, informed, and unambiguous affirmative agreement to the processing of their personal data.
Introduction
Goletrik ("we", "our", "us") is a digital Energy-as-a-Service platform operated through two entities: 0 Emission Technologies Limited (OpCo, the platform operator) and Goletrik Energy Assets Limited (AssetCo, the asset-owning SPV). This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our website, web application, or mobile application.
Both OpCo and AssetCo act as data controllers. OpCo is the primary data controller for platform-level data (account, KYC, usage). AssetCo is a joint data controller for data relating to Customer Power Service Agreements (CPSAs) and Investor Participation Agreements (IPAs).
By accessing or using Goletrik, you consent to the practices described in this Policy. This Policy is issued in compliance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulations 2024.
Data Protection Contact
Goletrik has designated a Data Protection Contact responsible for handling inquiries, requests, and complaints relating to personal data. You may contact our Data Protection Contact for any matter relating to your data protection rights under the NDPA 2023:
You may also contact the Nigeria Data Protection Commission (NDPC) if you have a complaint about how we have handled your personal data. We will respond to all data protection inquiries within thirty (30) days of receipt.
Information We Collect
a. Personal Information
- •Full name
- •Email address
- •Phone number
- •Date of birth
- •Gender
- •Business details (where applicable): business name, sector, address, CAC registration number, TIN
b. Identity & Verification Data (KYC)
- •Government-issued ID (NIN, Passport, Driver's License)
- •Business registration documents (CAC certificate, MEMART)
- •Proof of address (utility bills)
- •Biometric or verification data (selfie/liveness check, where required)
- •Bank Verification Number (BVN) where provided for enhanced verification
c. Usage & Technical Data
- •Login activity and session data
- •Energy consumption data (for Customers)
- •Token purchase and payment history
- •Device and browser data
- •IP address and approximate location
d. Financial Data
- •Bank account details (for withdrawals and payouts)
- •Payment method details (card last 4 digits, bank name)
- •Transaction history (deposits, withdrawals, earnings, token purchases)
- •Tax identification numbers (TIN) for withholding tax purposes
How We Use Your Information & Lawful Bases
We process your personal data only where we have a lawful basis under the NDPA 2023. The table below sets out each purpose, the lawful basis relied on, and the data categories involved:
Purposes and Lawful Bases
- •Creating and managing user accounts — Lawful basis: Contract performance (necessary to provide the service you requested)
- •Delivering energy services and monitoring usage — Lawful basis: Contract performance (CPSA)
- •Processing KYC and identity verification — Lawful basis: Legal obligation (NDPA, AML/CFT regulations) and contract performance
- •Processing payments, withdrawals, and payouts — Lawful basis: Contract performance
- •Facilitating asset ownership, bond issuance, and performance tracking — Lawful basis: Contract performance (IPA)
- •Meeting legal, regulatory, and tax compliance obligations (WHT, VAT, NDPA) — Lawful basis: Legal obligation
- •Communicating with you about your account, service, and platform updates — Lawful basis: Contract performance and legitimate interest
- •Improving platform functionality, security, and user experience — Lawful basis: Legitimate interest
- •Sending marketing or promotional communications (Affiliates only) — Lawful basis: Consent (you may opt out at any time)
- •Aggregated, anonymised analytics and reporting — Lawful basis: Legitimate interest (no personal data published)
We do not sell personal data to third parties. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
Data Sharing
We may share data with the following categories of third parties, only as necessary for the purposes described above:
- •Payment service providers (e.g. Paystack) — for payment processing and bank verification
- •Identity verification partners (e.g. NIMC via Dojah) — for NIN, BVN, and CAC verification
- •Insurance and maintenance partners — for asset insurance and field service delivery
- •Affiliated installers — limited to job-relevant data for commissioned installations
- •Cloud hosting and infrastructure providers (e.g. Supabase) — for data storage and application hosting
- •Regulators and tax authorities (e.g. FIRS, NDPC) — where legally required
- •Professional advisers (legal, audit, tax) — under confidentiality obligations
All third-party processors are required to maintain confidentiality and data protection standards consistent with the NDPA 2023. We do not transfer personal data to third parties for their own commercial purposes.
International Transfers of Personal Data
Your personal data is primarily stored and processed in Nigeria. However, some of our service providers are located outside Nigeria, which means your data may be transferred to and processed in other countries. Specifically:
- •Cloud hosting: Our primary database and application hosting provider (Supabase) stores data in the United States. This includes account data, KYC data, and usage data.
- •Payment processing: Paystack processes payment data and may transfer it to its infrastructure providers outside Nigeria.
- •Identity verification: Dojah may transfer verification queries to NIMC and other upstream data providers.
Where we transfer personal data outside Nigeria, we ensure that:
- •The transfer is necessary for the performance of a contract with you or to comply with a legal obligation
- •The recipient provides an appropriate level of data protection consistent with the NDPA 2023, through contractual safeguards, standard contractual clauses, or binding corporate rules where applicable
- •You are entitled to receive information about the safeguards applied to such transfers upon request to our Data Protection Contact
Data Storage & Security
- •Data is stored securely using industry-standard encryption in transit (TLS) and at rest
- •Access is role-restricted and based on the principle of least privilege
- •Sensitive actions (withdrawals, bank changes) require OTP or multi-factor authentication
- •We conduct periodic access reviews and security assessments
- •We maintain audit logs of access to and modifications of personal data
No method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.
Your Data Protection Rights
Under the NDPA 2023, you have the following rights regarding your personal data. To exercise any of these rights, contact our Data Protection Contact at goletrik@zetl.ng. We will respond within thirty (30) days of receiving your request.
Your Rights
- •Right of Access: You may request a copy of the personal data we hold about you and information about how we process it
- •Right to Rectification: You may request correction of inaccurate or incomplete personal data. We will rectify within thirty (30) days
- •Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations
- •Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances (e.g. while a rectification request is being reviewed)
- •Right to Object: You may object to processing based on legitimate interests or direct marketing. We will stop processing for these purposes unless we have compelling legitimate grounds
- •Right to Data Portability: You may request a machine-readable copy of the personal data you provided to us, to transfer to another service provider
- •Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal
If you are not satisfied with our response to a data protection request, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for meeting legal, regulatory, and tax compliance obligations. Retention periods by data category:
Retention Periods
- •Account and KYC data: Retained for the duration of the user relationship plus six (6) years after account closure (to meet AML/CFT and tax record requirements)
- •Transaction and payment records: Retained for six (6) years after the transaction date (tax and audit requirements)
- •CPSA and IPA contract data: Retained for the duration of the agreement plus six (6) years after termination
- •Energy consumption and usage data: Retained for the duration of the service relationship plus two (2) years
- •Support tickets and communications: Retained for three (3) years after resolution
- •Marketing communications data: Retained until you opt out, then deleted within thirty (30) days
- •Biometric data (selfie/liveness): Retained only for the verification session, then deleted. KYC documents (ID images) are retained per account/KYC retention above
After the retention period expires, data is securely deleted or anonymised so that it can no longer identify an individual.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, Goletrik shall:
- •Notify the Nigeria Data Protection Commission (NDPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with Section 39 of the NDPA 2023
- •Where the breach is likely to result in a high risk to data subjects, notify the affected data subjects without undue delay, describing the nature of the breach, the likely consequences, and the measures taken or proposed
- •Document all data breaches, including the facts, effects, and remedial action taken, and maintain this documentation to allow the NDPC to verify compliance
Children's Data
The Platform is intended for businesses and individuals aged eighteen (18) years and above. We do not knowingly collect personal data from children under the age of eighteen (18). If you believe that a child has provided us with personal data, please contact our Data Protection Contact immediately, and we will take steps to delete such data.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. For material changes (changes that affect the type of data collected, the purposes of processing, or your rights), we will:
- •Notify registered users via the Platform and/or by email at least thirty (30) days before the effective date of the change
- •Seek your fresh consent where the change involves a new purpose or a new lawful basis that requires consent
- •Publish the updated Policy with a new version number and effective date
For non-material changes (clarifications, formatting, administrative updates), continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
Contact Us
0 Emission Technologies Limited (OpCo)
Goletrik Energy Assets Limited (AssetCo)
Data Protection Contact: Emmanuel Okpala
Email: goletrik@zetl.ng
Version 2.0 — Last updated: September 29, 2026