Mainpower Disco Data Protection Policy

1.0 Introduction

Mainpower Electricity Distribution Company Limited (Mainpower Disco) is an electricity distribution company licensed by the Nigerian Electricity Regulatory Commission (NERC) to distribute electricity across its designated service areas.

Mainpower Disco collects a significant amount of information about our customers, vendors, and employees (data subjects). Some of this information is processed, stored electronically, and/or transmitted across networks to other systems. We recognize that personal data used for business activities must be secured, and it is our responsibility to ensure its confidentiality to maintain trust. Employees or third parties may have access to, handle, or process personal data concerning colleagues, customers, and vendors. It is essential that Mainpower Disco protects personal data and ensures compliance with the Nigeria Data Protection Regulation 2019 (NDPR). Breach of data security could result in business losses, lawsuits, and financial harm.

2.0 Definitions

• Mainpower Disco – Mainpower Electricity Distribution Company Limited
• NDPR – Nigeria Data Protection Regulation 2019
• Personal Data – Any data relating to an identified or identifiable natural person (data subject), such as name, address, photo, email address, or bank details.
• Data Subject – Any individual who can be identified, directly or indirectly.
• Data Subject Access Request – The formal process for individuals to request a copy of their personal data.
• DPO – Data Protection Officer
• Processing – Any operation performed on personal data, such as collection, storage, or transmission.
• Personal Data Breach – Any security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data.
• Responsible Person – The person responsible for managing data within a department or the company.

3.0 General Provisions

• This policy applies to all personal data collected, stored, transmitted, and processed by Mainpower Disco.
• Our partners and vendors who process personal data on our behalf are required to adhere to this policy’s principles.
• Where applicable, Mainpower Disco will register with relevant authorities as an organization that processes personal data.
• Personal data will not be shared without proper authorization.
• Personal data will always be captured with the consent of the data subject, and such data will be encrypted when stored or transmitted electronically.
• Personal data will be processed in a secure environment by authorized personnel.

4.0 Policy Principles

Mainpower Disco is committed to processing data in accordance with its obligations under the Nigerian Data Protection Regulation (NDPR) and global data protection standards. This policy outlines Mainpower Disco’s commitment to ensuring that data storage and handling are carried out transparently and fairly, with respect for the rights of data subjects.

In line with the NDPR, Mainpower Disco follows these principles in the collection and processing of personal data:

• Personal data is processed based on the consent of the data subject, contractual obligations, legal requirements, vital interests, public interest, or legitimate business interests. Consent is obtained in a fair and lawful manner, free from fraud or coercion.
• Mainpower Disco collects personal data for specific, clear, and legitimate purposes, and these purposes are communicated to the data subjects.
• We only process adequate data necessary for the intended purposes.
• Mainpower Disco ensures that personal data is accurate and up to date. Inaccurate data will be rectified or erased promptly.
• Personal data will be retained only for the necessary period and for the specific purpose for which it was collected. Data may be stored longer for archiving, scientific, or historical purposes, subject to adequate security measures.
• When stored on paper, data will be secured and printouts will be securely shredded when no longer needed.
• When stored electronically, data will be protected from unauthorized access, accidental deletion, and malicious hacking.

4.1 Individual Rights

Data subjects have the right to object to the use of their personal data for non-essential purposes. 

Data subjects may also request access to, amend, obtain a copy of, or delete personal data that is processed on their behalf, subject to applicable terms and conditions. 

5.0 Lawful, Fair, and Transparent Processing

All data processed by Mainpower Disco must have a lawful basis, including consent, contract, legal obligations, vital interests, public interest, or legitimate interests.

• Mainpower Disco will maintain a Register of Systems to ensure lawful, fair, and transparent data processing, and this register will be reviewed annually.
• Data subjects have the right to access their personal data, and any requests will be addressed in a timely manner.
• Where consent is the lawful basis for processing data, opt-in consent will be recorded, and systems will be in place to reflect any revocations of consent.

6.0 Monitoring

Mainpower Disco will monitor how personal data is collected, stored, processed, and transmitted in compliance with applicable regulations. In the event of a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data, Mainpower Disco will promptly assess the risk to individuals’ rights and freedoms and, if necessary, report the breach to relevant supervisory authorities within 72 hours.

7.0 Confidentiality

Mainpower Disco is committed to treating all personal data as strictly confidential, regardless of its form. The company will only use such information for the purposes for which it was provided and will ensure that its employees and subcontractors comply with this confidentiality obligation. However, Mainpower Disco may disclose confidential information if required by a court order or a relevant government authority. All employees, contractors, and third-party agents working with Mainpower Disco will be required to uphold this confidentiality commitment.