Introduction

PowerAfric (operating Voltify) is committed to protecting personal data processed through Voltify. This page summarises our approach under the Nigeria Data Protection Act (NDPA), the EU General Data Protection Regulation (GDPR) where applicable, and security practices aligned with ISO/IEC 27001.

For detailed categories of data and everyday processing activities, see our Privacy Policy. For cookies and similar technologies, see our Cookie Policy.

NDPC and Nigeria Data Protection Act

As a platform operating in and serving Nigeria, we process personal data in accordance with the Nigeria Data Protection Act 2023 and guidance from the Nigeria Data Protection Commission (NDPC).

• Lawful processing: we process data based on consent, contract performance, legal obligation, vital interests, or legitimate interests as permitted by the NDPA.
• Data subject rights: you may request access, rectification, erasure, restriction, objection, and data portability where applicable.
• Cross-border transfers: where data leaves Nigeria, we implement safeguards such as contractual clauses and risk assessments.
• Registration and accountability: we maintain records of processing activities and cooperate with the NDPC where required.

GDPR (EU and EEA users)

If you are located in the European Union or European Economic Area, the GDPR may apply to our processing of your personal data.

• Legal bases are documented in our Privacy Policy and include contract, legitimate interests, legal obligation, and consent.
• You have rights to access, rectification, erasure, restriction, portability, and objection, and to lodge a complaint with a supervisory authority.
• International transfers outside the EEA use appropriate safeguards where required.
• Data protection enquiries: [email protected].

ISO 27001 alignment

We design and operate Voltify using security controls aligned with ISO/IEC 27001 principles. This statement describes our approach; it does not represent a certification unless explicitly stated elsewhere.

• Access control: role-based access, authenticated sessions, and least-privilege principles for internal systems.
• Encryption: data in transit protected via HTTPS; sensitive credentials hashed using industry-standard algorithms.
• Operations security: logging, monitoring, and change management for production environments.
• Incident response: procedures to detect, contain, and notify relevant parties of personal data breaches as required by law.
• Vendor management: subprocessors assessed for security and data protection commitments.

Subprocessors

We use trusted infrastructure and service providers to host and operate Voltify. These subprocessors process personal data only on our instructions and under appropriate agreements. A list is available on request at

[email protected].

Breach notification

If a personal data breach is likely to result in risk to your rights and freedoms, we will notify affected individuals and relevant authorities within timeframes required by applicable law, including NDPA and GDPR where applicable.

Contact

For data protection requests or questions about this page, contact [email protected]. Please include “Data protection” in your subject line.