PRIVACY NOTICE

1. Who we are

This notice explains how AlwaysON Limited ("AlwaysON", "we", "us") collects and uses your personal data when you join our waitlist or use our platform. AlwaysON is the data controller of the personal data described here. We are a company registered in Nigeria with RC number 8715617 and our address is No. 5 Kikuyu Close, Wuse 2, Abuja, Nigeria.

We handle your personal data in line with the Nigeria Data Protection Act 2023 (the "NDPA") and the directives issued by the Nigeria Data Protection Commission (the "NDPC").

2. The personal data we collect

When you join the waitlist, we collect the information you enter in the form:

• Contact details: your name, email address and phone number;
• Installation location: the address or location where you want solar and storage installed, including any location pin you provide;
• Customer type: whether you are a household or a business, the type of business (for example a hotel, clinic or pharmacy) and the name of your business if you give it;
• Energy information: the appliances or loads you use, your approximate monthly spending on electricity or generator fuel, and any other energy details you choose to give us;
• Signup details: when you joined, the source of your signup and any preferences you set, such as how you want us to contact you.

We also collect limited technical data when you use the website, such as your IP address, browser type, device type and the pages you visit. We use this to keep the service secure and working.

We do not ask you for bank account numbers, card details or government ID numbers on the waitlist. Please do not send them to us through the form.

3. Why we use your data and our legal basis

Where we rely on consent, you can withdraw it at any time, as explained in section 8. Withdrawing consent does not affect processing done before you withdrew it.

4. Who we share your data with

We do not sell your personal data. We share it only as follows:

• Service providers: Companies that host our platform, send emails or messages and provide analytics. They act on our instructions and are bound by written agreements that require them to protect your data.
• Platform Subscribers you choose: Installers, equipment manufacturers and banks, but only after you agree to it. Each of them becomes responsible for how they use the data once they receive it and will explain this in their own notices.
• Authorities and advisers: Courts, regulators, law enforcement or professional advisers where the law requires it or where we need to protect our legal rights.
• Business changes: A buyer or successor of our business, if AlwaysON is restructured or sold, on terms that protect your data.

5. Where your data is stored and transfers outside Nigeria

Your data is stored on Supabase servers located in London, United Kingdom. Where your data is processed outside Nigeria, we make sure the transfer meets the requirements of the NDPA, which means the destination must provide adequate protection or we must put appropriate safeguards in place, such as contractual terms approved for this purpose. You can ask us for details of the safeguards we use.

6. How long we keep your data

• We keep waitlist data for as long as you stay on the waitlist and for up to 12 months after the platform launches or after you ask to be removed, whichever is earlier, unless you become a customer.
• If you become a customer, we keep records for the period needed for the contract and for legal, tax and accounting duties, which is generally 6 years.
• Technical logs are kept for up to 12 months.

When the retention period ends, we delete your data or make it anonymous.

7. How we protect your data

We use access controls, encryption of data in transit and row level security, restricted staff access and regular reviews of our systems to protect your data. If a breach is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it and will tell you directly where there is a high risk to you.

8. Your rights

Under the NDPA you have the right to:

• be told how your data is used and to ask for a copy of the data we hold about you;
• have inaccurate or incomplete data corrected;
• ask us to delete your data, or to restrict how we use it, where the law allows;
• object to processing based on our legitimate interest, and to object to direct marketing at any time;
• receive your data in a structured, commonly used format and ask that we send it to another provider where that is possible;
• withdraw your consent at any time, including by using the unsubscribe link in our messages;
• not be subject to a decision based only on automated processing that significantly affects you. Our pricing estimates are indicative and are confirmed by a person before any offer is made.

To use any of these rights, contact us using the details in section 11. We will respond within [30] days and may ask you to confirm your identity first. You can also lodge a complaint with the Nigeria Data Protection Commission (www.ndpc.gov.ng) if you believe we have mishandled your data, although we ask that you contact us first so we can try to resolve it.

9. Marketing messages

We will send you waitlist and launch updates. We will send promotional messages only where you agreed to them, and every message will include a way to opt out.

10. Children

The platform is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, please contact us and we will delete it.

11. Contact us

12. Changes to this notice

We may update this notice when our services or the law change. We will post the new version with its date on this page and, where the change is significant, we will tell you by email before it takes effect.