PRIVACY POLICY

1. Introduction and Scope

Cloud Energy Photoelectric Limited is a renewable energy and technology company incorporated and operating in Nigeria. We provide solar energy solutions, electric mobility services, and related technology products, including our ride-hailing services known as Cloud Ride (the "App").

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you:

• Visit our website at www.cloudenergy.com.ng or www.cloudride.com.ng
• Download and use the Cloud Ride mobile application
• Contact us for customer support or business inquiries
• Subscribe to our newsletters, promotions, or communications
• Enter into any contract or business relationship with us

This Policy applies to all users of our platforms, including individual customers, corporate clients, drivers, partners, and visitors, whether located in Nigeria or elsewhere. This Privacy Policy is designed to comply with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and reflects the principles of the EU General Data Protection Regulation (GDPR) where applicable to international users.

By accessing our website or using the Cloud Ride App, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. If you do not agree, please discontinue use of our platforms immediately.

2. Information We Collect

We collect different categories of information depending on how you interact with our platforms. Below is a clear breakdown of what we collect and why.

2.1 Personal Identification Data

• Full name
• Email address
• Phone number
• Date of birth (where applicable for age verification)
• Government-issued identification (e.g., NIN, driver's license, passport) for driver verification
• Profile photograph
• Billing and payment information (processed through secure third-party payment gateways)

2.2 Ride and Mobility Data

• Pick-up and drop-off locations
• Real-time GPS location during active trips
• Trip history, routes, and duration
• Fare information and transaction records
• Driver and vehicle information (for drivers registered on the platform)

2.3 Device and Technical Data

• IP address and device identifier
• Browser type, version, and operating system
• Mobile device type and unique device ID
• App version and usage logs
• Crash reports and performance diagnostics

2.4 Usage and Behavioral Data

• Pages visited and features used
• Search queries within the App
• Clickstream data and session duration
• Preferences and settings configured in your account

2.5 Communications Data

• Customer support messages, emails, and chat logs
• Feedback, ratings, and reviews submitted through the App
• Survey responses and user research participation

3. How We Collect Your Information

3.1 Directly from You

• Account registration and profile setup on the Cloud Ride App or website
• Booking a ride or requesting services
• Completing forms, surveys, or feedback requests
• Contacting our support team via email, phone, or in-app messaging
• Applying to become a Cloud Ride driver or partner

3.2 Automatically via Technology

• When you visit our website, cookies and web analytics tools collect behavioral and device data automatically
• The Cloud Ride App collects GPS and location data when the app is active and you have granted location permissions
• Server logs automatically record IP addresses, timestamps, and device metadata

3.3 From Third Parties and Partners

• Payment processors (e.g., Paystack, Flutterwave) may share transaction verification data
• Identity verification service providers may share verification outcomes
• Mapping and navigation service providers (e.g., Google Maps) may share location-related data
• Marketing and analytics partners may provide aggregated audience insights
• Social media platforms, if you log in via OAuth integrations (e.g., Google, Facebook)

We only receive data from third parties that are bound by equivalent data protection obligations. We do not purchase personal data from data brokers.

4. Purpose of Data Collection and Use

4.1 Service Delivery

• Processing ride bookings and matching riders with available drivers
• Calculating fares and processing payments
• Enabling real-time navigation and route optimization
• Managing driver onboarding and vehicle verification

4.2 Account Management

• Creating and maintaining your user account
• Authenticating your identity and preventing unauthorized access
• Processing account updates, password resets, and preferences

4.3 Safety and Security

• Monitoring for fraudulent, abusive, or illegal activity on the platform
• Verifying driver identities and vehicle credentials
• Responding to emergency situations or safety incidents during trips
• Enforcing our Terms of Service and community guidelines

4.4 Customer Support

• Responding to enquiries, complaints, and support requests
• Resolving disputes between riders and drivers
• Improving service quality based on feedback

4.5 Communications and Marketing

• Sending transactional notifications (booking confirmations, receipts, status updates)
• Sending promotional offers, discounts, and news about Cloud Energy and Cloud Ride (only with your consent)
• Personalising communications based on your usage history and preferences

4.6 Analytics and Product Improvement

• Analysing platform performance and user behaviour to improve our services
• Conducting research and internal reporting
• Developing new features and testing product improvements

4.7 Legal and Regulatory Compliance

• Complying with obligations under Nigerian law, including tax, anti-money laundering, and transport regulations
• Responding to valid legal requests from authorities
• Maintaining records as required by law

5. Legal Basis for Processing Personal Data

We do not process your personal data arbitrarily. Every processing activity is grounded in at least one lawful basis under the NDPA 2023 and, where applicable, the GDPR. Our legal bases are:

5.1 Contractual Necessity

• You book a ride and we process your location and payment data to fulfil the trip
• You register as a driver and we process your identification to onboard you

5.2 Consent

• Marketing communications (SMS, email, push notifications)
• Collection of location data in the background
• Cookies and tracking technologies beyond strictly necessary ones

You have the right to withdraw consent at any time without affecting the lawfulness of prior processing. See Section 10 (Your Rights) for details.

5.3 Legitimate Interests

• Fraud prevention and platform security
• Network and information security
• Improving and optimising our services through analytics
• Business development and strategic planning

5.4 Legal Obligation

• Tax records and financial reporting obligations
• Compliance with regulatory investigations or court orders
• Transport and ride-hailing regulatory requirements

5.5 Vital Interests

In rare emergencies, we may process data to protect the vital interests of a user or another person, for example, sharing location data with emergency services during a safety incident.

6. Data Sharing and Disclosure

We do not sell your personal data to any third party.

We share your information only in the circumstances described below, and only with parties that have appropriate data protection measures in place.

6.1 Within the Cloud Energy Group

Your data may be shared between Cloud Energy Photoelectric Limited and its affiliated entities for the purposes of delivering integrated services, internal reporting, and compliance.

6.2 Service Providers and Data Processors

• Payment processors (e.g., Paystack, Flutterwave) for fare processing and refunds
• Cloud infrastructure providers for data storage and hosting
• Identity verification platforms for driver and user KYC
• Mapping and navigation service providers for route planning
• Customer support and CRM platforms
• SMS and email communication service providers
• Analytics and crash reporting tools

All third-party processors are contractually bound to process data only on our instructions, maintain adequate security, and comply with applicable data protection laws.

6.3 Business Partners

With your consent, we may share data with selected business partners for co-branded services, loyalty programmes, or integrated clean energy mobility offerings. You will be notified and given the option to opt out before any such sharing occurs.

6.4 Legal Requirements

• Nigerian regulatory bodies (e.g., NITDA, FIRS, FRSC, CBN)
• Law enforcement agencies, courts, or government agencies with valid legal authority
• Compliance with anti-money laundering (AML) or counter-terrorism financing (CTF) obligations

6.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the relevant successor entity. We will notify you of any such transfer and your rights in connection with it.

6.6 Safety and Emergency Situations

We may share location or contact data with emergency services or other users where necessary to protect safety, prevent imminent harm, or respond to an emergency during a trip.

7. Data Storage, Security, and Retention

7.1 Where We Store Your Data

Your data is primarily stored on secure servers located in Nigeria. Where we use international cloud service providers, appropriate safeguards are in place to ensure equivalent data protection standards, as detailed in Section 11 (International Data Transfers).

7.2 Security Measures

• End-to-end encryption for sensitive data in transit (TLS/SSL protocols)
• Encryption of personal data at rest
• Multi-factor authentication for system access
• Role-based access controls, ensuring staff access only the data necessary for their role
• Regular security audits, penetration testing, and vulnerability assessments
• Incident response procedures for data breach detection and notification

While we take every reasonable precaution, no method of data transmission over the internet is 100% secure. We encourage you to keep your account credentials confidential and notify us immediately if you suspect any unauthorised access to your account.

7.3 Data Retention

• Active account data: Retained for the duration of your account and up to 3 years after account closure
• Transaction and ride history: Retained for 7 years to meet tax and financial regulatory requirements
• Driver identity and verification records: Retained for the duration of the driver relationship and 5 years thereafter
• Customer support communications: Retained for 2 years after the resolution of a matter
• Marketing consent records: Retained until consent is withdrawn, plus 1 year
• Anonymised analytics data: May be retained indefinitely as it cannot be linked to any individual

Upon expiry of the applicable retention period, data is securely deleted or anonymised in accordance with our data destruction procedures.

8. Location Data

• Precise location is collected only when the App is active and a trip is in progress, or when you are searching for available rides nearby
• Background location access (when the app is not in use) is only enabled if you have expressly granted that permission on your device
• Drivers' location data is collected during active duty hours to optimise matching and navigation

You can revoke location permissions at any time through your device settings; however, this will limit the functionality of the App. We do not use your location data to build persistent profiles for advertising purposes, nor do we sell location data to third parties.

9. Cookies and Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website. They help us recognize you, remember your preferences, and understand how you interact with our platform.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for the website to function. They enable core features such as login sessions, security, and navigation. You cannot opt out of these without affecting website functionality.
• Performance and Analytics Cookies: These collect anonymised information about how visitors use our website (e.g., pages visited, time spent) to help us improve performance. We use tools such as Google Analytics for this purpose.
• Functional Cookies: These remember your preferences (e.g., language settings, login details) to provide a more personalised experience.
• Marketing and Targeting Cookies: These track your online activity to help deliver more relevant advertising. They are only deployed with your explicit consent.

9.3 Managing Cookies

• Using the cookie consent banner on our website
• Adjusting your browser settings to block or delete cookies
• Using browser privacy extensions

Disabling certain cookies may affect the functionality of our website. Strictly necessary cookies cannot be disabled without impacting site operation.

9.4 Third-Party Tracking

Our website may include third-party tools (such as Google Analytics, Meta Pixel, or similar services) that set their own cookies. These third parties have their own privacy policies, which we encourage you to review.

10. Your Rights as a Data Subject

Under the NDPA 2023 and applicable data protection laws, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 14.

10.8 Right to Opt Out of Marketing

• Clicking the "unsubscribe" link in any email we send
• Adjusting notification preferences in your App settings
• Contacting us directly at privacy@cloudenergy.com.ng

10.9 Right to Lodge a Complaint

• The Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng
• Your local data protection supervisory authority, if you are located outside Nigeria

We encourage you to contact us first so we can address your concern directly before escalating to a regulatory body.

11. International Data Transfers

Cloud Energy operates primarily in Nigeria. However, given the nature of cloud-based services and our use of international technology providers, your personal data may be transferred to, or accessed from, servers and personnel located outside Nigeria.

• Transfers to countries with adequate data protection laws as recognised by the NDPC
• Standard Contractual Clauses (SCCs) or equivalent binding data transfer agreements with service providers
• Ensuring third-party processors outside Nigeria are bound by data processing agreements that meet NDPA 2023 requirements

For users in the European Economic Area (EEA), the United Kingdom, or other jurisdictions with specific data transfer requirements, we undertake appropriate transfer mechanisms to ensure your data is protected to at least the standard required in your jurisdiction. We only transfer your data internationally where it is necessary for service delivery or where you have explicitly consented.

12. Third-Party Links

Our website and the Cloud Ride App may contain links to third-party websites, social media platforms, or partner applications. These include, but are not limited to, payment gateways, mapping services, and social media sharing buttons.

We are not responsible for the privacy practices or content of these external platforms. Once you navigate away from our platforms, this Privacy Policy no longer applies. We strongly encourage you to review the privacy policy of any third-party site you visit. The presence of a link to a third-party website does not constitute endorsement by Cloud Energy of that website or its content.

13. Children's Privacy

Our platforms and services are not directed at, or intended for use by, individuals under the age of 18 years. We do not knowingly collect personal data from children.

If you are a parent or guardian and believe that your child has provided personal information to us without your consent, please contact us immediately at privacy@cloudenergy.com.ng. We will take prompt steps to delete such information from our records. In jurisdictions where the minimum age for digital consent differs from 18 years, we comply with the applicable local minimum age requirement.

14. Updates to This Privacy Policy

• Post the updated Policy on our website with a revised "Last Updated" date
• Notify registered users via email or in-app notification
• Where required by law, seek your renewed consent

Your continued use of our website or the Cloud Ride App after any update constitutes your acknowledgement of the revised Policy. We encourage you to review this Policy periodically. The current version of this Policy supersedes all previous versions.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our dedicated Data Protection team:

We aim to acknowledge all privacy related communications within 72 hours and resolve requests within 30 calendar days, in line with the NDPA 2023 and GDPR requirements.

This Privacy Policy was prepared in compliance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and global best practices including the EU General Data Protection Regulation (GDPR). Cloud Energy Photoelectric Limited is committed to being a responsible and transparent data controller.

© 2026 Cloud Energy Photoelectric Limited. All rights reserved.