Privacy policy

1. Controller

Ecopacq Nigeria Limited (“Ecopacq”, “we”, “us”) is the data controller for personal data collected through this website and in the course of quoting for, supplying, installing and maintaining systems.

2. Personal data

Data you provide

• Contact form: name, phone number and/or email address, and the message.
• On-site chat: questions you type in the floating chat are sent to our chat service so an assistant can reply from Ecopacq site information. We use them to answer you on the page. We do not use them to train public models for others.
• WhatsApp: if you choose Continue on WhatsApp, the message (including a short transcript when you hand off from the on-site chat) is transmitted by WhatsApp (Meta) under WhatsApp’s terms. We receive the WhatsApp name, number and message content, and use them only to reply.
• Project brief and solar calculator: name, phone number, email address, location, any note, the answers given (service, appliances, timing, payment preference) and any estimate the calculator produced.
• Customer records: site address, billing details, design and equipment, payment records, handover documents, warranty and maintenance records, and correspondence.
• Project records: survey findings, photographs and evidence, progress and delay records, quality checks, defects and the remedy, equipment serial numbers, and service requests.
• Customer portal: the sign-in email, the sign-in links we send, and requests made there (service, corrections, and changes to sharing).
• Finance applications: the application details, the amount requested, and the financing partner’s decision.

Data collected automatically

• Spam limits: a hashed IP address when a form is sent. The address itself is not stored for this purpose.
• Server logs: standard technical logs (IP address, browser type, pages requested) kept by our hosting providers to operate and secure the website.
• Browser storage: calculator progress and your cookie choice, stored on your device. Calculator progress is not sent to us until you submit an estimate, and is cleared when you do.
• Analytics and advertising: Google Analytics on every page. The Meta Pixel only if you accept it. See section 8.

We do not request sensitive personal data. Do not include it in a note or message.

3. Purposes and lawful basis

Consent may be withdrawn at any time (section 7). Withdrawal does not affect processing carried out before withdrawal.

4. Recipients

We do not sell personal data. We disclose it only to:

• providers that host this website, host our systems and files, deliver email, and protect the website;
• the installer assigned to the project, whether Ecopacq’s installation team or another approved installer, and only the name, contact details, site address and project information required for that project;
• a financing partner, only with your agreement. You choose the partner, the purpose (assessing a finance application or monitoring a financed project) and the fields, from: name, phone number, email address, state, installation address, system size, project progress, contract value and payment status. Each agreement has an end date. You may view and stop sharing in the customer portal under “Sharing my details”, or by contacting us. Access ends immediately. We keep a record of what was shared and when it stopped;
• equipment manufacturers and distributors, where required to register or claim a warranty;
• Google, for website analytics;
• Meta, only if you accept advertising cookies;
• the AI inference provider that powers on-site chat replies (message text only, to generate an answer), when that service is configured;
• WhatsApp (Meta), if you continue the chat on WhatsApp;
• professional advisers (lawyers, accountants, insurers), where necessary; and
• regulators, courts, law enforcement and other authorities where the law requires it, or to protect our rights, customers or staff.

Service providers and installers process data on our instructions and must keep it secure and confidential.

Installer measures. We score installers on records from their projects, including dates met and defects found and closed. Financing partners may see those measures. They do not see your personal data unless you have agreed. An installer may see the records used and may dispute them. A dispute is decided by a reviewer who was not involved in the record.

5. Transfers outside Nigeria

Some providers, including Google and Meta, may process personal data outside Nigeria. Where a transfer occurs, we rely on a ground permitted by the Nigeria Data Protection Act 2023, including adequate protection, appropriate contractual safeguards, or your consent.

6. Retention

• Enquiries that do not become orders: for as long as follow-up requires, then deleted or anonymised.
• Customer records: for the warranty and maintenance period and for as long as tax, accounting and contract law require.
• Consent and sharing records: for the life of the customer record.
• Hashed IP records: only for the period needed to apply the submission limit.
• Analytics: according to the analytics provider’s retention settings.

Data that is no longer required is deleted or anonymised.

7. Your rights

Under the Nigeria Data Protection Act 2023 you may:

• be informed of the processing (this policy);
• obtain a copy of your personal data;
• have inaccurate data corrected;
• have data erased where there is no lawful ground to keep it;
• restrict or object to processing, including direct marketing;
• receive your data in a commonly used format, or have it transmitted to another organisation where technically feasible;
• withdraw consent; and
• complain to the Nigeria Data Protection Commission.

A customer may request a correction under “My details” in the customer portal, and may stop sharing with a financing partner under “Sharing my details”. Other requests go to the email in the contact section. We may require proof of identity. We will respond within the period required by law.

8. Cookies

• Strictly necessary storage: calculator progress and the cookie choice. These do not require consent.
• Analytics (Google Analytics): page use and how visitors arrive. It runs on every page. Google receives the IP address and browser details. You may block it in the browser or with Google’s opt-out add-on.
• Advertising (Meta Pixel): measurement of adverts on Facebook and Instagram. Set only if you select “Accept”.

You may change the advertising choice at any time through “Cookie settings” at the bottom of every page, or by clearing browser storage. Rejecting cookies does not limit use of the website.

9. Security

We apply technical and organisational measures appropriate to the data, including HTTPS, restricted access to submissions, role-based access in the operations system, a tamper-evident log of record changes and of partner access, storage of submissions outside the public website, and limits on repeated submissions. No method of transmission or storage is completely secure. Contact us if you believe your data has been compromised.

10. Children

This website and our services are directed at adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data, contact us and we will delete it.

11. Changes

We may amend this policy when our services, providers or the law change. The date at the top of this page is the date of the current version. Where the law requires fresh consent, we will ask for it.