How We Protect Your Data.

Phoenix Renewable Group ("Phoenix", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our services, or interact with us in any way. This policy is issued in compliance with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act 2023, and applicable international best practices. By using our website or services, you consent to the practices described in this Policy.

Phoenix Renewable Group is an integrated clean energy and e-mobility conglomerate headquartered in Abuja, Nigeria, operating across six northern states. We are the Data Controller responsible for your personal data. Data Controller: Phoenix Renewable Group Email: legal@phoenixrenewgrp.com Website: https://phoenixrenewgrp.com For all data protection inquiries, contact our Data Protection Officer (DPO) at: compliance@phoenixrenewgrp.com

We may collect and process the following categories of personal data: Identity & Contact Data: Full name, email address, phone number, postal address, national identification number (where required). Business Data: Company name, job title, industry sector, project enquiry details. Technical Data: IP address, browser type, device identifiers, pages visited, time spent on site, referral source (collected automatically via cookies and analytics tools). Communications Data: Messages, enquiries, and feedback you send us via forms, email, or phone. Employment Data (for job applicants and staff): CV/résumé, employment history, qualifications, references. We do not knowingly collect personal data from children under 13.

We process your personal data only where we have a lawful basis to do so. Our uses include: • Responding to your enquiries and providing requested services or quotations. • Administering contracts and project engagements. • Sending relevant updates, news, or marketing communications (where you have opted in). • Improving our website and services through analytics. • Complying with our legal and regulatory obligations under Nigerian law. • Maintaining internal records and auditing. • Processing job applications and managing employment relationships. We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

We rely on the following lawful bases under the NDPR and NDPA 2023: Contract: Processing necessary to fulfil a contract with you or to take steps at your request prior to entering into a contract. Legitimate Interests: Where processing is necessary for our legitimate business interests and these are not overridden by your rights. Legal Obligation: Where processing is necessary to comply with applicable Nigerian law or regulatory requirements. Consent: Where you have given us clear, informed, and specific consent to process your data for a stated purpose. You may withdraw consent at any time.

We may share your personal data with trusted third parties solely to enable us to deliver our services: • Technology providers (cloud hosting, email platforms, analytics) bound by data processing agreements. • Government or regulatory authorities where required by Nigerian law (e.g., FIRS, CAC, NAFDAC, NEMSA). • Professional advisors (lawyers, auditors) under strict confidentiality obligations. • Partner organisations involved in joint projects, only with your prior knowledge. All third parties are required to respect your data and process it only on our documented instructions.

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. General enquiries and contact records: 3 years from last contact. Contract and project data: Duration of the contract plus 7 years (as required by Nigerian financial and tax law). Marketing opt-ins: Until you withdraw consent. Employment records: Duration of employment plus 7 years post-termination. When personal data is no longer required, we securely delete or anonymise it.

Under the NDPR and NDPA 2023, you have the following rights regarding your personal data: Right of Access: Request a copy of the personal data we hold about you. Right to Rectification: Request correction of inaccurate or incomplete data. Right to Erasure: Request deletion of your data where there is no legitimate reason to retain it. Right to Restrict Processing: Ask us to suspend processing in certain circumstances. Right to Object: Object to processing based on legitimate interests or for direct marketing. Right to Data Portability: Request transfer of your data to you or a third party. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise any of these rights, contact: compliance@phoenixrenewgrp.com. We will respond within 30 days.

We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include: • AES-256 encryption for data at rest. • TLS 1.3 encryption for all data in transit. • Role-based access controls limiting data access to authorised personnel only. • Regular security assessments and staff data protection training. • Audit trails and login activity monitoring. In the event of a data breach, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware, and affected individuals where required.

Our website uses cookies to improve your browsing experience and to understand how visitors use the site. Types of cookies we use: Essential Cookies: Required for the website to function. Cannot be disabled. Analytics Cookies: Help us understand how visitors interact with the site (e.g., Google Analytics). Anonymised data only. Preference Cookies: Remember your choices and settings. You can control cookies through your browser settings. Disabling certain cookies may affect website functionality. Our cookie banner allows you to adjust your preferences when you first visit the site.

Our website may contain links to third-party websites. This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of other sites and recommend you read their policies when visiting.

We review this Privacy Policy periodically and may update it to reflect changes in our practices or legal requirements. Material changes will be announced on our website with an updated effective date. Continued use of our services after updates constitutes acceptance.

If you have questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your data: Data Protection Officer (DPO): Phoenix Renewable Group Email: compliance@phoenixrenewgrp.com If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.