Privacy Policy

1. Introduction

E5 Energy Services Limited (“E5”, “we”, “our”) provides DIYA, a connected-worker safety and industrial monitoring platform comprising compatible wearable devices, mobile and tablet applications, web dashboards and associated infrastructure.

We are committed to protecting personal information and processing it lawfully, fairly, transparently and securely, in accordance with applicable data protection laws, including the Nigeria Data Protection Act 2023.

2. Our role in processing personal information

Where an organisation deploys DIYA to manage its workforce, that organisation generally determines the purposes and lawful basis for processing employee and contractor information and acts as the data controller. E5 ordinarily processes that information as a service provider or data processor on its documented instructions.

E5 may act as an independent controller for its own account administration, business communications, contractual records and security operations.

The respective responsibilities of E5 and its customers will be documented in applicable agreements.

3. Information we process

Depending on the features enabled, DIYA may process:

• Account and workforce information: Names, usernames, work contact details, employer or organisation, role, assigned device and account identifiers.
• Location information: GPS coordinates, location history, geofence events and associated timestamps.
• Safety and operational information: SOS events, helmet-removal alerts, gas readings, equipment status, incident records and other enabled sensor data.
• Audio and visual information: Voice messages, photographs, live video, video recordings and incident-related media.
• Technical information: Device identifiers, application identifiers, connectivity status, diagnostic logs, authentication records and security events.
• Notification information: Push notification tokens and information necessary to deliver operational alerts.

Certain information, including identifiable location histories and audio/video recordings, may be particularly sensitive in an employment context.

DIYA is not intended to collect personal information unrelated to its disclosed safety, operational and security purposes.

4. Purposes of processing

We process information to:

• Provide connected-worker safety monitoring and communications.
• Detect, report and manage configured safety events.
• Support incident investigation and emergency response.
• Enable authorised organisations to manage devices and users.
• Maintain system reliability, security and auditability.
• Provide technical support and fulfil contractual obligations.
• Meet applicable legal and regulatory requirements.

Personal information must not be used for unrelated employee surveillance, advertising, profiling or disciplinary purposes without an appropriate lawful basis, transparent notice and applicable safeguards.

5. Location, camera and microphone

DIYA may display worker locations and location history to authorised users for approved operational and safety purposes.

The tablet application’s microphone is used for enabled voice communication and recordings. Its camera may be used for enabled video communication.

Camera and microphone access is subject to applicable device permissions and should be used only for disclosed functions.

DIYA does not authorise unrestricted access to employees’ personal devices or covert monitoring.

6. Legal basis and workforce transparency

Personal information is processed on the lawful bases applicable to the relevant controller and processing purpose, which may include legitimate interests, contractual necessity, legal obligations, vital interests or consent where legally appropriate.

Employers deploying DIYA are responsible for providing appropriate worker privacy notices, assessing applicable lawful bases, consulting workers or representatives where required, and establishing proportionate monitoring policies.

Consent should not be treated as the default justification for workplace monitoring where the employment relationship makes freely given consent questionable.

7. Sharing and service providers

Information may be processed by authorised E5 personnel, the deploying customer and contracted technology service providers to the extent necessary to operate DIYA.

Depending on the deployed configuration, these may include cloud hosting, database, media, storage, mapping and push notification service providers, including Railway, DigitalOcean, Cloudflare, Google/Firebase and Expo.

We do not sell personal information or disclose worker data to third parties for their independent advertising purposes.

Access by developers, technical support personnel or other contractors must be subject to appropriate contractual, confidentiality and security restrictions.

8. International data transfers

DIYA’s infrastructure and technology providers may process information outside Nigeria or the country where a customer operates.

Where personal information is transferred internationally, E5 and the relevant controller will apply the transfer safeguards required by applicable law, including appropriate contractual protections and assessments where necessary.

Customer-specific data residency requirements will be addressed contractually.

9. Security

E5 applies and continuously improves technical and organisational safeguards appropriate to the nature of the information processed, including access controls, authentication, encrypted communications, monitoring, secure credential management and operational security procedures.

No electronic system can guarantee absolute security. Security incidents will be investigated and notified where required by law and applicable contractual obligations.

10. Data retention

DIYA retains personal information only for as long as necessary for the relevant purpose, subject to the customer’s documented instructions, applicable retention schedules, legal requirements and preservation obligations.

The standard platform configuration is intended to retain ordinary video recordings for approximately 72 hours, subject to technical verification.

Incident-related recordings, locked clips and other records may be retained longer where justified by an approved retention policy, an active investigation or legal obligations.

Retention periods for location history, gas telemetry, photographs, voice messages, user accounts and backups must be defined in the applicable retention schedule.

When the relevant retention period expires, information will be deleted, anonymised or securely disposed of in accordance with applicable requirements.

11. Individual rights and deletion requests

Individuals may have rights to access, correct, delete, restrict or object to processing of their personal information, as well as other rights provided by applicable law.

Where E5 processes workforce information on behalf of an employer, requests concerning that information will ordinarily be referred to or coordinated with the employer as data controller.

Requests relating to E5-controlled account information may be submitted directly to E5.

Deletion requests will be assessed in accordance with applicable law, contractual obligations, security requirements and legitimate retention obligations.

12. Children’s information

DIYA is intended for authorised organisational and professional use and is not directed at children.

13. Changes to this policy

We may update this policy to reflect changes in technology, operations, legal requirements or processing practices. The revised policy will show an updated effective date, and material changes will be communicated through appropriate channels.

14. Contact

E5 Energy Services Limited
Website: e5energyng.com
Privacy enquiries: info@e5energyng.com
Registered business address: 70, Kur Muhammad Way, CBD, Abuja

Individuals may also contact the relevant deploying organisation concerning its processing of workforce information.