Privacy Policy

1. Introduction

PETROAN ("we", "us", or "our") is committed to protecting the privacy and security of all personal information entrusted to us. This Privacy Policy applies to the PETROAN mobile application (the "App"), our website, and all associated services collectively referred to as the "Services".

By downloading, registering for, or using the PETROAN App, you agree to the collection and use of your information in accordance with this policy. If you do not agree, please do not use the App.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration data: Full name, PETROAN membership number, email address, phone number, and password.
• Identity verification: Date of birth, National Identification Number (NIN), Bank Verification Number (BVN) — collected solely for financial compliance and KYC purposes.
• Insurance data: Policy details, beneficiary information, worker enrollment records, and claim particulars including incident descriptions and supporting photographs.
• Payment information: Bank account details and wallet transaction records processed through our payment partner, ALATPay. We do not store full card numbers or PINs.
• Communications: Messages and support tickets you send to us.

2.2 Information Collected Automatically

• Device data: Device model, operating system version, unique device identifiers, and app version.
• Usage analytics: Pages viewed, features accessed, session duration, and in-app event logs.
• Location data: Approximate or precise GPS location when you use station-locator or emergency-report features — only with your explicit permission.
• Push notification tokens: Firebase Cloud Messaging tokens used to send relevant alerts to your device.
• Log data: IP addresses, access timestamps, and crash reports used for debugging and security.

3. How We Use Your Data

We process your personal data for the following purposes:

• To create and maintain your PETROAN membership account.
• To administer your insurance policies, process renewals, and handle claims.
• To facilitate premium payments and wallet transactions through ALATPay.
• To send you transactional notifications (claim updates, payment confirmations, policy alerts).
• To comply with Nigerian financial regulations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations.
• To improve the App's features and performance using aggregated, anonymised analytics.
• To safeguard against fraud, unauthorised access, and security threats.
• To respond to your support enquiries.

We process your data on the following legal bases: performance of a contract (providing the services you signed up for), legal obligation (regulatory compliance), legitimate interests (security and fraud prevention), and consent (location access, marketing communications).

4. Sharing Your Data

We do not sell your personal information. We may share your data with:

• NICON Insurance Ltd: As the underwriting insurer, NICON requires policyholder data to administer group life, motor, and property insurance, issue certificates, and process claims.
• ALATPay / Access Bank: Our integrated payment partner for processing premium payments, wallet funding, and claim payouts. Data shared is governed by ALATPay's own Privacy Policy.
• Technology service providers: Cloud hosting, analytics, and communications providers engaged under strict data processing agreements.
• Regulatory authorities: The National Insurance Commission (NAICOM), the Central Bank of Nigeria (CBN), and other competent authorities where required by law.
• Emergency services: Limited location and incident data shared during active emergency responses upon your request.

All third-party partners are contractually required to process your data only for the specified purpose and in accordance with applicable law.

5. Data Retention

We retain your personal data for as long as your account is active and for a minimum of seven (7) years thereafter, in compliance with Nigerian insurance and financial regulations. Specific data retention periods:

• Account and identity data: 7 years after account closure.
• Insurance policy and claims records: 7 years from the date of policy expiry or claim settlement.
• Transaction records: 7 years as required by the CBN and NAICOM.
• Device and analytics logs: 12 months.

You may request deletion of your account at any time. See our Account Deletion Policy for details. Certain data may be retained beyond your deletion request where required by law.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• TLS/HTTPS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• JSON Web Token (JWT)-based authentication with token refresh and expiry controls.
• Role-based access controls limiting staff access to data on a need-to-know basis.
• Regular security assessments and penetration testing.

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach affecting your rights, we will notify you and the relevant regulatory authority within 72 hours of becoming aware of the breach, as required by the Nigeria Data Protection Act 2023 (NDPA).

7. Your Rights

Under the Nigeria Data Protection Act 2023 (NDPA), you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data (subject to legal retention requirements). See our Account Deletion Policy.
• Right to restrict processing: Request that we limit the processing of your data in certain circumstances.
• Right to data portability: Receive a structured, machine-readable copy of the data you provided to us.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: Withdraw any consent you have given at any time (e.g., location access) without affecting prior processing.

To exercise any of these rights, contact us at privacy@petroan.ng. We will respond within 30 days.

8. Children's Privacy

The PETROAN App is intended for use by adults aged 18 and over. We do not knowingly collect personal data from persons under the age of 18. If you believe a child has provided us with personal data, please contact us immediately and we will delete the information.

9. Third-Party Services

The App integrates with the following third-party services, each governed by their own privacy policies:

• ALATPay (Access Bank) — payment processing and wallet services.
• Google Play / Apple App Store — app distribution and in-app events.
• Firebase (Google) — push notification delivery via Firebase Cloud Messaging.

We encourage you to review the privacy policies of these third-party services.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App and, where appropriate, sending you an in-app notification. Your continued use of the App after the effective date of the revised policy constitutes your acceptance of the changes.

11. Contact Us