Risk & ESG Intelligence

Privacy notice

What this service records about you and your organisation, why, and what you can ask us to do about it.

Who controls this data

The National Energy Investment & Intelligence Administration is the data controller for the ESG Clearance Portal. Processing is carried out under the Nigeria Data Protection Act 2023.

To be completed before launch

NEIIA must publish the name and address of its Data Protection Officer and the address for data subject requests here. This page states accurately what the software does; the contact details are the Administration's to give.

What is recorded

Your organisation. Legal name, RC number, sector, and a corporate contact email and telephone number, as entered at registration.
Your account. Name, work email address, and a one way hash of your password. The password itself is never stored and cannot be recovered by us.
Your application. The four benchmark metrics or your request for an on-site observation, the reporting period, the audit tier, and the amounts charged.
Your audit package. The document you upload, its size, and its SHA-256 digest, held in the platform document vault.
Payments. The reference, amount, rail and confirmation time. Card details are handled by the payment provider and never reach this service.
Correspondence. Messages you exchange with your evaluator, and the evaluator's remarks.
Actions. Every consequential act is appended to an audit log with the identifier of the person who performed it and the time.

What is not recorded

Audit log entries carry identifiers, states and hashes only. They do not carry names, email addresses or document contents. The log can prove what happened without republishing who said what about whom.

What becomes public

A clearance certificate is a public instrument. When one is issued or refused, a decision record is published naming your organisation, the decision and its basis. Anyone holding a certificate number can verify the holder, the tier and the dates. Your metrics, your audit package and your correspondence are not published.

How long it is kept

Applications, certificates and decision records are retained permanently, because they are the record of an administrative act and the platform corrects by adding a version rather than by deleting. Audit entries cannot be edited or removed by anyone, including us: the database refuses it.

Your rights

Under the Act you may ask for a copy of your data, ask that inaccurate data be corrected, and object to processing. Correction is handled by adding a corrected version with the reason recorded, so the earlier state remains visible. Erasure is limited where the record is an act of administration that the law requires us to keep.

Cookies

This service sets two cookies, both strictly necessary and neither used for tracking: a short-lived session token, and a longer-lived sign-in token that your browser cannot read. There is no analytics, advertising or third-party tracking on this service.