1. Airtel will process personal data based on one of the following grounds:
   1. performing a contract or to enter a contract with the data subject, for example, we process the numbers customers dial, how much data they use and when they do it so we can provide them with a connection and issue a bill;
   2. Airtel’s legitimate business interests, if these do not override the data subject’s rights and freedoms. For example, fraud prevention, security of our network and services, marketing, analyzing and improving our services; or
   3. complying with a mandatory legal obligation, for example, accounting, tax, money laundering, anti-bribery requirements
2. Airtel will collect personal data relating to:
   1. employees and applicants for employment, including an employee’s job application, records of training, documentation of performance appraisals, salary increases, expense claims and other employment records (Employee Personal Data)
   2. consumers (i.e. members of the public to whom we do not directly sell our products and services but who use, will use or are considering using a service which Airtel ultimately provides) and customer contacts (Customer Personal Data)
   3. users of our websites or other related services provided by Airtel (User Personal Data)
   4. supplier contacts, industry professionals and other individuals who provide goods and/or services to the Airtel (Supplier Personal Data).
3. Airtel holds and processes Employee Personal Data for the following purposes:
   1. administering and managing its employees;
   2. administering employee benefits and entitlements;
   3. protecting the legitimate interests of the Airtel, including investigating acts or defaults; and
   4. compliance with applicable laws, regulations and rules.
4. Airtel holds and processes Customer Personal Data for the following purposes:
   1. administering and managing our relationships with its consumers and customers, which may include:
      1. dealing with enquiries, processing orders and providing the customer with products and services (including facilitating delivery);
      2. taking the appropriate measures to invoice and take the appropriate payment or credit from the customer; and
      3. providing updated information, such as changes to terms and conditions;
   2. marketing and promoting its products and services and inviting customers to participate in market research;
   3. any corrective action which may be required in respect of any of the products and services of the company;
   4. improving and innovating its products and services which, for example, enables it to manage its networks and understand network usage more effectively;
   5. credit checks, fraud prevention, debt recovery and security purposes; and
   6. compliance with applicable laws, regulations and rules.
5. Airtel holds and processes User Personal Data for the following purposes:
   1. supplying marketing and promotional material (at the user’s express request) and advertising online;
   2. administering and improving its websites and related purposes, (including collecting and analyzing anonymous, de-identified and aggregate information); and
   3. compliance with applicable laws, regulations and rules.
6. Airtel holds and processes Supplier Personal Data for the following purposes:
   1. administering the receipt of products and services from its suppliers;
   2. administering and managing business relationships with its suppliers; and
   3. compliance with applicable laws, regulations and rules.
7. Airtel may share the personal data that it collects with its corporate affiliates and third parties operating on its behalf. Airtel will only share personal data with companies that are required to protect personal data in accordance with relevant laws, regulations and rules, and subject to any appropriate security measures and directions from the relevant Airtel data controller, and in accordance with this policy.

1. All individuals who are the subject of Personal Data held by Airtel are entitled to the following rights:
   1. Right to request for and access their Personal Data collected and stored. Where data is held electronically in a structured form, such as in a Database, the Data Subject has a right to receive that data in a common electronic format;
   2. Right to information on their personal data collected and stored;
   3. Right to objection or request for restriction;
   4. Right to object to automated decision making;
   5. Right to request rectification and modification of their data which Airtel keeps;
   6. Right to request for deletion of their data, except as restricted by law or Airtel statutory obligations;
   7. Right to request the movement of data from Airtel to a Third Party; this is the right to the portability of data; and
   8. Right to object to, and to request that Airtel Nigeria restricts the processing of their information except as required by law or Airtel Nigeria’s statutory obligations.
   9. Right to complain to the Nigerian Data Protection Commission.
2. To opt out of marketing and unsolicited messages:
   1. If you no longer want to receive marketing messages from Airtel, you can choose to opt out at any time. If you’ve previously opted to receive personalized content based on how and where you use our network, you can also opt out at any time.
   2. These are various ways to opt out:
      • Contact our customer services team via the email addresses – mailto:customercare@ng.airtel.comcustomercare@ng.airtel.com or mailto:postpaidexperience@ng.airtel.compostpaidexperience@ng.airtel.com
      • Reach out to any member of the High Value Experience managers or Key Account Managers (KAMs)
      • Click the unsubscribe icon from our email or newsletters if you receive any.
      • Disable push notification messages, including marketing messages, at any time in our apps by changing the notification settings on your device or by uninstalling the app
      • You can also activate DND (Do Not Disturb) by dialing *2442#
      • Contact our customer service team by dialing 300
3. Airtel Nigeria’s well-defined procedure regarding how to handle and answer Data Subject’s requests are contained in Airtel Nigeria’s Data Subject Access Request Policy.
4. Data Subjects can exercise any of their rights by completing the Airtel Nigeria’s Subject Access Request (SAR) Form and submitting it to the Company via dataprotectionofficer@ng.airtel.com or call the number 09041119000.

The personal data we collect from our customers and how we collect it depends on the services that our customers subscribe to, how they use our services and how they interact or interface with us. This also applies to persons who are not customers of Airtel but have interacted with Airtel Networks. We may also obtain your personal data from a third party with permission to share it with us.

We may share your data with third parties to whom you have given your consent to procure such data from Airtel; Personal data we have about our customers where applicable includes: Name, Phone number, address, sex, photograph, ID card details, fingerprint and signature.

Please note that we collect your data when you provide it to us through any of our data collection points (physical, online, virtually, etc.) and only process your personal data based on the grounds set out in the NDPA 2023. Accordingly, in line with the provisions of the NDPA 2023, processing of Personal Data by Airtel shall be lawful if at least one of the following applies:

1. where you give us consent to the processing of your Personal Data for one or more specific purposes. You are at liberty of withdrawing the consent and Airtel will cease to process your personal information where there is no other basis to do so.
2. Where the processing is necessary for the performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering a contract;
3. Processing is necessary for compliance with a legal obligation to which Airtel is subject.
4. Processing is necessary to protect the vital interests of the Data Subject or of another natural person;
5. Processing is necessary for the performance of a task carried out in the public interest or in exercise of official public mandate vested in Airtel.
6. For the purposes of the legitimate interest pursued by the data controller or by a third party to whom the data is disclosed.

We collect your personal data when you do any of the following:

1. Buy or use any of our products and services;
2. Use our network or other Airtel products and services;
3. Register for a specific product or service;
4. Visit or browse our website;
5. Have given permission to other companies to share information about you;
6. Where your information is publicly available;
7. Are the customers of a business we acquire; or
8. Take part in a competition, prize draw or survey;
9. Where Airtel engages you as an employee or external business partner;
10. We also keep records when you use/conduct an activity on your mobile phone using our network. This includes the number you dialed, the length, date and time of that call, and records of your IP data sessions;
11. When you provide your data to us through any of our data collection points including but not limited to the following: our KYC registration forms, SIM Swap Forms, MNP Forms, self-service applications, social media platforms, websites, etc.

Personal data we have about our customers, where applicable includes name, phone number, address, sex, photograph, ID card number, fingerprint, and signature.

1. Where Personal Data is to be transferred to a country outside Nigeria, Airtel shall put adequate measures in place to ensure the security of such Personal Data. Airtel shall, among other things, conduct a detailed assessment of whether the said country is on the Nigerian Data Protection Commission (NDPC) Whitelist of Countries with adequate data protection laws.
2. Transfer of Personal Data out Airtel Networks Ltd would be in accordance with the provisions of the NDPA 2023, NDPR 2019 and GAID 2025. Airtel will therefore only transfer Personal Data out of Nigeria on one of the following conditions:
   1. The consent of the Data Subject has been obtained;
   2. The transfer is necessary for the performance of a contract between Airtel and the Data Subject or implementation of pre-contractual measures taken at the Data Subject’s request;
   3. The transfer is necessary to conclude a contract between Airtel and a third party in the interest of the Data Subject;
   4. The transfer is necessary for reason of public interest;
   5. The transfer is for the establishment, exercise or defense of legal claims;
   6. The transfer is necessary to protect the vital interests of the Data Subjects or other persons, where the Data Subject is physically or legally incapable of giving consent.

   Provided, in all circumstances, that the Data Subject has been manifestly made to understand through clear warnings of the specific principle(s) of data protection that are likely to be violated in the event of transfer to a third country, this proviso shall not apply to any instance where the Data Subject is answerable in duly established legal action for any civil or criminal claim in a third country.

3. Airtel will take all necessary steps to ensure that the Personal Data is transmitted in a safe and secure manner. Details of the protection given to your information when it is transferred outside Airtel Networks Ltd shall be provided to you upon request.
4. Where the recipient country is not on the Whitelist and none of the conditions stipulated in Section 8.3.2 of this Policy is met, Airtel will engage with NITDA and the Office of the Honorable Attorney General of the Federation (HAGF) for approval with respect to such transfer.

Intra Group Arrangements

1. Personal data may be transferred between companies in the Airtel Africa Group in accordance with applicable data privacy laws, Airtel Intra-Group Data Processing Agreement and this policy, in particular the data protection principles set out in paragraph 5 above and, if relevant, the requirements in relation to sharing personal data with a data processor or controller set out in section 10 above.
2. Where an Airtel Africa Group company receives personal data in its capacity as a data processor, that company shall comply with the requirements set out in this policy.

A data breach procedure is established and maintained to deal with incidents concerning Personal Data or privacy practices leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

All employees must inform their designated line manager or the DPO of Airtel immediately about cases of violations of this Policy or other regulations on the protection of Personal Data, in accordance with Airtel Personal Data Breach Management Procedure in respect of any:

1. improper transmission of Personal Data across borders;
2. loss or theft of data or equipment on which data is stored;
3. accidental sharing of data with someone who does not have a right to know this information;
4. inappropriate access controls allowing unauthorized use;
5. equipment failure;
6. human error resulting in data being shared with someone who does not have a right to know; and
7. hacking attack.

A data protection breach notification must be made immediately after any data breach to ensure that:

1. immediate remedial steps are taken in respect of the breach;
2. any reporting duties to NDPC or any other regulatory authority can be complied with,
3. any affected Data Subject can be informed and
4. any stakeholder communication can be managed.

When a potential breach has occurred, Airtel will investigate to determine if an actual breach has occurred, and the actions required to manage and investigate the breach as follows:

1. Validate the Personal Data breach.
2. Ensure proper and impartial investigation (including digital forensics if necessary) is initiated, conducted, documented, and concluded.
3. Identify remediation requirements and track resolution.
4. Report findings and send to senior management.
5. Coordinate with appropriate authorities as needed.
6. Coordinate internal and external communications.
7. The procedure for reporting of Personal Data Breaches to a Supervisory Authority
8. The Head of IT Security shall notify the DPO of any breach of personal data immediately of being aware of such breach.
9. The DPO shall review each reported incident of data breach and determine if there’s a requirement to notify the relevant supervisory authority.
10. The DPO shall be responsible for reporting in a timely manner all incidences of data breaches to the relevant supervisory authority upon consultation with the Group Privacy Officer, Chief Legal Officer and Airtel Africa Head of IT Security.

INTERACTION WITH SUPERVISORY AUTHORITIES

1. Engagement with local data protection authorities or regulators is an important step in strengthening Airtel’s data privacy and protection compliance programme and ensuring the company continues to meet the expectations of its stakeholders. Prior to engaging with local data protection authorities, the DPO is required to consult with the Airtel Africa Group Privacy Officer and functions responsible for data protection oversight to ensure such engagement are effective and well-coordinated.
2. Ensure that impacted Data Subjects are properly notified, if necessary.

Airtel Networks Ltd shall appoint a Data Protection Officer(s) (DPO) responsible for overseeing the Company's data protection strategy and its implementation to ensure compliance with the NDPA 2023 requirements. The DPO shall be duly certified on data privacy and protection principles and shall be familiar with the provisions of the NDPA 2023.

The main tasks of the DPO include:

1. administering data protection policies and practices of Airtel;
2. monitoring compliance with the NDPA 2023 and other data protection laws, data protection policies, awareness‑raising, training, and audits;
3. advice the business, management, employees and third parties who carry on processing activities of their obligations under the NDPA 2023;
4. acts as a contact point for Airtel;
5. monitor and update the implementation of the data protection policies and practices of Airtel and ensure compliance amongst all employees of Airtel;
6. ensure that Airtel undertakes a Data Impact Assessment and curb potential risk in Airtel data processing operations; and
7. maintain a Data Base of Airtel’s data collection and processing operations.

1. When appointing third parties to carry out processing of personal data on the [Airtel Nigeria’s] behalf, Airtel Nigeria shall only use processors that will guarantee to implement appropriate technical and organizational measures to ensure that their processing activities meet the requirements of data privacy laws and ensure the protection of the rights of data subjects. The third parties shall be duly licensed by the Commission per the classification of agent and processing further to the Guidance Notice.
2. When appointing a third-party data processor, Airtel Nigeria must enter into a written agreement in accordance with the Nigerian Data Protection Act (NDPA 2023 Act and as part of its adequacy mechanisms) which specifies:
   1. the subject matter and duration of the processing;
   2. the nature and purpose of the processing;
   3. the type of personal data and categories of data subjects; and
   4. the obligations and rights of Airtel Networks Ltd as data controller.

   The agreement must impose obligations at least as onerous as those set out in Annex 1.

   (a) When Airtel Networks Ltd and a third party jointly determine the purposes for which, and the way, personal data is processed, they might be considered joint data controllers under data privacy laws.

   (b) The requirements in paragraph 9(a–c) also apply to personal data sharing between Airtel Africa Group companies. In that case, references to a third party shall be read as ‘Airtel Africa Group recipient’.

The processor shall, when processing personal data on behalf of Airtel Africa Group and Airtel Networks Ltd, process the personal data only on documented instructions from Airtel Africa and Airtel Networks Ltd including with regard to transfers of personal data to a country outside the European Economic Area or to an international organization (unless the processor is required to do so by European Union or United Kingdom law, in which case the processor shall inform Airtel Africa of that legal requirement before processing, unless prohibited by that law on important grounds of public interest);

1. ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
2. taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as appropriate:
   1. the pseudonymization and encryption of the personal data;
   2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
   3. the ability to restore the availability and access to the personal data in a timely manner in the event of a physical or technical incident;
   4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing;
3. only engage another processor with Airtel Africa’s prior specific written consent and, if Airtel Africa consents, by entering into a legally binding written agreement that places the same data protection obligations as those set out in this clause on the other processor, provided that if the other processor fails to fulfil its data protection obligations the initial processor shall remain fully liable to Airtel Africa for the performance of that other processor’s obligations;
4. considering the nature of the processing, assist Airtel Africa by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects for access to or rectification, erasure, portability, restriction of processing or objections to processing of their personal data;
5. assist Airtel Africa in ensuring compliance with Airtel Africa’s security, data breach notification, impact assessment and consultation obligations under Articles 32 to 36 of the General Data Protection Regulation, considering the nature of processing and the information available to the processor;
6. at Airtel Africa’s election, delete or return all personal data and existing copies to Airtel Africa at the end of the provision of the services (unless European Union or other applicable law requires the processor to store the personal data);
7. make available to Airtel Africa all information necessary to demonstrate compliance with the obligations in this clause and allow for and contribute to audits, including inspections, conducted by Airtel Africa or another auditor mandated by Airtel Africa.
   [Drafting note: Depending on the other terms of the agreement with the processor, this clause (h) should cross-reference Airtel Africa’s other audit rights]