Privacy Policy

Last updated 26 September 2026 · Effective on publication

How we collect, use, share and protect your personal data when you buy electricity through UtilityBox, and the rights you have over it under the Nigeria Data Protection Act 2023.

1. Who we are

UtilityBox is operated by UtilityBox Ltd (“UtilityBox”, “we”, “us”, “our”), a company registered in Nigeria with company number RC1280416, registered office CITEC Mount Pleasant, Abuja. For the purposes of the Nigeria Data Protection Act 2023 (the “NDPA”) we are the data controller of the personal data described in this policy.

Questions, requests and complaints: support@utilitybox.ng.

2. What we collect

Information you give us

• Meter number and the distribution company (DisCo) it belongs to.
• Purchase amount.
• Account details, if you create an account: your name, email address and phone number.
• Anything you tell us in support, by email or in chat.

Information we receive from your DisCo

When we check a meter number before payment, the DisCo returns the registered customer name, service address, meter type and tariff band for that meter. We show this back to you so you can confirm you are paying for the right supply before any money moves. If you buy for someone else’s meter, you will see their registered name and address.

Information created by your purchase

• The electricity token issued by the DisCo, the units credited, the amount paid and any fees.
• A payment reference from our payment provider, and whether the payment succeeded or failed.
• The date and time of the transaction.

Information we do not collect

We do not receive or store your card number, CVV or bank credentials. Those are entered inside our payment provider’s own secure window. We do not run advertising or analytics trackers on this service, and we do not build marketing profiles.

3. Why we use it, and our lawful basis

The NDPA requires us to have a lawful basis for each purpose. Ours are:

4. Who we share it with

• Your electricity distribution company. We pass your meter number and purchase amount so the DisCo can credit your meter and issue a token. They process that data as controllers in their own right, under their own policies.
• Our payment provider. Payments are processed by Quidly, which collects your card or bank details directly and returns only a reference and a result to us.
• Our infrastructure providers, who host the service and store its data on our instructions.
• Regulators, law enforcement and professional advisers, where we are legally required to disclose, or need to establish or defend a legal claim.

We do not sell personal data, and we do not share it with advertisers or data brokers.

5. Where your data is held

Our systems and database are hosted with Amazon Web Services in the United States. Using this service therefore involves a transfer of your personal data outside Nigeria.

We make those transfers on the basis that the recipient is bound by contractual terms requiring a level of protection comparable to the NDPA, and we transfer only what is needed to run the service.

6. How long we keep it

• Transaction records (meter, amount, token, date): retained forthe period required by Nigerian financial record-keeping law, and then deleted or anonymised.
• Account details: for as long as your account is open. If you close it, we delete your account data and keep only the transaction records we are legally required to keep.
• Support messages:kept while the matter is open and for a reasonable period afterwards, in case it is reopened.

7. Your rights

Under the NDPA you have the right to:

• Access — ask what personal data we hold about you and get a copy.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete data we no longer need, subject to records we must keep by law.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing carried out on the basis of legitimate interest, and to direct marketing at any time.
• Portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time, where we relied on consent. This does not affect anything done before you withdrew it.

To exercise any of these, email support@utilitybox.ng. We will respond within30 days, and we do not charge for it. We may ask you to confirm your identity first — a meter number and a purchase history are not something we will hand to whoever asks.

8. Automated decision-making

We do not make decisions about you by automated means alone, and we do not profile you. Meter validation and payment checks are automated steps in a purchase, not decisions that produce legal effects for you.

9. Security

Your session is held in your browser’s session storage and ends when you close the tab; we sign you out after a period of inactivity. Traffic between your browser and our systems is encrypted in transit. Access to the transaction database is restricted to named staff over a private network, and card data never enters our systems at all.

No system is completely secure, and we do not claim otherwise. If you think your account has been accessed by someone else, tell us immediately.

10. Data breaches

If a breach occurs that is likely to result in a high risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we will tell affected customers without undue delay.

11. Cookies and local storage

UtilityBox uses necessary cookies and browser storage to keep the website secure and working. Optional analytics and marketing technologies are used only when configured for the site and only after you give the relevant permission in Cookie Settings.

• Strictly necessary: authentication, antiforgery protection, checkout state, payment return handling, purchase recovery and core account history. These stay active so rejecting optional cookies does not stop you buying a UtilityBox service.
• Analytics: measurement tools such as Google Analytics or Google Tag Manager, if configured, to understand how the service is used. Off unless you allow Analytics.
• Marketing: advertising measurement tags such as Google Ads, Meta, TikTok, Microsoft or Snap, if configured. Off unless you allow Marketing.
• Preferences: optional choices such as remembering a light or dark theme. Off unless you allow Preferences.
• Session storage: your signed-in session, an inactivity timestamp, and a purchase in progress so a token is not lost if a payment window closes. Cleared when you sign out or close the tab.
• Local storage: details needed for purchase recovery and account history, such as meters you have bought for and the units on tokens you have already received. Optional attribution and preference storage is not kept unless the matching consent category is allowed.

You can change or withdraw optional cookie choices at any time by using Cookie Settings in the footer. Withdrawal stops future optional tracking and prevents optional tags loading on later page views. Where technically possible, UtilityBox-controlled optional cookies and storage are removed. Some third-party cookies already set by a third party may also need to be cleared through your browser or that third party's own controls.

12. Children

This service is not intended for anyone under 18. We do not knowingly collect data from children, and we will delete it if we find we have.

13. Changes to this policy

If we change this policy we will update the date at the top of this page, and we will tell account holders directly where the change is significant.

14. Complaints

Please raise anything with us first — support@utilitybox.ng — and we will try to put it right. You also have the right to complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

© 2026 UtilityBox Ltd. All rights reserved.