• NNPC Limited

• Any company or partnership in which NNPC Limited directly or indirectly owns or controls, more than fifty percent (50%) of the ownership interest having the right to vote or appoint its directors or functional equivalents (“Affiliated Company”)

• Any joint venture in which NNPC Limited, or an Affiliated Company has day-to-day operational control.

The relevant NNPC Limited affiliates will process the Personal Data in accordance with the privacy notices they provide for such specific uses. When these notices apply to you, we recommend that you read them carefully.

This Privacy Policy sets forth general Personal Data privacy principles that NNPC Limited follows with respect to Personal Data being processed in our business operations. Our data privacy policies may vary among the countries in which we operate to reflect local practices and legal requirements.

Those whom this Privacy Policy is addressed to include but not Limited to:

• Recruitment Candidates,
• Vendors,
• Customers
• Visitors,
• CCTV Data,
• CSR Beneficiaries,
• Website Visitors,
• Recipients of electronic or other communications which contain or refer to this Privacy Policy

Information from Children

NNPC Limited does not seek through the Site to gather Personal Data from or about minors (as this term is defined by applicable law), nor does NNPC Limited share the personal information of minors without affirmative authorization.

NNPC’s compliance with data protection Laws

NNPC Limited is committed to collecting and using personal data in a lawful manner. NNPC Limited will ensure that, when it collects or uses personal data, such collection or use is allowed under applicable data protection law, including, for example, the Nigeria Data Protection Act.

Individuals may object to the processing of their personal data and we will consider such objections carefully where required by law. For more information about your rights with respect to how we process your personal data, please contact us via data.privacy@nnpcgroup.com

Personal Data Collected & How It Is Used

We obtain information about you through the mediums defined below. In addition to the purposes set out below, we may use all or a combination of this information to defend our legal rights and comply with the law and regulatory requirements.
When NNPC Limited relies on its legitimate interest as a legal basis to process personal data, NNPC Limited will ensure that these interests do not disproportionately and adversely impact your rights and freedoms. When NNPC Limited relies on your consent as a legal basis to process personal data, you can withdraw your consent at any time. Data Subjects wishing to withdraw their consent should notify us at data.privacy@nnpcgroup.com and we will stop the processing of your personal data as soon as reasonably possible.

*Note: Data Elements we have identified in the table above is not an exhaustive list.*

We contract with other companies and persons to perform functions on our behalf. They have access to personal data needed to perform these business purposes.
For example, NNPC Limited may share your personal data with vendors in order to allow NNPC Limited to fulfil orders and make deliveries, to send postal mail, and email, to manage customer lists, analyse data, provide marketing assistance, host websites, process card payments, and provide and improve customer service.

Furthermore, communicating via the Internet and sending information, products, and services to you by other means necessarily involves your personal data passing through or being handled by third parties.
These service providers have access to your personal data needed to perform our business purposes, but shall not use it for other purposes.
Before any personal data is shared with service providers, we enter into a written agreement that requires them not to make any unauthorized disclosures of the personal data and:

• to use the personal data only for the specified purposes and only according to the instructions received from NNPC Limited
• to retain the personal data only as long as necessary to protect company interests; and
• to have in place adequate and appropriate security measures.

In some circumstances, NNPC Limited will disclose personal data to vendors, legal advisors, NNPC Limited owned and affiliate fuel station operators, payment and loyalty card issuers, other contracted parties and competent authorities. These external parties process the personal data on their own behalf, for instance: if required by law, in order to defend NNPC Limited’s rights, or to handle individuals’ complaints and requests. We may also share your information in connection with a transfer of assets, or if we are otherwise involved in a merger or transfer. Only when permitted by applicable law and with your consent as required, will we distribute personal data to vendors, such as NNPC Limited distributors, for the purpose of allowing them to market their products and services to you. NNPC Limited does not, and will not, sell personal information to third parties.

We may share personal data with third parties such as appropriate security agencies and competent legal/regulatory authorities where disclosure is reasonably necessary to: (a) comply with applicable legislation and regulation; (b) comply with legal process or a regulatory investigation (e.g., a subpoena or court order); (c) investigate potential violations; (d) detect, prevent or otherwise address fraud or security issues; (e) protect against harm to the rights, property, or safety of the Company, our customers or the public, as required or permitted by law.
NNPC Limited does permit third parties to collect information through our Sites (for example via cookies) to show advertisements for our products and services when the user visits other websites. Where required by law, we will seek your prior consent before such information is collected via our Sites. The third parties may also use the information for interest-based advertisement of other products and services. The advertisements are based on the users’ online activities over time and across different sites, services, and devices (“interest-based advertising”).

Transfers between affiliates

The relevant NNPC Limited affiliate who is the Data Controller may make personal data available to other NNPC Limited affiliates and may transfer some or all of the personal data to NNPC Limited servers located worldwide in accordance with applicable law.

The transfer of personal data from Nigeria to recipients located outside the country is subject to restrictions. NNPC Limited has taken steps so that personal data receives an adequate level of data protection at all NNPC Limited locations. These steps include NNPC Limited affiliates entering into inter-affiliate agreements containing the NDPA “Standard Contracting Clauses”. The Standard Contracting Clauses which have been established in line with the NDPA as offering adequate protection for transfers of personal data outside Nigeria.

Transfers to third parties When transferring personal data

NNPC Limited puts in place safeguards to ensure that the recipient adequately protects the personal data. With respect to the transfer of personal data from Nigeria to outside the country, NNPC Limited relies on NDPA “Standard Contracting Clauses” - contractual safeguards imposed on the recipient which is contracted by NNPC Limited affiliates outside of Nigeria; and protections available under local law for the recipient established in a country deemed adequate by NDPC. Where permitted, and as applicable, we will rely on the individual’s consent.

For more information about specific transfer mechanisms, including information on existing safeguards implemented by NNPC Limited, please contact us at data.privacy@nnpcgroup.com

Data Accuracy

NNPC Limited endeavours to keep the personal data that it collects accurate and complete. NNPC Limited relies on data subjects to maintain the accuracy and completeness of the personal data. Please inform NNPC Limited if your personal details change, including the context in which the personal data was provided, e.g. in connection with a specific product or service.

Individual’s Right

Applicable law may give you certain rights with respect to your personal data. Data subjects may have the right to delete their data, to access and transfer personal data collected, used, or disclosed by NNPC Limited, and to exercise these rights freely and without discrimination.

In order to submit a verifiable request to exercise your right to know about, or delete, your personal information, please visit NNPC Limited’s privacy program landing page where you may submit your request via email, web form or via phone.

• Under data privacy laws in Nigeria, applicable law gives data subjects the right to:
• access their personal data; have inaccurate or incomplete personal data rectified
• request for a copy of any personal data which we hold
• request to update or delete personal data which we hold.
• restrict the processing of their personal data, under certain circumstances
• withdraw consent to process personal data, where we rely on consent as a legal basis to justify personal data processing
• object to the processing operations, having regard to the given circumstances and for reasons related to their situation; or have personal data erased when such data is no longer necessary for the purposes for which it has been collected, in accordance with applicable law.

In some circumstances, you also have a right to request a portable extract of your personal data, which will allow you to reuse your personal data for your own purposes. You also have a right to lodge a complaint to the data protection supervisory authority (Data Protection Commission for Nigeria) in your country.
For more information about the specific mechanisms available to exercise these rights, please contact us at data.privacy@nnpcgroup.com
To facilitate our efforts to address your request, please let us know the circumstances in which you initially provided NNPC Limited with your personal data, e.g. in connection with a specific product or service.

Please note that we may ask individuals to provide us with the information necessary to confirm their identity before responding. We will aim to acknowledge inquiries within 72 hours and respond within one month unless otherwise required by law. Where permitted to do so, complying with your request may be subject to a fee to meet our associated costs.

We will consider all data subject requests. However, we may not fulfil requests under circumstances where exemptions exist, which include a need to keep processing information for our legitimate interests or to comply with a legal obligation. If such an exception applies, we will notify individuals when responding to their request.

Do-Not-Track Signals and Similar Mechanisms

Some mobile web browsers transmit "do-not-track" signals. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. We currently do not act in response to these signals.

Automated Decision Making

NNPC Limited does not use automated decision-making unless it is necessary for entering into, or performance of, a contract between the Individual and NNPC Limited and its affiliates; permitted or required by law; or based on the data subject’s explicit consent. Automated decision-making refers to decisions that produce legal effects concerning an Individual or significantly affect the Individual and which are based solely on automated processing (i.e. no human intervention) of personal data.

NNPC Limited shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests when automated decision-making is used.

We have implemented appropriate technical and organizational security measures (such as Secure Sockets Layer (SSL) on our website and access controls on our information systems) to protect the personal data in our care, both during transmission and once we receive it. This includes measures to protect personal data from accidental or unauthorized destruction, loss, or alteration, and from unauthorized disclosure or access. NNPC LIMITED takes reasonable and practicable security measures to ensure privacy. In the event of a data breach, we shall report such breach to the relevant authority and if necessary, affected individuals of personal data breach (where the personal data breach will likely result in high risks to the freedoms and rights of the individual) within 72 hours of becoming aware of the breach or being notified by any processor of a personal data breach. We will take steps to investigate and recover personal data and will ensure security controls are improved to prevent a re-occurrence of the data breach.

A “cookie” is a string of information that assigns a unique identifier that we store on an individual’s computer. The browser then provides that unique identifier to use each time a query is submitted to the site. We use cookies on the site to, among other things, keep track of services that have been used and record user preferences. Where the use of cookies is not strictly necessary for the basic function, we rely on your explicit consent for processing in line with the purposes of their operation.

We use cookies to:

• Ensure your privacy and security when you visit our sites,

• Store your login details securely,

• Evaluate our sites' advertising and promotional effectiveness.

The following cookies can be used when visiting our website or sub-sites:

*Note – the list of cookies in this table is not an exhaustive list as cookies deployed on the group website or subsites are subject to change at intervals.*

It is possible to limit the use of cookies or prevent them from being set entirely. Most Internet browser software allows the blocking of all cookies or enables users to receive a warning before a cookie is stored, either through built-in functionality or by using third-party plugins. Please be advised that disabling cookies may result in some features or services performing sub-optimally.

For further information, please refer to the internet browser software instructions or help screen.

What types of cookies do we use on our Site?

Functionality cookies

These cookies allow our websites to remember your site preferences and choices you make on the site including username, region, and language. This allows the website to provide personalized features like local news and weather forecasts if you share your location. They are anonymous and don’t track your browsing activity across other websites.

Analytical cookies

These cookies enable us and third-party services to collect aggregated data for statistical purposes on how you use the website. These cookies do not contain personal information such as names and email addresses and are used to help us improve your user experience of the website.

Statistical Cookies

Also known as “performance cookies,” these cookies collect information about how you use our website, like which pages you visited, and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized.

Marketing Cookies

Marketing cookies are cookies that are used for marketing, advertising, or tracking purposes. They primarily gather information about your online behaviour, preferences, and interactions with websites or advertisements.

How to delete cookies?

If you want to restrict or block the cookies that are set by our website, you can do so through your browser settings.

More information about cookies

For more information about managing and restricting the use of cookies, visit (https://allaboutcookies.org/).

Contacting us

If you have any questions about this policy or our use of cookies, please contact us at data.privacy@nnpcgroup.com 

NNPC Limited retains personal data as long as necessary to meet the purposes for which the data was collected, to exercise its legal rights and to ensure compliance with applicable law.

NNPC Limited is committed to protecting your personal data as described in this Privacy Policy and as required by applicable laws. If you have any questions about this notice or our handling of your personal data, or if you would like additional information, please contact us at data.privacy@nnpcgroup.com. 

We will ensure all data protection complaints are resolved in a timely manner as set out in the applicable Data Privacy laws and the Data Subject is informed when appropriate.

We reserve the right to change this Privacy Policy at any time without notice. When we make material changes to this Privacy Policy, we will post the changes on this page and update the revision date at the bottom of the Privacy Policy. We encourage you to review our Privacy Policy regularly for updates.

NNPC Limited respects and is sensitive to the rights as granted in the data protection laws in Nigeria. Should you have questions about this privacy policy or our information collection, use and disclosure practices in relation to NNPC Limited, you may contact the Enterprise Data Office as per the details given below. 

We will use reasonable efforts to respond promptly to requests, questions, or concerns regarding the use of your personal data and sensitive personal data.
data.privacy@nnpcgroup.com 

Nigerian National Petroleum Company Limited
NNPC Limited Towers
Herbert Macaulay Way,
Garki,
P.M.B 190,
Abuja – Nigeria
Effective Date: 4th February 2026.