Introduction
Monsera Technologies Limited (RC 9187476), a company incorporated in the Federal Republic of Nigeria (“Monsera”, “We”, “Us” or “Our”), owns and operates the Monsera solution: an embedded credit infrastructure that enables licensed electricity distribution companies (“DisCos”) to offer short-term electricity credit advances to their prepaid customers within the DisCo’s own application, together with our website and API (together, “the Monsera Solution” or “the Solution”).
We take the privacy of every person who interacts with the Monsera solution seriously. This Privacy Policy explains what personal data We collect, why We collect it, the lawful bases on which We process it, who We share it with, how long We keep it, and the rights You have in respect of it. It is issued in accordance with the Nigeria Data Protection Act 2023 (“NDPA”) and the NDPA General Application and Implementation Directive 2025 (“GAID”) issued by the Nigeria Data Protection Commission (“NDPC”).
If You are a prepaid electricity customer, it should also be read together with the privacy notice of Your DisCo, which governs the identity and account data that DisCo holds about You.
Who This Policy Covers
This Policy applies to:
- Consumers: prepaid electricity customers whose meter is served by a DisCo that has integrated the Solution, and whose meter data is processed by Us in connection with a credit advance, whether or not that customer ever requests one;
- Partner Personnel: employees, officers and agents of DisCos, lenders of record and other Partners who are granted access to the Solution, API or dashboards, or who communicate with Us in the course of a Partner relationship;
- Visitors: individuals who visit our websites or contact Us without holding any account.
These three groups are treated separately throughout this Policy because what We hold about each is different in kind. Partner Personnel are the only people whose ordinary personal data (names, work contact details, credentials) We hold. For Visitors We hold only the technical and contact data generated by a website visit or an enquiry. For Consumers We hold pseudonymised meter data and no identity data at all; the next section explains that architecture, and it is the section that matters most if You are an electricity customer.
Our Role
Monsera operates at the meter level. DisCos assign a pseudonymised identifier (“Meter Token”) to each meter and share the vending history of that meter with us. We receive no name, residential address, telephone number, email address, identification document, National Identity Number or Bank Verification Number (BVN), and We hold no key that would allow us to link a Meter Token to a person.
Pseudonymised data remains personal data under the NDPA where it can be re-identified by someone, and because Your DisCo can re-identify it, We treat all Meter Data as personal data and apply the protections of the NDPA to it in full.
We act as an independent data controller in respect of: (a) Meter Data received from DisCos and the credit decisions, obligation records, repayment outcomes and model calibration data We generate from it (“Monsera Credit Data”), because We determine how that data is used to operate and improve the Solution; (b) the account, contact and usage data of Partner Personnel; (c) data relating to Visitors; and (d) security, device and audit logs generated from the operation of the Solution.
Your DisCo is the data controller for Your identity, contact, account and billing information, for the Meter Token mapping, for Your opt-in consent to the credit feature, for all communications sent to You, and for the operation of the obligation registry and settlement deduction within its own systems. Because Your DisCo alone can identify You, requests to access, correct or delete data relating to Your meter should be made to Your DisCo in the first instance.
The Lender of Record is a finance company licensed by the Central Bank of Nigeria under whose licence every credit advance is booked. It receives pseudonymised transaction records from Us for booking, reporting and regulatory purposes, and is an independent controller of those records under its own privacy notice.
The Data We Collect
Data relating to Consumers
- Meter Data: vending (recharge) history, recharge frequency, consumption patterns and token values for a meter, identified by Meter Token, as transmitted to Us by Your DisCo through the API.
- Credit request data: the obligation value requested, the eligibility decision and limit returned, the service charge applied, the token value disbursed, and the timestamps of each event.
- Repayment data: recoveries applied to an obligation at subsequent vends, the timing of full recovery, and default classifications, as reported to Us by Your DisCo’s settlement system.
- Monsera Credit Data: the outputs of our Scoring Engine for a meter, including eligibility scores, limits and the data We derive for calibrating and improving the Scoring Engine.
Data relating to Partner Personnel and Visitors
- Account and contact data: name, work email address, telephone number, job title, organisation and access credentials of individuals granted access to the Solution or who correspond with Us.
- Device and usage data: IP address, device type, operating system, browser type, API client identifiers, access dates and times, actions taken within dashboards, and related diagnostic data.
- Communications and support data: the content of messages sent to our support, partnership or data protection channels.
- Cookies and similar technologies: as described in Cookies and Similar Technologies.
What We do not collect
We do not collect, request or accept from any Partner: customer names, residential or postal addresses, telephone numbers, email addresses, dates of birth, identification documents, National Identity Numbers, Bank Verification Numbers, bank account or card details, geolocation, or any other direct identifier of a Consumer.
Partners are contractually prohibited from transmitting such data to Us, and Our API is designed to reject it. We do not perform Know Your Customer checks, We do not create person-level credit profiles, and We do not report to or query any credit bureau.
How We Collect Data
We collect data from DisCos, which transmit Meter Data, credit requests and repayment data to Us through secure API integration under a Partner Agreement and Data Processing Agreement; automatically, through the operation of the Solution, which generates credit decisions, reconciliation records and security logs; directly from Partner Personnel and Visitors, when they register for access, correspond with Us or use our website; and through cookies and similar technologies on our website.
Lawful Bases for Processing
We process personal data only where a lawful basis under Section 25 of the NDPA applies. The basis differs by group of Users:
Meter Data and Monsera Credit Data (Consumers)
Legitimate interests: We process Meter Data to assess whether a meter is eligible for a credit advance, to orchestrate the float, to reconcile recoveries, to prevent fraud and misuse, and to calibrate and improve the Scoring Engine. These are legitimate interests of Monsera, of Your DisCo and of the Lender of Record, and We have assessed that they are not overridden by Your rights and freedoms because:
- the data is pseudonymised at source and We hold no means of identifying You;
- the processing concerns only the vending behaviour of a meter, not any characteristic of a person;
- a decline carries no consequence beyond the unavailability of an advance on that occasion; and
- Your DisCo offers the feature only to customers who have affirmatively opted in.
That opt-in, which Your DisCo obtains and records as controller of the customer relationship, is a safeguard on which our assessment relies, and You may withdraw from the feature through Your DisCo at any time.
Legal obligation: We retain credit, repayment and reconciliation records, and make disclosures to regulators, where required by the Federal Competition and Consumer Protection Act 2018, the Digital, Electronic, Online or Non-Traditional Consumer Lending Regulations 2025 (the “DEON Regulations”), the NDPA, and lawful requests from competent authorities.
Partner Personnel
Performance of a contract: We process the account, contact and credential data of Partner Personnel to provide the Solution to the Partner under its Partner Agreement, administer access, provide technical support and issue service communications.
Legitimate interests and legal obligation: We maintain security, audit and access logs to protect the Solution, and retain records required by tax, accounting and regulatory law.
Visitors
Legitimate interests: in operating and securing our websites and responding to enquiries, and consent for non-essential cookies and any marketing communications, which You may withdraw at any time without affecting the lawfulness of processing before withdrawal.
How We Use Personal Data
We use the personal data for which We are controller to: assess the eligibility of a meter for a credit advance, and determine the applicable limit; orchestrate the float from which advances are funded; record obligations and reconcile recoveries with Your DisCo’s settlement system; detect and prevent fraud, duplicate requests and misuse; calibrate, test and improve the Scoring Engine; produce aggregated, non-identifying performance reports for Partners and the Lender of Record; maintain audit trails required by regulation and by our Partner Agreement; administer Partner accounts and provide technical support; secure and monitor the Solution; establish, exercise or defend legal claims; and comply with applicable law.
We do not sell personal data. We do not use Meter Data or Monsera Credit Data for advertising, marketing or for any purpose other than to ensure the operation of the credit feature. We do not permit Partners to use Monsera Credit Data for any purpose other than operating the credit feature.
Automated Decision-Making
The decision whether a meter is eligible for a credit advance, and the limit that applies, is made automatically by the Scoring Engine, in real-time, without human intervention at the point of decision. We are transparent about this because Section 37 of the NDPA gives You rights in respect of decisions made solely by automated means.
The Scoring Engine assesses the likelihood that an advance will be recovered at the next vend, using only the vending history of the meter itself: how regularly it is recharged, in what amounts, and how previous advances on that meter were repaid. It does not use, and does not have access to, any information about the person behind the meter, including income, employment, location, gender, age, ethnicity or any other personal characteristic. A decline does not affect Your access to ordinary electricity vending or any other service of Your DisCo, is not reported to any credit bureau, and carries no consequence beyond the unavailability of an advance on that occasion.
You have the right to be informed when a request is declined or limited, which Your DisCo provides through its application; to obtain through Your DisCo a meaningful explanation of the general logic applied; to contest a decision and request human review, which We will carry out within ten (10) business days of a referral from Your DisCo; and to object to this processing by withdrawing from the credit feature.
International Transfers
Our primary infrastructure is hosted on cloud services with data residency in, or serving, Nigeria. Where personal data is transferred outside Nigeria, including for cloud hosting or technical support, We do so in accordance with Sections 41 to 43 of the NDPA: either to a jurisdiction the NDPC has determined provides an adequate level of protection, or subject to appropriate safeguards such as contractual instruments imposing data protection obligations on the recipient, or on another basis permitted by the NDPA. Because the data We transfer is pseudonymised and contains no direct identifiers, the risk to data subjects from any such transfer is correspondingly reduced.
Security
We apply technical and organisational measures appropriate to the risk of the processing, including pseudonymisation of all Consumer-related data at source, before it reaches Us; encryption of data in transit and at rest; authenticated, rate-limited API access with credentials issued per Partner; role-based access controls and least-privilege permissions for Partner Personnel and our own staff; segregation of each Partner’s data; immutable logging of every credit decision, settlement deduction and administrative action; and due diligence on our service providers. No system is impenetrable and We do not promise absolute security.
Where We become aware of a personal data breach, We will act in line with our obligations under the NDPA, including notification to the NDPC within seventy-two (72) hours where required, notification without undue delay to any DisCo whose Meter Data is affected so that it can notify affected Consumers, and notification to Partner Personnel and Visitors directly where a breach is likely to result in a high risk to them.
Retention
We retain personal data for no longer than is necessary for the purposes for which it was collected, and in accordance with the following principles:
Consumers
- Meter Data, credit request, repayment and reconciliation records are retained at Meter Token level for five (5) years from the date the relevant obligation is discharged, in line with the record-keeping period applicable to consumer lending under the DEON Regulations, and for any longer period required by law or reasonably required to establish or defend a legal claim. They are then deleted or irreversibly anonymised.
- Meter Data for meters that never requested an advance is retained only for as long as the meter remains enrolled in the credit feature with its DisCo and is deleted or anonymised within a reasonable period after enrolment ends.
- Monsera Credit Data used for Scoring Engine calibration is converted to aggregated or irreversibly anonymised form once it is no longer required at Meter Token level.
Partner Personnel and Visitors
- Partner Personnel account data is retained for the life of the Partner relationship and thereafter for the period required by tax, accounting and limitation law.
- Visitor enquiry data is retained for as long as needed to respond to the enquiry and for a reasonable period thereafter.
- Security and audit logs are retained for a defined period proportionate to their purpose of detecting and investigating fraud, abuse and security incidents.
Where a Partner relationship ends, Meter Tokens for which no obligation is outstanding are deleted or anonymised within a reasonable period after the Partner’s export window closes, save for records within the five-year period above. Where deletion is not immediately possible (for example, in secure backups), We isolate the data from further processing until deletion is effected.
Your Data Protection Rights
Subject to the conditions and exemptions in applicable law, You have:
- The right to access: You have the right to request copies of your personal data from us.
- The right to rectification: You have a right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
- The right to erasure: You have the right to request that our company erase your personal data, under certain conditions.
- The right to restrict processing: You have the right to request that we restrict processing your personal data under certain conditions.
- The right to object to processing: You have a right to object to our processing of your personal data, under certain conditions.
- The right to data portability: You have a right to request that we transfer the data we have collected from you to another organization, or directly to you under certain conditions.
- The right to withdraw consent: at any time where processing relies on it.
- The right to not be subject to a decision based solely on automated processing: that produces legal or similarly significant effects, subject to the Automated Decision-Making section above; and
- The right to lodge a complaint with the NDPC.
How You exercise these rights depends on which group You belong to, as explained below. We do not charge a fee for responding to a rights request.
How Consumers exercise these rights
Because We hold no identity data, We cannot verify who You are or locate Your meter among the Meter Tokens We hold. For that reason, please direct any request concerning Your meter or Your credit advances to Your DisCo in the first instance. Your DisCo will verify Your identity, identify Your Meter Token, and either respond itself (for data it controls) or relay the request to Us (for data We control). We will respond to Your DisCo within the time the NDPA allows, and in any event within thirty (30) days of receiving a verified referral, and Your DisCo will communicate our response to You. If You contact Us directly, We will explain this process and, with Your agreement, refer Your request to Your DisCo. Nothing in this Section limits Your right to complain directly to the NDPC or the FCCPC.
How Partner Personnel and Visitors exercise these rights
Please contact our Data Protection Officer using the details at the end of the document. We will respond within one (1) month of receipt, which may be extended where the NDPA permits. We may ask You to verify Your identity before acting on a request.
Consumer Communications
We don’t communicate directly with Consumers. All communications about the credit feature, including enrolment confirmation, decisions on requests, repayment notifications, statements of account and responses to complaints, are issued by Your DisCo through its own channels and under its own privacy notice. We do not send marketing of any kind to Consumers, and We do not hold the contact details that would allow Us to do so.
Partner Personnel may receive service communications relating to their access, security and material changes to the Solution; these are necessary to the Services and are not marketing.
Children
The Solution is a credit infrastructure for electricity account holders and is not directed at children. Electricity accounts and prepaid meters are held by adults, and We do not knowingly process data relating to any person below the age of eighteen (18). Because we do not hold identity data, We rely on DisCos to ensure that the credit feature is offered only to account holders of lawful age. If You believe data relating to a child is being processed through the website or solution, please contact Your DisCo or Us and We will take appropriate steps to delete it.
Third-Party Services
The credit feature is delivered inside applications operated by Your DisCo, and our website may link to third-party sites. This Policy applies only to the data for which We are controller. Your use of Your DisCo’s application is governed by Your DisCo’s own privacy notice, and Your relationship with the Lender of Record is governed by its privacy notice. We encourage You to read both.
Data Protection Officer and Registration
We have appointed a Data Protection Officer who is responsible for overseeing our compliance with the NDPA and GAID and who may be contacted using the details at the end of this document. We maintain the registrations and filings required of Us under the NDPA for our processing activities and conduct Data Protection Impact Assessments for processing likely to result in high risk to data subjects, including the automated decisioning described above.
Changes to our Privacy Policy
We keep this privacy policy under regular review and publish updates at plugmonsera.com/privacy. Where a change is material, We will notify Partners in writing and will provide Your DisCo with notice sufficient to inform affected Consumers before the change takes effect; where the change concerns processing that relies on consent, consent will be sought afresh through Your DisCo. Continued use of the Solution after the effective date of an update constitutes acceptance to the extent permitted by law.
How to Contact Us
The data controller responsible for your personal information for the purposes applicable to the Nigeria Data Protection Act 2023 is:
Monsera Technologies Limited
Attention: Sharon Kelechi Obi
Suite 25, 3rd Floor, Vicbalkon Towers, Utako, Abuja, Nigeria.
If You are a Consumer, please contact Your DisCo first using the complaint and data protection channels published in its application. If You have questions about this Policy or our data practices, or are not satisfied with our response to a request, You may contact Us at the details above or lodge a complaint with the Nigeria Data Protection Commission.