Legal

Privacy Policy

Effective date: 15 October 2026·

1. Who we are

Africa Energies Report (“AER”) is an energy intelligence initiative of the Africa Energy Investment Corporation (AEICORP), Société Africaine d’Investissement en Énergie, and the African Petroleum Producers’ Organization (APPO). AER is published and operated by AEICORP (“AEICORP”, “we”, “us” or “our”).

AEICORP is the data controller for the personal data described in this policy. This means we decide why and how your personal data is processed and are responsible for protecting it.

Address: Lotissement 332, Quartier Zongo Mifongou, 5e Arrondissement de Cotonou, Immeuble Espace Antou, Republic of Benin
Data Protection Officer: [email protected]
General enquiries: [email protected] · +229 01 61 27 07 07

2. Scope of this policy

This Privacy Policy applies to personal data we process when you:

visit the Africa Energies Report website at africaenergiesreport.com (the “Website”);
use the Africa Energies Report data platform at app.africaenergiesreport.com, including its dashboards, country profiles, exports, AI reports and alerts (the “App”);
subscribe to our newsletter, create an account, buy a subscription or enter into an Organization agreement;
contact us, attend or register for our events, or otherwise deal with us in connection with AER.

The Website and the App are together the “Services”. This policy does not cover third-party websites linked from the Services, which have their own policies.

We process personal data in line with the Digital Code of the Republic of Benin (Law No. 2017-20, Book V) and, where they apply to you, other data protection laws including the Nigeria Data Protection Act 2023, South Africa’s Protection of Personal Information Act 2013, Kenya’s Data Protection Act 2019, Ghana’s Data Protection Act 2012, Egypt’s Personal Data Protection Law No. 151 of 2020, and the EU and UK General Data Protection Regulation (together, “Data Protection Laws”).

Nothing in this policy waives or limits any privilege or immunity AEICORP enjoys as an intergovernmental financial institution.

3. Personal data we collect

We collect only what we need to provide and improve the Services.

Category	What it includes	Source
Identity and contact data	Name, email address, organization, job title, country, phone number (if provided)	You
Account data	Login email, encrypted password, user category (Research and Academic, Professional or Industry, Government and Policy), account preferences, language	You
Subscription and billing data	Plan, billing period, transaction references, amounts, billing name and address, invoice records, payment status	You and our payment processors
Usage data	Dashboards and countries viewed, filters applied, saved views, exports generated, AI reports requested, alert subscriptions, download history	Generated by your use of the App
Content you submit	Messages through the contact form, prompts or parameters for AI reports, feedback, event registrations	You
Technical data	IP address, device and browser type, operating system, approximate location derived from IP, referring pages, time stamps, error logs	Collected automatically, including through cookies
Communications data	Newsletter subscription status, email opens and clicks, records of correspondence with us	You and our email tools
Organization plan data	Names and work contact details of the client organization’s contacts and authorised users, contract and invoicing details	The client organization and you

Payment card data. Payments are processed by PayPal and Flutterwave. Your card, bank or mobile money details are entered directly with those providers. We do not receive or store full card numbers or security codes.

Sensitive data. We do not ask for, and ask you not to submit, sensitive personal data such as health information, religious or political beliefs, or biometric data. Please do not include such data in contact messages or AI report prompts.

4. How we use your personal data and our legal bases

We use personal data only for the purposes below. For each, we rely on a lawful basis recognised by Data Protection Laws.

Purpose	Examples	Legal basis
Provide the Services	Create and manage your account, apply your plan’s access level, save views, deliver exports and AI reports, send alerts you have chosen	Performance of a contract with you
Process payments and manage subscriptions	Take payment, renew or cancel subscriptions, issue invoices, handle refunds	Performance of a contract; legal obligation (tax and accounting)
Protect licensed content	Apply a watermark identifying the account to each export; detect unauthorised redistribution, scraping or account sharing	Legitimate interests in protecting our data, our licensors and paying users
Respond to you	Answer enquiries, provide support, prepare Organization quotes	Legitimate interests; steps at your request before entering a contract
Send newsletters and marketing	Newsletters, report announcements, event invitations	Your consent, which you can withdraw at any time; for existing customers, legitimate interests where the law permits, with an easy opt-out
Service communications	Security notices, billing notices, changes to terms or policies	Performance of a contract; legal obligation
Improve the Services	Analyse aggregated usage to decide which data, sectors and features to develop	Legitimate interests; consent where analytics cookies are used
Security and integrity	Prevent fraud, abuse and attacks; keep logs; enforce our Terms	Legitimate interests; legal obligation
Legal compliance	Keep accounting records, respond to lawful requests, establish or defend legal claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights and concluded that the processing is proportionate. You may object to it at any time (see section 11).

5. AI-generated reports

The App offers AI reports that summarise and analyse AER datasets. When you request an AI report:

the request parameters you choose (for example sector, countries and years), any text you enter, and the relevant AER data are sent to a third-party AI model provider that processes them on our behalf to generate the report;
the provider is contractually bound to use this content only to provide the service to us, to keep it confidential, and not to use it to train its models;
we keep a record of the reports you generate so that you can access them again and so that we can apply your plan’s monthly limit.

Please do not include personal data about yourself or others in AI report prompts. AI reports are generated automatically and may contain errors (see our Terms and Conditions). They are not used to make decisions about you.

6. Export watermarking

Every export from the App carries a watermark identifying the account it was generated from. This protects the integrity of AER data and supports the licence terms that apply to each plan. The watermark may include your account name, organization or an account identifier. If an export is shared outside the terms of your licence, the watermark allows us to identify its origin.

7. Who we share personal data with

We do not sell or rent personal data. We share it only as follows:

Service providers acting on our instructions, under written agreements requiring confidentiality and security: the technical operator that builds, hosts and maintains the Services; hosting and infrastructure providers (including Vercel and our Website host); payment processors (PayPal and Flutterwave), which act as independent controllers for the payment data they handle under their own privacy policies; email and newsletter providers; analytics providers (where you have consented); the AI model provider used for AI reports; and customer support tools.
Our Data Consultant, which sources and validates AER data and analysis, only to the extent it needs personal data to respond to data enquiries or corrections you raise.
APPO and AEICORP governance bodies, in aggregated or anonymised form only (for example total user numbers by sector or region), unless you have agreed otherwise.
Your organization, if you use the Services under an Organization plan: the organization’s administrator may see which authorised users hold access and their usage of the licence.
Professional advisers, such as auditors, lawyers and insurers, under duties of confidentiality.
Authorities and others where required by law, to comply with a legal obligation, a court order or a lawful request, or to protect the rights, property or safety of AEICORP, our users or others.
A successor body, if responsibility for AER is transferred to another entity, in which case this policy, or one offering equivalent protection, will continue to apply.

8. International transfers

AEICORP is based in Benin, and our users and service providers are located across Africa and worldwide. Some of our providers, including hosting and payment providers, process data in other countries, including the United States and the European Union.

When we transfer personal data outside the country where it was collected, we make sure it is protected to the standard required by Data Protection Laws. Safeguards include transfers to countries recognised as providing adequate protection, standard contractual clauses approved by the relevant authority, contractual commitments from the recipient, and, where required, authorisation from or notification to the competent authority. You may request a copy of the relevant safeguards by contacting our Data Protection Officer.

9. How long we keep personal data

We keep personal data only as long as needed for the purposes in section 4, then delete or anonymise it.

Data	Retention period
Account data and saved views	For as long as your account is active; deleted within 90 days of account closure, except as below
Subscription, billing and invoice records	10 years from the end of the financial year, to meet accounting and tax obligations
AI report and export history, including watermark records	Life of the account plus 24 months, to protect licensed content and resolve disputes
Contact form and support correspondence	24 months from the last exchange
Newsletter subscription data	Until you unsubscribe; a suppression record is kept so we do not email you again
Technical and security logs	Up to 12 months, unless needed to investigate an incident
Analytics data	Up to 26 months, in aggregated or pseudonymised form
Inactive free accounts	Closed after 36 months without login, after 30 days’ email notice

We may keep data longer where needed to establish, exercise or defend legal claims, or where the law requires it.

10. How we protect personal data

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS) and of passwords at rest, role-based access controls with the principle of least privilege, multi-factor authentication for administrative access, regular backups, vulnerability management and monitoring, and confidentiality obligations for all staff and providers with access.

No online service can be guaranteed fully secure. Please use a strong, unique password and keep it confidential. If we become aware of a personal data breach likely to affect your rights, we will notify you and the competent authorities as Data Protection Laws require.

11. Your rights

Subject to the conditions and exceptions in the Data Protection Laws that apply to you, you have the right to:

Access the personal data we hold about you and receive a copy;
Rectify inaccurate or incomplete data (you can update most account details yourself in the App);
Erase your data, including by closing your account;
Restrict our processing in certain circumstances;
Object to processing based on legitimate interests, and to direct marketing at any time;
Data portability, receiving data you provided in a structured, machine-readable format;
Withdraw consent at any time, without affecting earlier processing;
Not be subject to decisions based solely on automated processing that significantly affect you (we do not make such decisions);
Lodge a complaint with a supervisory authority (see section 16).

To exercise your rights, email [email protected] from the address linked to your account, or write to us at the address in section 1. We may ask you to verify your identity. We respond within one month, extendable where the law allows for complex requests, in which case we will tell you why. Exercising your rights is free unless a request is manifestly unfounded or excessive.

12. Marketing communications

We send newsletters and marketing emails only where you have opted in or where the law otherwise permits. Every message includes an unsubscribe link. You can also manage preferences in your account settings or by emailing [email protected]. Service communications about your account, billing or changes to our terms are not marketing and will still be sent while you hold an account.

13. Children

The Services are designed for professionals, researchers and institutions and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Third-party links

The Services link to third-party websites, including news sources, partners and social media. We are not responsible for their privacy practices and encourage you to read their policies.

15. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date shows when it was last changed. We will notify registered users by email or through the App at least 30 days before any material change takes effect, unless an earlier change is required by law.

16. Contact and complaints

If you have a question or concern about how we handle personal data, please contact our Data Protection Officer first at [email protected], or by post at: Data Protection Officer, Africa Energies Report, AEICORP, Lotissement 332, Quartier Zongo Mifongou, 5e Arrondissement de Cotonou, Immeuble Espace Antou, Republic of Benin.

You also have the right to complain to a supervisory authority, in particular in the country where you live or work or where an alleged breach occurred. These include the Autorité de Protection des Données Personnelles (APDP) in Benin, the Nigeria Data Protection Commission, the Information Regulator of South Africa, the Office of the Data Protection Commissioner in Kenya, the Data Protection Commission of Ghana, the Personal Data Protection Center in Egypt, and the data protection authority of your EU Member State or the UK Information Commissioner’s Office.