Privacy & cookies

At Seplat Energy Plc (“Seplat,” “the Company,” or “We”), we are committed to protecting your personal data in accordance with all applicable laws including the Nigeria Data Protection Act (NDPA), 2023, the Nigeria Data Protection Act – General Application and Implementation Directive (GAID), 2025 and the United Kingdom General Data Protection Regulation (GDPR). They are collectively referred to as the “Regulations” or “Laws.”

Overview

This Privacy Notice provides information on how Seplat Energy collects and processes your personal data when you visit our website. It sets out what we do with your personal data and how we keep it secure and explains the rights that you have in relation to your personal data.

Nature of Personal Data We Collect and Process

The Company collects the following personal information directly from you when you subscribe to email alerts within the Investors Centre of this website for you to receive news and other financial information:
•    contact details such as your full name (first name and last name), email addresses
•    profession, company;
•    country.

Seplat Energy will not share your information with any third parties beyond Euroland or use it to send you unsolicited communications. Please refer to Euroland’s Privacy Policy.
By voluntarily submitting the personal information, you consent to the processing of your personal information for the purpose stated above

Cookies

A cookie is a small text file that is stored on your computer or mobile device when you visit a website. Seplat Energy uses these to make a user’s experience more efficient. Cookies enable us to distinguish you from other users of our website, which helps us to provide you with an improved browsing experience.

The law states that we can store cookies on your device if they are strictly necessary for the operation of the site. For all other types of cookies, we need your permission. On this website we use persistent cookies (necessary for the functioning of the site), performance cookies (to enable Google Analytics to analyze how users interact with our site) and customization cookies (to record your preference within the investor section of the website). 

Details of the cookies used on our website are provided below:

Persistent or Necessary (2 cookies)

Performance cookies (3)

Your consent to the use of cookies applies to www.seplatenergy.com

You can view and change your cookie settings at any time.

Third Party Website Links

We may direct you to third-party websites from content within our site. Linked sites will have their own cookie notices which we advise you to review to understand their cookie policy. Please note that Seplat Energy Plc cannot be held responsible for the content of linked websites, any use of these sites, or the cookie and privacy practices of these websites.

Read Google Analytics https://policies.google.com/privacy?hl=en and Clarity https://clarity.microsoft.com/terms privacy policies for more information

Do Not Track (DNT) browser setting

DNT is a feature offered by some browsers which, when enabled, sends a signal to websites to request that your browsing is not tracked, such as by third party advertising networks, social networks, and analytics companies. This website does not currently respond to DNT requests, however, you may opt-out of tracking on this website, including analytics, by following the instructions to opt-out of cookies above. A uniform standard has not yet been adopted to determine how DNT requests should be interpreted and what actions should be taken by websites and third parties. We will continue to review DNT and other new technologies and may adopt a DNT standard in the future.

Consent

By using our website, you consent to the processing of your personal information as described in this Privacy notice. You can withdraw your consent at any time, but such withdrawal will not affect the lawfulness of processing based on consent given before its withdrawal.

Use and Legal Basis for processing your Personal Data

We are committed to ensuring that your personal data is processed lawfully, fairly, and transparently in accordance with applicable data protection laws. We collect personal information directly from you when you subscribe to email alerts within the Investors Centre of this website for you to receive news and other financial information. We may also process your Personal Data to comply with provisions of applicable laws. The lawful basis for which we process your personal data, are outlined below:

Consent

Where you have provided your explicit consent, we may process your personal data for specific purposes such as:

•    Sending you news and other financial information through email alerts.
•    Using cookies or other tracking technologies for personalization and analytics.

You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Compliance with Legal and Regulatory Obligations

We may process your personal data where required to comply with applicable laws, regulations, or directives. This includes:

•    Verifying your identity or carrying out due diligence where necessary.
•    Responding to lawful requests from public authorities or regulators.

Legitimate interests

We may process your personal data where it is necessary for our legitimate business interests or those of a third party, provided that such interests are not overridden by your fundamental rights and freedoms. Examples include:

•    Improving our website functionalities.
•    Preventing, detecting, and managing risks relating to fraud, misuse, or illegal activities.
•    Enhancing user experience and service quality through feedback and analytics.

Protection of Vital Interests

We may process your personal data where necessary to protect your vital interests or those of another natural person. For example, in situations involving potential harm, safety incidents, or emergencies.

Public Interest

Where applicable, we may process personal data for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company.

Principles for Data Processing

Seplat will adhere to the following principles of Data Protection which require that personal information:

1. shall be processed in a fair, transparent, and lawful manner;
2. shall be adequate, relevant, and not excessive in relation to the purposes for which such information is required by the Company;
3. shall be accurate and, where necessary, kept up to date;
4. shall not be kept for longer than is necessary;
5. shall be kept secure by the Data Controller who takes appropriate technical and other measures to prevent unauthorized or unlawful processing or accidental loss or destruction of, or damage to, personal information;
6. shall not be transferred to a country or territory outside Nigeria, UK, the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of individuals in relation to the processing of personal information.

Disclosure of Personal Data

“Disclosing” personal data means processing, giving access to, or sharing the information or certain elements of it with people or organizations. Seplat would disclose Personal Data to Euroland and may disclose Personal Data to other Seplat group companies, for legitimate business purposes in accordance with applicable data law.

Where the Company engages a third-party Processor to Process Personal Data, the Processor will be subject to binding contractual obligations to:

1. Process personal data only on the documented instructions of the company, including with regard to international data transfers, unless required to do otherwise by law.
2. Ensure that all personnel authorized to process personal data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
   1. Encryption and pseudonymization of personal data.
   2. Obtain Cyber security certifications
   3. Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
   4. Measures to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
   5. Regular testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of processing.
4. Assist the company, as far as possible, in fulfilling its obligation to respond to requests for exercising the data subject's rights, such as access, rectification, erasure, and objection.
5. Assist the company in ensuring compliance with obligations regarding:
   1. Data security. 
   2. Data breach notification to supervisory authorities and data subjects. 
   3. Data protection impact assessments (DPIAs). 
   4. Prior consultation with supervisory authorities where required. 
6. Notify the company without undue delay after becoming aware of a personal data breach.
7. Obtain the company’s prior specific or general written authorization before engaging any sub-processors. Ensure that sub-processors are subject to the same data protection obligations in their contracts.
8. Remain fully liable to the company for the performance of the sub-processor’s obligations if the sub-processor fails to fulfill its data protection duties.
9. At the choice of the company, delete or return all personal data to the company after the end of the provision of services relating to processing, and delete existing copies unless required by law to retain the data.
10. Make available to the company all information necessary to demonstrate compliance with the obligations and allow for and contribute to audits, including inspections, conducted by the company or another auditor mandated by the company.
11. Maintain records of processing activities and compliance with obligations under the data protection agreement and relevant laws.

If personal data is shared with a third party or a Seplat Energy affiliate outside Nigeria, the conditions regarding data transfers (see section Third Parties and International Data Transfers below) apply in addition to the requirements of this section.

Children

Whilst this site does not contain explicit or sensitive content, it is not intended for children under the age of 16. Seplat Energy does not knowingly collect personal information from or about any person under the age of 16. If you are under 16 years old and wish to contact us, please get your parent or guardian to do so on your behalf.

Third Parties and International Data Transfers

Due to the international nature of Seplat’s business, Seplat may need to transfer Personal Data to other entities within the Seplat group, and/or to third parties, in connection with the purposes set out in this Notice. For this reason, Seplat may transfer Personal Data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which the Individual is located. The Seplat affiliates which receive the personal data from the data controller identified, may in turn process the personal data they have received either as (i.) subsequent data controllers, or (ii.) they may only act upon instruction of the affiliates in Nigeria (in the role of data processors), as the case may be.

Where Seplat makes a transfer of Personal Data to recipients located outside Nigeria, UK, or the EEA/regions who are not in Adequate Jurisdictions, such is done on the basis of Standard Contractual Clauses, the Individual may request a copy of Seplat’s Standard Contractual Clauses using the contact details provided below.

Accuracy of Data

Seplat takes every reasonable step to ensure that:

1. Personal Data Processed by Seplat are accurate and, where necessary, kept up to date; and
2. any of an Individual’s personal data Processed that are inaccurate (having regard to the purposes for which they are Processed) are erased or rectified without delay.

From time-to-time Seplat may ask an Individual to confirm the accuracy of his/her Personal Data.

Data Security and Confidentiality

Seplat has implemented appropriate technical and organizational security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other unlawful or unauthorized forms of Processing, in accordance with applicable law.

As described in Section Third Parties and International Data Transfers, third party data processors may process personal data only if they agree by contract to binding security and confidentiality safeguards. 

Records Retention

Seplat Energy retains personal data to meet the purposes for which the data was collected or in order to ensure compliance with applicable law or to meet other legitimate purposes. In particular, the applicable retention periods are defined in the company Retention Schedule, or other periods if required under applicable national law.

We have assessed the data processing according to requirements and obligations of the applicable laws and verified that the processing does not disproportionately and negatively impact your fundamental rights and freedoms.

What are Your Rights in relation to our Collection and Processing of your Personal Data 

Users of our Site are entitled to exercise the following rights in relation to their personal data collected and processed by the Company:

• the right to withdraw consent to the processing of the personal information;
• the right to know whether personal information is being processed;
• the right to know and see what personal information is processed;
• the right to know purpose(s) of the processing personal information;
• the right to obtain a copy of personal information processed in a commonly used electronic format
• the right to have inaccurate personal information corrected or deleted;  
• the right to know the recipients or categories of recipient to whom the personal information have been or will be disclosed, particularly recipients in third countries or international organizations; 
• the right to know the period for which the personal data will be stored or the criteria used to determine that period;
• the right to request for erasure of personal information; 
• the right to request for restriction of processing of personal information; 
• the right to object to processing of personal information; 
• the right to lodge a complaint with the Commission; 
• the right to know the source of personal information processed, where the personal data is not collected from the data subject; 
• the right to request the transmission of data from the Company to a third party (right to the portability of data); 
• the right to object to direct marketing; 
• the right to be informed on the existence of automated decision-making, including profiling, the significance and envisaged consequences for the data subject and the right to:
  • obtain human intervention on the part of the data controller;
  • express their point of view ; and  
  • contest the decision.

Review of our Privacy Notice

We may need to review and make necessary updates, modifications, or amendments to our Privacy Notice to ensure compliance with applicable data protection legislations including the NDP Act/GAID or as a result of changes in our systems and processes arising from the use of technology. Your continuous use of our services after such notice will be construed as your consent to carry on with the processing of your personal data. To opt out of continued processing of your personal data after such notice, please complete the Modify or Unsubscribe Section of the Email Alerts form. 

Data Controller / Data Processor

The data controller in respect of personal data is Seplat Energy Plc. The data processor  in respect of personal data is Euroland.

Data Protection Officer 

In the event that you have any questions, inquiries or complaints relating to the collection and processing of your personal data on our Site or the exercise of your rights as a data subject under the NDP Act/GAID, please send an email to our DPO via email at [email protected]

Privacy notice review and effective date: 11th November 2026