Privacy Notice

This notice explains how Arnen Technologies Limited ("Gen318", "we", "us") handles personal data. It covers the website at gen318.com, the Gen318 platform at app.gen318.com (the operator console, the technician app and the API), and the Gen318 edge node installed at customer sites.

We wrote it to describe what our software actually does. Where something is switched off by default, we say so.

1. Who we are

Arnen Technologies Limited is a private company incorporated in Nigeria (RC 9839547). We trade as Gen318.

• Registered office: No. 6 Lawrence Ayodele Street, Arab Road, Kubwa, Federal Capital Territory, Nigeria.
• Privacy contact: privacy@gen318.com

2. Our two roles

We handle personal data in two different capacities. The difference matters for who you should contact.

Some data sits in both columns. For example, a user's name and email is processed for our customer (so their team can work together) and by us as controller (to secure the login and to administer the account).

3. Personal data we handle

3.1 As controller

Website visitors (gen318.com)

• The website sets no cookies.
• If you turn analytics off, your browser stores that choice in local storage on your device. It is not sent to us.
• Privacy-friendly analytics (see section 7) run by default and can be turned off.
• Our hosting provider, Cloudflare, processes your IP address and request details to deliver the site, and keeps request logs for a limited period.

Enquiry forms (contact, demo and fleet-assessment forms)

• What you type: name, email, company, portfolio type, number of sites, equipment, message, and whether you are a DARES grantee.
• What the form service records automatically: your IP address, browser user-agent and country.
• Unless you turned analytics off, the campaign label you arrived from (for example the name of an outreach campaign) may be attached to your enquiry. Labels are held in your browser's memory for up to 30 minutes and are cleared when you reload or close the page.
• Please do not send passwords, API keys or confidential site records through these forms.

Business contacts and partners

• Names, job titles, work email addresses, phone numbers and professional profile links of people at prospective customers, partners, funders and institutions.
• Our correspondence and notes of meetings.
• Sources: you, your organisation, and public sources such as company websites and professional networks.

Platform account and security data

• Name, work email, phone number (optional), role, and organisation.
• Password hash (Argon2id; we never store the password itself), multi-factor authentication secrets and recovery codes.
• Session records: IP address and browser user-agent for active sessions and for password-reset requests.
• An append-only audit log of security-relevant and administrative actions, including IP address and user-agent.
• Consent records and records of data-protection requests.

3.2 As processor, on our customers' behalf

Customer users and stakeholders

• Name, email, phone number, role, notification preferences (email, SMS, push), and a record of notifications sent.

Technicians

• Name, phone number, email, state and local government area, a location point, certifications (including NAPTIN certificate number where provided), skills, availability, and work-performance figures the platform calculates (quality score, first-visit resolution rate, average completion time, jobs completed).
• GPS position at job check-in and check-out, captured by the technician app with the browser's location permission.
• Work-order photos. We strip EXIF metadata from photos when they are uploaded; the platform may store a separate latitude and longitude with the photo.

Site and operating data

• Site names, locations and configuration; equipment records; telemetry readings (solar, battery, inverter, meter, grid and generator measurements); alerts; work orders and maintenance notes; reports.
• Telemetry is about equipment, not people. Some of it can still relate to a person: for example, a smart meter reading linked to one household or business. Metering integrations can bring in meter and customer identifiers from the metering system.
• Credentials for the customer's equipment-vendor accounts (for example a monitoring-API token). These are encrypted at rest.

We do not ask for, and the platform is not designed to hold, sensitive personal data such as health, religious or biometric data. The platform has no fields for national identity numbers, BVNs or bank details.

4. Where the data comes from

• From you, when you fill in a form, write to us, or use the platform.
• From your organisation, when an administrator invites you or adds you as a technician or stakeholder.
• From equipment at the site, through a Gen318 edge node or a direct device connection.
• From third-party monitoring and metering platforms that hold data about the customer's equipment, such as Victron Energy (VRM), SparkMeter, Huawei FusionSolar and Growatt. We connect to one of these only with credentials or an authorisation that the customer provides as the system owner or with the system owner's permission. The system owner can withdraw that authorisation through the vendor at any time, and we then stop receiving the data.
• From public sources, for business contacts (section 3.1).

5. Why we use personal data, and our lawful basis

The Nigeria Data Protection Act 2023 (NDPA) and, where it applies, the EU General Data Protection Regulation (GDPR) require a lawful basis for each use. As processor, the lawful basis is our customer's to establish; we process only on their instructions.

We do not sell personal data. We do not use customer operating data for advertising.

The platform has three features that combine data across customers: publication in the Gen318 Annual Index, an anonymised parts-demand signal, and a reserved research-corpus setting with no live product. Each is off unless the customer opts in. The platform's prediction and forecasting models are fitted using data held in the platform; outside those opt-in features, we do not show one customer's data to another customer.

6. Automated processing

The platform raises alerts, predicts equipment failures and suggests maintenance and diesel dispatch. These are about equipment.

Some features score technicians from their job records (for example a quality score) and use those scores, with skills, availability and location, to recommend or automatically assign technicians to work orders. The customer's staff can change any assignment. If you are a technician and want a person to review an assignment or a score, ask the organisation you work for, or write to us and we will pass your request on.

AI features that send data to an external language-model provider are switched off by default. They include the operations copilot and optional AI text generation for alerts, notes and fleet briefs; by default these use built-in rules, not an external model. If a customer enables one, the provider receives the data needed to answer the request. See section 8.

7. Cookies, local storage and analytics

gen318.com

• No cookies.
• One local-storage entry (gen318.analytics.v1) records your analytics choice, if you make one.
• Plausible Analytics runs by default. It sets no cookies. It records page visits, clicks on selected links, and confirmed enquiries. We send approved campaign labels, never your name, email or message. Your browser sends Plausible your IP address and user-agent as part of the request; we add no visitor identifier.
• If your browser sends a Do Not Track or Global Privacy Control signal, analytics stay off.
• You can turn analytics off (or back on) with the "Analytics preferences" control on the contact page.

app.gen318.com

• Two strictly necessary cookies keep you signed in safely: gen318_refresh (an httpOnly session refresh token) and __Host-gen318_csrf (protects the refresh request). The console keeps its short-lived access token in memory, not on disk.
• The technician app stores a 15-minute access token in local storage so it can reopen without a signal at remote sites.
• The platform uses no advertising or analytics cookies.
• The console's fleet map loads its basemap (roads, boundaries, place names) from OpenFreeMap. Your browser requests those map tiles directly, so OpenFreeMap receives the request, including your IP address and user-agent and the map area being viewed. It sets no cookies.

8. Who receives personal data

We share personal data only as described here.

8.1 Service providers

Our providers are bound to confidentiality and security obligations through their service terms. We will update this list when we add a provider that handles personal data.

8.2 Recipients our customers choose

The platform can send data to places a customer configures. We send these only on the customer's instruction:

• regulatory and programme submissions, for example compliance reports to Odyssey Energy Solutions for the DARES programme (automatic submission is off by default);
• the customer's own systems, through signed webhooks or the partner data API;
• share links for reports, which the customer creates, which expire within 30 days and which can be revoked; and
• notifications to people the customer adds.

8.3 Others

• Authorities, courts or regulators, where the law requires it.
• A buyer or successor of our business, under the same protections as this notice.
• Professional advisers (lawyers, auditors) under a duty of confidentiality.

9. International transfers

We are a Nigerian company. Our platform servers are in Germany, so platform data leaves Nigeria. Some providers in section 8 operate in other countries, including the United States.

We transfer personal data outside Nigeria only as the NDPA permits. You can ask us about the safeguards that apply to a transfer by writing to privacy@gen318.com.

10. How long we keep data

When a customer leaves. A customer's account deletion has a 30-day grace period. After that, the platform deletes the customer's data across the platform. Deleted data rolls out of backups as the backup copies expire, which takes up to 6 months.

When one person asks to be erased. The platform anonymises that person's user record rather than deleting the row, so that the records it is attached to (for example a closed work order) stay intact without identifying them.

11. How we protect data

Measures that are built and running:

• Each customer's data is separated by database row-level security. The application refuses to start if its database connection could bypass that separation.
• Passwords hashed with Argon2id and checked against known-breached passwords.
• Multi-factor authentication (TOTP) with single-use recovery codes. Re-authentication is required before changing stored credentials.
• Session refresh tokens held only in httpOnly cookies, with CSRF protection.
• AES-256-GCM encryption of equipment-vendor credentials and other selected fields, with key rotation.
• An append-only audit log.
• Work-order photos validated and stripped of EXIF metadata; files are never public and are served through short-lived signed links.
• Encrypted off-site backups with a rehearsed restore.
• Blocking dependency, code and secret scanning in our build pipeline; signed container images verified before deployment.

What we have not done yet, stated plainly:

• No independent penetration test and no third-party certification (such as ISO 27001 or SOC 2).
• User email addresses and phone numbers are stored without field-level encryption (they are protected by the measures above).

12. Your rights

Under the NDPA (and the GDPR where it applies) you can ask to:

• access your personal data and receive a copy;
• correct inaccurate data;
• erase your data;
• restrict or object to our processing, including objecting to business-development contact at any time;
• receive your data in a portable format;
• withdraw consent, where we rely on consent, without affecting what happened before, and turn off website analytics at any time;
• not be subject to a decision based solely on automated processing that significantly affects you; and
• complain to the Nigeria Data Protection Commission (NDPC) or, in the EU, to your local supervisory authority.

How to exercise them.

• Platform users can export their own data, and erase their own personal data, in the console under Settings → Privacy. Owners and administrators can also erase the data of a person in their own organisation there.
• Anyone can email privacy@gen318.com. We may need to verify your identity.
• If your data is in the platform because of your employer or your electricity provider, that organisation is the controller. You can contact them, or contact us and we will pass your request on.

We will respond within 30 days of receiving your request.

The last owner of a customer account cannot erase themselves through self-service; the customer's account deletion process applies instead.

13. Personal data breaches

If a breach affects personal data for which we are controller, we will notify the NDPC within 72 hours of becoming aware of it, and tell affected people without undue delay where the risk to them is high. We keep a register of every breach, reportable or not.

Where we are processor, we will notify the affected customer without undue delay, and within 72 hours of confirming the breach, so that they can meet their own obligations.

14. Children

Gen318 is a business service. It is not directed at children, and we do not knowingly collect children's data. A metering record linked to a household may relate to a family that includes children; that data is handled for our customer as processor.

15. Changes to this notice

We will post any change on this page with a new date. If a change materially affects how we use personal data, we will also tell platform customers by email or in the platform before it takes effect.

16. Contact

Arnen Technologies Limited (RC 9839547), trading as Gen318, No. 6 Lawrence Ayodele Street, Arab Road, Kubwa, Federal Capital Territory, Nigeria.

• Privacy: privacy@gen318.com
• Security reports: security@gen318.com