Public Privacy Notice (Policy)

1. Who we are and who is responsible

Dangote Industries Limited (DIL) is the parent company of a group of affiliated and subsidiary companies operating across multiple sectors and jurisdictions. References in this Notice to “Dangote”, “we”, “us” or “our” mean DIL and, where applicable, the Dangote affiliate or subsidiary that determines why and how your personal data is processed. The Dangote entity that first collects or receives your personal data will ordinarily be the data controller for that processing. In some activities, two or more Dangote entities may jointly determine the purposes and means of processing and act as joint controllers. Other Dangote entities may process personal data on behalf of a controller and act as data processors. You may contact the Group Data Protection Officer to identify the relevant entity for a particular activity. Registered / principal office: Leadway Marble House, 1 Alfred Rewane Road, Ikoyi, Lagos, Nigeria. Data Protection Officer: Group Data Protection Officer. Email: dpo.dil@dangote.com Telephone: +234 707 470 2099 / +234 707 470 2100.

​

2. Scope and persons covered

This Notice applies to personal data processed by DIL and participating Dangote affiliates and subsidiaries in connection with their websites, mobile applications, social media pages, products, services, facilities, employment and recruitment processes, customer and supplier relationships, community and corporate social responsibility programmes, compliance activities and other business operations.
It covers employees, former employees, dependants and beneficiaries; candidates; customers and prospects; suppliers, contractors and professional advisers; shareholders and representatives of corporate counterparties; visitors; website and application users; community members; beneficiaries; complainants; and any other identifiable person whose personal data we process.
Where another jurisdiction provides a higher level of protection, the relevant Dangote entity will apply the stricter requirement to the extent required by applicable law.

3. Personal data we collect

We collect only personal data that is adequate, relevant and necessary for the stated purposes. The specific categories and data collected depends on the relationship, entity, product, service and applicable legal obligation.

4. How we collect personal data

Directly from Data Subject, including through forms, contracts, correspondence, calls, websites, applications, portals, events and in-person interactions.

•   Directly from Data Subject, including through forms, contracts, correspondence, calls, websites, applications, portals, events and in-person interactions.

•  From your employer, authorised representative, referee, guarantor, dependant, beneficiary or other person who provides information about you.

•  From Dangote affiliates and subsidiaries where sharing is lawful and necessary for group administration or the relevant business purpose.

•  From service providers, financial institutions, logistics providers, professional advisers, identity-verification providers, recruitment agencies and business partners.

•  From public authorities, courts, regulators, law-enforcement bodies and publicly available registers, websites, media and professional databases.

•  Automatically through cookies, server logs, device data, CCTV, visitor-management systems, access-control systems and similar technologies.

If you provide personal data about another person, you should have authority to do so and, where appropriate, give that person this Notice.

5. Processing purposes and lawful bases

We process personal data only for specified, explicit and lawful purposes. Depending on the activity, we may rely on one or more lawful bases under section 25 of the NDPA, including consent; pre-contract steps taken at your request or performance of a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest; or legitimate interests, where these are not overridden by your rights, interests and freedoms.

Where we rely on legitimate interests, we will assess necessity, proportionality, reasonably expected use, the likely impact on you, available safeguards and whether your rights override our interests. Where consent is required, it will be specific, informed and capable of being withdrawn as easily as it was given. Withdrawal does not affect processing already lawfully carried out.

If you do not provide data needed by law or for a contract, we may be unable to enter into or perform the relevant relationship or deliver the requested product or service. We will explain the consequence at the point of collection where appropriate.

6. Sensitive personal data

We process sensitive personal data only where permitted by the NDPA and other applicable law, and only where necessary for a stated purpose. This may include explicit consent; employment, social security or social protection obligations; protection of vital interests where a person cannot consent; legal claims; substantial public interest; health or occupational medicine under duties of confidentiality; public health; or other grounds authorised by law or the Nigeria Data Protection Commission.

We apply enhanced safeguards such as restricted access, encryption or pseudonymisation where appropriate, confidentiality duties, need-to-know handling, retention controls and documented approvals. Biometric data will not be used merely for convenience where a less intrusive means can reasonably achieve the purpose.

7. Children and persons lacking legal capacity

We do not knowingly collect children’s personal data through services directed at children unless the processing is lawful and appropriate safeguards are in place. Where consent is the lawful basis, we will obtain and verify the consent of a parent or legal guardian as required by law. We may process without such consent only where an applicable statutory exception permits it, including where necessary to protect the child’s vital interests, for education or medical purposes under appropriate safeguards, or for legal proceedings.

Notices and consent requests directed to children or vulnerable persons will use clear, age-appropriate and accessible language. We will consider the best interests of the child and avoid profiling, tracking or marketing that creates an unjustified risk.

8. Cookies and tracking technologies

Our websites, applications and digital services may use cookies, pixels, software development kits, local storage and similar technologies. Strictly necessary cookies support core functions such as security, network stability, authentication and accessibility. Other cookies, including analytics, preference and advertising cookies, will be deployed only with a valid lawful basis and, where required, your freely given, informed and specific consent.

A conspicuous cookie banner or preference tool will identify the organisation responsible, explain the categories and purposes of cookies, provide equally clear “accept” and “reject” choices for non-essential cookies, and explain how to change or withdraw consent. Non-essential cookies will remain disabled until the required choice is made. Further detail may be provided in an entity or website-specific Cookie Notice.

9. Sharing and access by third parties

We may disclose personal data only where there is a lawful purpose and appropriate safeguards. Recipients may include:

•  Dangote affiliates and subsidiaries for the purposes described in this Notice;

• service providers acting on our instructions, including technology, cloud, hosting, payroll, insurance, pension, logistics, security, verification, recruitment, communications, payment and professional-service providers;

• banks, payment networks, customers, suppliers, joint-venture partners and other counterparties where necessary for a transaction or service;

• auditors, insurers, lawyers, consultants and other professional advisers bound by confidentiality;

• courts, regulators, tax, customs, immigration, law-enforcement and other public authorities where disclosure is required or permitted by law;

• a purchaser, investor, lender or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and data protection safeguards;

• another person where you consent or direct us to disclose the data.

Processors are engaged under written data processing terms that define the subject matter, duration, nature, purpose, data types, categories of data subjects, security measures, confidentiality, assistance obligations, deletion or return of data, audit rights and restrictions on sub-processing and cross-border transfers. We do not sell personal data.

10. International and inter-company transfers

Because Dangote operates across jurisdictions and uses regional or global service providers, personal data may be transferred to or accessed from a country outside Nigeria, including by another Dangote entity. Before a transfer, the responsible entity will identify and document a lawful transfer mechanism under sections 41 to 43 of the NDPA and Article 45 and Schedule 5 of the GAID.

Depending on the circumstances, safeguards may include a determination that the recipient country, sector or organisation affords an adequate level of protection; an approved binding instrument or standard contractual clauses; an enforceable intra-group arrangement; or a statutory exception, such as explicit consent after being informed of possible risks, contract necessity, public interest, legal claims or vital interests. We will assess the effectiveness of the safeguard and apply supplementary technical or organisational measures where necessary.

11. Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, and thereafter only where a lawful retention ground applies. Retention decisions consider contractual and operational needs, legal and regulatory limitation periods, statutory recordkeeping, tax and employment obligations, claims or investigations, the amount and sensitivity of data, security risk and whether the purpose can be achieved by anonymisation.

At the end of the applicable period, personal data will be securely deleted, destroyed, anonymized, or archived with restricted access where continued retention is lawfully justified. Data collected for pre-contract due diligence where the contract does not materialise will ordinarily be securely deleted or destroyed once the relevant purpose has ended and no lawful basis for continued retention applies, unless retention is justified for legal claims or another lawful purpose. More specific periods may appear in an entity retention schedule or supplemental notice.

12. Security and privacy by design

We maintain risk-based technical and organisational measures designed to preserve the confidentiality, integrity and availability of personal data. Measures may include governance and accountability controls, data minimisation, access management, segregation of duties, encryption or pseudonymisation, network and endpoint protection, logging and monitoring, secure configuration, vulnerability management, physical security, backups, resilience, incident response, vendor due diligence, confidentiality commitments, training and periodic testing.

We apply privacy by design and by default throughout the data lifecycle. We conduct a Data Privacy Impact Assessment before processing data that is likely to result in high risk. No method of transmission or storage is completely secure, but we review safeguards in light of the nature, scope, context, purpose and risk of processing.

13. Your data protection rights

Subject to conditions and exemptions under applicable law, you may have the following rights:

These rights are not absolute. We may decline or limit a request where an exemption applies, another person’s rights would be adversely affected, or we must retain or process the data under law. We will explain the applicable reason, unless prohibited by law from doing so.

14. Exercising your rights and identity verification

Submit a request to dpo.dil@dangote.com or the privacy contact provided by the relevant Dangote entity. Describe the right you wish to exercise, the relevant relationship or service, and enough information to locate the data. We may request proportionate information to verify your identity and authority. An authorised representative may act for you where satisfactory authority and identity evidence are provided.

Requests are ordinarily handled without charge. Where a request is manifestly unfounded, repetitive or excessive, we may charge a reasonable fee reflecting the administrative cost or refuse to act, where permitted by law. We will respond within the time required by applicable law and inform you if additional time is lawfully necessary. We will make access, correction, portability and grievance channels reasonably easy to use and accessible to vulnerable data subjects.

15. Complaints and regulatory redress

If you have a privacy concern, contact the Group Data Protection Officer first at dpo.dil@dangote.com so that we can investigate and provide prompt internal remediation. You may use the Standard Notice to Address Grievance (SNAG) in Schedule 9 to the GAID or submit the same information in another clear written form. Please include your contact details, a description of the issue, relevant dates or records, the outcome sought and any previous correspondence.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission: Nigeria Data Protection Commission, Abuja, Nigeria; website: https://ndpc.gov.ng/.  You retain any right to approach a court of competent jurisdiction or pursue another remedy available under law.

16. Contact details

Appendix A. Processing schedule

This schedule provides the core information required for transparency. Entity or activity-specific notices should expand it where the processing differs materially.

Appendix B. Glossary

Appendix C. Publication and implementation checklist

•  Confirm the legal names and contact details of all participating entities and identify entity controllers.

•  Validate DPO email, telephone, postal address and ownership of the shared mailbox.

•  Map actual processing, data categories, sources, purposes, lawful bases, recipients and systems in the Record of Processing Activities.

•  Validate retention periods against legal, tax, employment, regulatory and litigation requirements.

•  List cross-border destinations and document the applicable transfer mechanism and transfer risk assessment.

•  Implement a conspicuous cookie banner and granular preference centre; block non-essential cookies before consent.

•  Publish the Notice on each relevant website, application and physical collection point in an accessible format.

•  Prepare activity-specific notices for recruitment, employees, CCTV, visitors, whistleblowing, vendors, customers, community programmes and mobile applications where needed.

•  Complete DPIAs and LIAs for activities that require them and align processor and intra-group agreements with the NDPA and GAID.

•  Implement data subject request, SNAG, breach response, complaint, training, audit and semi-annual DPO reporting workflows.

Legal sources used for this draft

•  Nigeria Data Protection Act 2023, especially sections 24 to 43.

•  Nigeria Data Protection Act General Application and Implementation Directive 2025, especially Articles 7, 15 to 19, 26 to 34, 36 to 45 and Schedules 1, 4, 5, 8 and 9.

•  Existing Dangote Group Privacy Policy draft supplied for this exercise.

•  DIL Data Protection Policy Version 2.0, November 2023, used for organisational context and existing contact information.