Privacy notice

Last updated: 3 September 2025
‍
This Privacy Notice explains in full how Lumia Energy (Zambia) Limited (“Lumia”, “we”, “us”, “our”) collects, uses, shares and protects personal data in connection with our websites and forms (including the Aurora Residential one-minute application), our customer communications, and our operated solar and storage services covering design, installation, commissioning, telemetry, billing, export settlement, maintenance and end-of-term activities. By using our websites, submitting an application, interacting with our teams or receiving our services, you acknowledge that you have read and understood this Notice. Where we require consent (for example, for non-essential cookies or certain marketing), we will ask for it explicitly and you can withdraw it at any time.

For Aurora sites in Zambia, the data controller is Lumia Energy Limited (Zambia). Where we process the personal data of Tanzanian residents or operate in Tanzania, the Tanzanian regime applies in parallel. Because our websites receive visits from the UK and the EEA, we also apply GDPR/UK GDPR standards to web users where those laws are engaged. We use carefully selected service providers—installation contractors, O&M partners, cloud platforms, analytics vendors, payment processors and KYC/AML tools—who act as our processors under contract and only on our documented instructions, subject to confidentiality, minimum security, and deletion/return obligations. In limited cases we may process a small subset of personal data for a financing special purpose vehicle (SPV), a development finance institution (DFI) or a utility on their instructions; where that happens we do so under a separate data processing agreement and they act as an independent controller for those narrow purposes.

We collect only the data needed to assess eligibility, install and operate systems safely, meet interconnection requirements, calculate invoices and export credits, provide support, and improve reliability. This includes identity and contact details (name, email, phone, property address, landlord consent if you are a tenant, and national ID only where required for KYC/AML or utility interconnection); premises and technical information (photos and drawings you upload, roof, structure and distribution board details, GPS coordinates, meter class and utility account numbers, safe access instructions); usage and telemetry from devices (interval import/export kWh, voltage, current, frequency and power-quality metrics, inverter/battery event logs, device health, alarms and measured availability); billing and payment information (plan and tenure, invoices, payment status and transaction references—we do not store full card numbers); and support and operations records (messages, call notes, work orders, survey reports, maintenance logs and fault tickets). We also collect standard website and app data such as IP address, device and browser information and cookie identifiers as surfaced in our cookie banner. We do not intentionally collect special category data (for example, health or religion) and ask that you do not share it with us; if such information is inadvertently provided (for example, within a support message), we minimise it and delete or redact where feasible.

We use personal data primarily to provide and support the service under our contract with you: to perform eligibility checks, schedule and conduct surveys, design, install and commission the system, integrate metering, operate and maintain equipment, monitor performance, settle exports with the utility, issue invoices, apply export credits to your account, and manage renewals, upgrades or buy-outs at the end of term. We also process data to comply with legal and regulatory obligations (including KYC/AML where required by law, by a utility, by a financing partner or by our risk policies; safety notices; incident reporting; and record-keeping), and to pursue our legitimate interests, which include operating, monitoring and improving reliability, delivering SLA-backed availability, detecting faults proactively, scheduling maintenance efficiently, forecasting energy production and consumption across our fleet, planning inventory and supply chains, improving designs and pricing, defending legal claims, preventing fraud and misuse, securing our infrastructure and managing business continuity. We send essential service communications without consent (for example, an outage or safety update) and send marketing only with consent where consent is required; you can opt out at any time and we will respect that choice. We do not engage in automated decision-making that produces legal or similarly significant effects about you; if we ever propose to do so, we will explain the logic involved, potential consequences and your rights before we begin.

Smart-meter and device telemetry is essential to the service. Interval consumption and export, power-quality measurements and device health are used to bill accurately, calculate availability for service-level purposes, schedule maintenance, confirm export revenue received from the utility and apply export credits correctly. For households we do not use interval data to infer sensitive characteristics or for unrelated profiling. You may request a consumer-grade view of your usage and export data, subject to reasonable identity checks, and we will provide it in a commonly used format where feasible.

We obtain personal data directly from you via forms, emails, calls, messaging applications and on-site visits; from your premises during survey and commissioning; from devices such as meters, inverters, batteries and gateways; and from third parties where lawful, including utilities, installers, KYC/AML providers, payment processors, credit reference agencies and financing partners. Where we receive personal data from third parties for verification, we use it only for the intended purpose and retain it no longer than necessary.

We share personal data only where necessary and proportionate, under contract, and with safeguards in place. This includes installation and O&M partners for surveys, works and repairs; utilities and regulators for interconnection, metering, export settlements and safety reporting; payment and billing providers to process transactions and manage accounts; cloud hosting, communications and analytics providers to operate our systems; insurers and loss adjusters for claims; financing partners, SPVs and DFIs under confidentiality to verify performance, receivables and security interests; and law enforcement or regulators where legally required or to protect rights, safety or the grid. We do not sell personal data under any definition. Where a supplier proposes to appoint a sub-processor, we require them to impose the same data protection, confidentiality and security obligations that we impose on them and to remain fully liable to us for the acts and omissions of those sub-processors.

Your personal data may be processed or stored outside your country (for example, in secure cloud regions). Where we transfer personal data internationally we implement appropriate safeguards, such as standard contractual clauses (or equivalent instruments), transfer risk assessments, encryption in transit and at rest, strict access controls, multi-factor authentication, logging and monitoring, and data minimisation. Where a local law could compel disclosure that conflicts with our obligations, we will challenge overbroad or unlawful requests and, where permitted, notify you. You may request a summary of the transfer safeguards relevant to your data, recognising that we will withhold security-sensitive details.

We apply layered security appropriate to energy infrastructure and the sensitivity of the data: network segmentation; encryption in transit and at rest; least-privilege, role-based access and multi-factor authentication; secrets management and key rotation; change control; vulnerability management and patching; logging and continuous monitoring; incident response plans and staff training; and physical controls for plant rooms, rooftops and equipment cabinets. We conduct vendor due diligence before onboarding service providers and require contractual security commitments, breach notification without undue delay, cooperation on incident management, and timely deletion or return of data at the end of the relationship. No system is perfectly secure; if you believe your account or our systems have been compromised, please contact security@lumia-energy.com immediately. Where a personal data breach presents a risk to individuals, we will notify affected users and relevant regulators without undue delay as the law requires.

We retain personal data only as long as needed for the purposes set out in this Notice or as required by law. Applicants who do not proceed are typically retained for up to twelve months from last activity to support re-application and audit queries. Contract, billing and financial records are retained for the term of the agreement and then for seven years (or longer if law requires) for tax, audit, safety and regulatory purposes. Smart-meter and telemetry data is retained on a rolling thirty-six month basis and then aggregated or anonymised for analytics unless it is needed longer for dispute resolution, safety investigations, compliance checks or export settlement. Support tickets and maintenance logs are typically retained for thirty-six months after closure. KYC and AML records are retained for the period required by applicable law or financing and utility rules, typically five to seven years. When retention periods expire, we delete or irreversibly anonymise data.

Subject to applicable law, you have the right to request access to personal data we hold about you, to rectify inaccuracies, to request erasure, to restrict or object to processing, and to request portability of certain data. You can withdraw consent to marketing at any time, and withdrawal will not affect the lawfulness of processing already carried out. To exercise your rights, email privacy@lumia-energy.com and provide enough information to identify yourself and your relationship to the premises; we may ask you for evidence to verify identity and authority. We will respond within the statutory timeframe. You also have the right to lodge a complaint with the competent authority— in Zambia under the Data Protection Act 2021, and in Tanzania with the Personal Data Protection Commission—though we request that you contact us first so we can try to resolve the matter promptly and fairly.

Our websites use necessary cookies for operation and security, and optional analytics cookies for performance and usage insights. Where required, we seek consent through a banner that offers Accept, Reject and Manage options; you can change your preferences at any time using the banner link or your browser settings. We keep a record of your consent choice. Cookie categories and purposes are described in the cookie controls. We do not use third-party advertising cookies on the Aurora application flow.

Our services are not directed to children and we do not knowingly collect children’s data beyond essential household contact details provided by the account holder for safety or emergency purposes. If we learn that we have inadvertently collected personal data from a child without the necessary permissions, we will delete it promptly.

Our sites may link to third-party pages and social platforms. Their privacy practices are their own; we recommend reviewing their notices before sharing data with them. Where we embed third-party content (for example, a map or a video), that provider may set its own cookies in line with its policies, and you can control this via our cookie banner.

We may disclose personal data where required by law, lawful request, court order or regulator, or to protect the rights, property or safety of Lumia, our customers and partners, the public or the grid. Where legally permitted, we will narrow the scope of any disclosure to what is strictly necessary and will notify you where doing so is lawful and does not prejudice an investigation or critical infrastructure security.

To protect individuals and our business, all suppliers who process personal data for us must sign and comply with a data processing agreement that contains confidentiality commitments, use-limitation to contracted purposes, technical and organisational measures equivalent to ours, restrictions on onward transfers, prompt incident notification and cooperation, assistance with data-subject rights requests, and deletion or return of personal data at the end of the engagement. We monitor performance and reserve the right to audit key suppliers for compliance with these obligations proportionate to risk.
‍
Because we iterate our products and operations, it is helpful to explain certain forward-looking strategies that have been discussed internally but not yet concluded or launched; these do not change your rights today and do not authorise new processing without further notice and, where needed, consent. We are evaluating fleet-level forecasting and virtual power-plant style coordination to optimise export timing across neighbourhoods; if implemented, this would rely on the same metering data we already collect, aggregated and, where possible, de-identified, with household-level controls and opt-outs where required. We are exploring dynamic export-credit enhancements tied to utility settlement windows; if introduced, customers would receive a separate notice describing the model, any changes to legal basis, and clear opt-in/opt-out choices. We are considering DER aggregation and grid-forming capabilities for weak grids; any additional telemetry needed would be limited to what is necessary for safe operation and compliance, and we would update this Notice and our contracts before enabling such features. We are assessing receivables financing and SPV-backed structures to scale deployments; where a financier requires limited access to performance or account data under confidentiality, we will share only what is needed, with stringent contractual controls, and without weakening your rights under this Notice. We may pilot usage-based service tiers or battery optimisation that shift charging away from peak grid stress; such features would be explained in advance with clear settings and would not enable unrelated profiling. None of these potential strategies are active unless and until we notify you and, where required, obtain consent; where a data protection impact assessment (DPIA) is appropriate, we will conduct one before launch.

We may update this Privacy Notice from time to time to reflect changes in law, regulation, utilities’ rules, our services or our supplier ecosystem. The “Last updated” date will always show the current version. Where changes are material—for example, a new purpose that is not compatible with the original one, or new optional analytics—we will provide reasonable advance notice, such as by email, portal message or a site banner, and where required we will seek fresh consent. Continued use of our services after an update indicates that you have read the revised Notice.

If you have questions, wish to exercise your rights, or need a copy of relevant transfer safeguards, contact privacy@lumia-energy.com. For security concerns, suspected incidents or vulnerability reports, contact security@lumia-energy.com. Our postal address and company details are available on our website and on request; we will provide them in full on any formal correspondence or rights request.