Privacy Policy and Customer Data Protection

1. Introduction

Ethiopian Electric Utility (EEU) is fundamentally committed to protecting the privacy, security, and confidentiality of personal information or data as defined in Article 2(2) and (5) of the Personal Data Protection Proclamation (Proclamation No. 1321/2016).

This policy describes how the EEU and its concerned work units collect, encode, encrypt, use, transfer, disclose, and protect the data subject from unauthorized access and disclosure.

2. Scope of Application

This policy applies to all personal information or data collected by EEU through its digital platforms, including:

• Websites and mobile applications
• Call centers
• Any data processes associated with customer service and operational activities
• Official third-party platforms such as Messenger, WhatsApp Business, and Facebook pages
• Analytics, cookies, or tracking technologies used on the EEU website and integrated systems

3. Collection of Personal Information

Data the EEU collects is information necessary for our legitimate utility operations, customer service, and regulatory compliance. We aim to collect only the minimum data required for each specific purpose.

Data Category	Purpose of Collection	Specific Data Elements Collected
Customer Interaction	To register, track, and resolve customer complaints and service requests	Name, Physical Address, Contact Information (phone/email), Business Partner Number (Contract Account Number)
Billing and Account Access	To allow customers to check current and historical electricity bills	Contract Account Number
Integrity and Reporting	To facilitate the reporting of unethical conduct or corruption	Contact Number (optional, used for follow-up)
Service Improvement	To analyze customer service trends, personalize communications, and identify areas for system upgrades and service enhancement	Aggregated and anonymized usage data
Technical and Security	To maintain system security, prevent fraud, and ensure platform reliability	IP addresses, device identifiers, browser type, access logs

4. How We Use Your Information

EEU uses personal information only for lawful purposes directly related to its utility operations and customer service functions:

• Service Delivery: To process service requests, manage accounts, and deliver electricity services
• Billing and Payments: To generate bills, process payments, and manage account balances
• Customer Support: To respond to inquiries, complaints, and service requests via call center, email, or digital platforms
• Communication: To send service updates, power interruption notices, and important announcements
• Improvement: To analyze usage patterns and improve our services and platforms
• Security: To detect and prevent fraud, unauthorized access, and other security threats
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

5. Third-Party Sharing

EEU may share your information with third parties only in the following circumstances:

• Legal Requirements: When required by law, court order, governmental authority, or contractual commitment
• Service Providers: To trusted contractors/partners who support EEU operations such as payment processing and IT maintenance, under strict confidentiality and data-use agreements
• Meta Platforms (Facebook): We use Meta APIs for social media integration and sharing features. When you interact with these features, Meta may collect information in accordance with their privacy policy
• Analytics Providers: We use analytics services to understand website usage patterns

We do not sell, trade, or rent your personal information to third parties for marketing purposes.

6. Data Security and Protection

EEU deploys robust administrative, technical, and organizational measures to protect your personal information or data from preventable accidental loss, unauthorized access, disclosure, transfer, alteration, or destruction. These include:

• Role-based access controls for authorized personnel only
• Encryption of sensitive information both in transit and at rest
• Regular security monitoring and vulnerability assessments
• Secure data storage and audit controls

7. Data Retention

We retain personal information only for the period necessary to fulfill the purposes outlined in this policy or to meet legal, regulatory, or operational requirements.

After the legal and contractual data retention period expires, the data will be securely erased or deleted, anonymized, or archived in accordance with EEU's data-retention policy and schedule.

8. Your Rights (Data Subject Rights)

EEU customers have the following rights regarding personal information or data, subject to legal and regulatory restrictions:

• Right to Access: Access personal data controlled by EEU upon request and free of charge
• Right to Rectification: Request free of charge rectification of personal data where you believe that the personal data is inaccurate, incomplete, misleading, not up-to-date, or is otherwise being processed contrary to applicable law or contractual agreement
• Right to Object: Object in writing to certain types of data processing by the data controller or processor where the latter processes in violation of their legal limits
• Right to Data Portability: Receive personal data concerning you, which you have provided to a data controller or data processor, in a structured, commonly used and machine-readable format
• Right to Lodge a Complaint: Submit a complaint to the appropriate supervisory authority regarding our improper data-handling practices
• Other Rights: Exercise other rights and entitlements emanating from applicable law or contractual clauses

9. Data Deletion Instructions

If you wish to request deletion of your personal data from our systems, you can:

• Call Center: Contact our 24/7 Call Center at 905
• Email Request: Send a deletion request to info@ethiopianelectricutility.gov.et with the subject line "Data Deletion Request"
• Written Request: Submit a written request to our head office

Please include your full name, Contract Account Number (if applicable), and contact information in your request. We will process your request in accordance with applicable law and confirm the action taken.

Note: Some data may be retained as required by law or for legitimate business purposes (e.g., billing records, legal compliance, regulatory requirements).

10. Data Breach Notification Procedure

EEU is committed to responding promptly and transparently to any incident that may compromise or violate personal data. In the event of a data breach involving unauthorized access, loss, or disclosure of personal information, the following procedures will be followed:

Detection and Assessment

• All suspected breaches are immediately reported to the EEU Security Operations and Data Protection Teams
• An internal investigation will be conducted to determine the nature, scope, severity, accountability and potential impact of the breach

Containment and Mitigation

• EEU will take immediate steps to contain the breach, prevent further unauthorized access, and secure affected systems
• Technical and operational measures may include access revocation, system isolation, password resets, or temporary shutdowns of affected services

Notification to Affected Customers

If the breach is likely to result in harm, identity theft, service disruption, or risks to personal rights, EEU shall notify affected customers and the regulatory body within 72 hours after having become aware of the breach. Notifications will be made via SMS, phone calls, email, website alerts, or official announcements.

Notification to Authorities

EEU will notify the breach to appropriate supervisory or regulatory authority in accordance with Article 43 of the Proclamation promptly.

11. Changes to This Privacy Policy

We reserve the right to modify this policy at any time. Updates will be posted on our official website. We encourage you to review this Privacy Policy periodically.

12. Contact Information

13. Consent

By using our Portal and Services, you hereby consent to our Privacy Policy and agree to its terms in accordance with the Personal Data Protection Proclamation (Proclamation No. 1321/2016).