Privacy Policy

Welcome

HBM NIGERIA PLC and its subsidiaries[1] (HBM) values you as a customer, supplier or other third party who is interested or in contact with HBM, our products, technologies and services. When you interact with us, we will collect and process certain of your personal data. This Data Protection Notice explains how HBM uses the personal data provided by you and which rights and options you have in this respect. It applies to Personal Data that you provide to HBM or which is derived from such data.

The use of information that is gathered by cookies or other web tracking technologies is subject to our Cookie Policy. In compliance with explicit digital transparency mandates, HBM deploys highly conspicuous, obvious cookie notification banners on our primary web interfaces. These tracking banners are explicitly placed to noticeably obstruct a prominent view of the homepage upon arrival to guarantee they are never ignored or unnoticed by a visitor. While strictly necessary functional cookies required for system network stability and baseline security deploy by default, all analytical, behavioral profiling, and marketing cookies are strictly blocked unless you actively check an un-selected "Accept" option. You maintain an absolute right to easily withdraw your tracking consent or opt-out at any time via our web settings.

[1]  HBM has full ownership of Ashakacem Limited (RC 13422) and Wapsila Nigeria Limited (RC 1228321). Personal data is processed centrally by HBM.

Who is Responsible for your personal data?

Your personal data will be controlled by HBM—a member of the Huaxin Group, who is identified as the controller responsible or processor in the communication you receive from us. As a primary data controller, personal data is processed centrally by HBM.

Due to the scope, nature, and volume of our commercial and corporate data operations, HBM is designated as a Data Controller of Major Importance under Nigerian law. Consequently, we maintain a formal registration with the Nigeria Data Protection Commission (NDPC) and commit to executing periodic, risk-based compliance audits across our central operations and full-ownership subsidiaries. We formally file our annual Compliance Audit Returns (CAR) through a licensed Data Protection Compliance Organisation (DPCO) through the automated platform provided by the Commission no later than the 31st of March each year.

Data Protection Officers (DPOs)

You or any regulatory authority may contact our DPOs regarding any question, grievance, or right assertion via the dedicated channel: ng-m-dataprotection@ng.huaxin.com

To ensure our processing operations are strictly aligned with legal and ethical standards, HBM has designated two Data Protection Officers (DPOs). Our DPOs possess expert knowledge of data protection laws and practices, are officially enrolled in the database of the NDPC, and undergo mandatory Annual Credential Assessments (ACA).

Data subjects may contact our DPOs with regard to issues relating to the processing of their personal data and the exercise of their rights. You or any regulatory authority may contact our DPOs regarding any question, grievance, or right assertion via our tracked channel: ng-m-dataprotection@ng.huaxin.com

Principles of personal data processing

Your personal data will be processed in a fair, lawful and transparent manner. HBM will process your data for and in line with the purpose for which it is collected, and not further processed in a manner that is incompatible with those purposes.

We will process your personal data in an accurate manner, using reasonable and practical means in accordance with our policies, to ensure that the data is kept up to date. Your data will be stored only as long as necessary for the purposes for which they are processed or otherwise permitted or required by applicable law (storage limitation) and HBM’s retention policy.

HBM will protect your data against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures to maintain the integrity and confidentiality of your personal data.

The legal bases for Processing of your Personal Data are set in the Nigerian Data Protection Act 2023 and other applicable laws (Data Protection Laws). HBM has established appropriate rules and procedures to demonstrate compliance of its data processing activities with the Data Protection Act Laws. This includes in particular documenting processing activities in the Records of Processing Activities and conducting data privacy assessments where required.

Privacy by Design and by Default

HBM adopts a proactive approach to data protection by integrating privacy into the design and operation of our IT systems, services, and business practices. By default, our systems are configured to process only the minimum personal data necessary for specific purposes, ensuring limited accessibility and shortened storage periods

For which purposes will we use your personal data?

We will process your personal data strictly only for the following purposes ("Permitted Purposes"):

• Planning, performing, managing and administering your (or a third party's to whom you are related) contractual business relationship with HBM, e.g. by performing transactions and orders of products or services, processing payments, performing accounting, auditing, billing and collection activities, arranging shipments and deliveries, facilitating repairs and providing support services or providing you with other services or things you may have requested;
• Maintaining and protecting the security of our products, services and websites or other systems, preventing and detecting security threats, fraud or other criminal or malicious activities;
• Ensuring compliance with legal obligations (such as record keeping obligations), compliance screening or recording obligations (e.g. under antitrust laws, export laws, trade sanction and embargo laws, anti-bribery or corruption laws and internal rules or to prevent white-collar or money laundering crimes), which may include automated checks of your contact data or other information you provide about your identity against applicable sanctioned-party lists and contacting you to confirm your identity in case of a potential match or recording interaction with you which may be relevant for antitrust purposes;
• Informing you, where permitted in accordance with applicable laws, within an existing business relationship about HBM's products or services which are similar or relate to such products and services which have already been purchased or used within that business relationship;
• Solving disputes, enforcing our contractual agreements and to establish, exercise or defend legal claims; or
• Ensuring compliance with legal obligations, e.g. to keep sales records for tax purposes or to send notices and other disclosures as required by law.
• Sustainability reporting and assurance
• Corporate social responsibility management and reporting
• Sponsorship and donation management and reporting
• Ensuring compliance with our health, safety and environment standards e.g. administration of drug test for third party drivers
• Product delivery management via geolocation monitoring for transportation services for third party drivers
• Ensuring security, protection of lives and property via surveillance of third parties visiting or working in our plants or offices
• Bursary and Scholarships
• Health Scheme Management
• Shares Data Management in collaboration with our Registrars

In compliance with the Data Protection Regulations, upon receipt of your consent, we may process your personal data also for the following purposes:

• Communicating with you through the channels you have approved to keep you up to date on the latest announcements, special offers and other information about HBM’s products and services (including marketing-related newsletters) as well as events and projects of HBM;
• Administrating and performing events including customer events, customer surveys, marketing campaigns, market analysis, sweepstakes, contests or other promotional activities or events; or
• Collecting information about your preferences to create a user profile to personalize and foster the quality of our communication and interaction with you (for example, by way of newsletter tracking or website analytics).

With regard to marketing-related types of communication (i.e. emails and phone calls), we will where legally required only provide you with such information after you have opted in and provide you the opportunity to opt out if you do not want to receive further marketing-related types of communication from us.

The legal bases for processing of your personal data is either for compliance with our legal obligation, the performance of a contract or other business agreement with HBM, our legitimate business interest (for example securing our physical and proprietary assets), public interest, your vital interest or your consent where you have expressly given that to us as set out in the Data Protection Laws. 

Scope of personal data

We may collect and process in particular the following categories of personal data:

• Contact information, such as full name, personal or work address, personal or work telephone number, work mobile phone number, and work email address,
• Payment data, such as data necessary for processing payments and fraud prevention, including credit/debit card numbers, security code numbers and other related billing information;
• Sensitive information, such as medical or health information during routine health checks in line with our health and safety policies and procedures
• Further business information necessarily processed in a project or contractual relationship with HBM or voluntarily provided by you, such as orders placed, payments made, requests and projects;
• Information collected from publicly available resources, integrity data bases and credit agencies; and
• If legally required for compliance purposes: information about relevant and significant litigation or other legal proceedings against you or a third party related to you and interaction with you which may be relevant for antitrust purposes.
• Special categories of Personal Data.  In connection with the registration for and provision of access to an event or seminar, we may ask for information about your health for the purpose of identifying and being considerate of any disabilities or special dietary requirements you may have. Any use of such information is based on your consent. If you do not provide any such information about disabilities or special dietary requirements, we will not be able to take any respective precautions.
• Other Personal Data. We may sometimes ask for your data of birth, your habits or your preferences as we would like to send you greeting messages on important days for you. Any use of such information is based on your consent.

How do we collect your personal data?

We will typically collect your personal data directly from you. We do not obtain personal data from third parties unless specified herein (e.g. information from publicly available resources, based on a contract, integrity data bases and credit agencies).

How do we Protect Your personal data

We maintain physical, electronic and procedural safeguards in accordance with the legal data protection requirements to protect your personal data from unauthorized access or intrusion. These safeguards include implementing specific technologies and procedures designed to protect your privacy, such as secure servers, firewalls and SSL encryption. We will comply with applicable laws and regulations regarding the confidentiality and security of personal data.

With whom will we Share Your personal data?

We may share your personal data as follows:

• With our affiliates within the Group if and to the extent required for the Permitted Purposes and legally permitted. In such cases, these entities will then use the Personal Data for the same purposes and under the same conditions as outlined in this Data Privacy Notice.
• We may also instruct service providers (so called data processors) within or outside of the Group, domestically or abroad, e.g. shared service centers, to process personal data for the Permitted Purposes on our behalf and in accordance with our instructions only. HBM will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers.
• With courts, law enforcement authorities, regulators or attorneys if legally permitted and necessary to comply with a legal obligation or for the establishment, exercise or defense of legal claims.
• Otherwise, we will only disclose your personal data when we are required by applicable law or regulations or judicial or official request to do so, or when we suspect fraudulent or criminal activities.

Where will your personal data be processed?

Our parent company is a globally active enterprise. In the course of our business activities, we may transfer your personal data also to recipients in other countries (“third countries”). When doing so we will comply with applicable data protection requirements and take appropriate safeguards including established binding corporate rules, or standard contractual clauses, or adequacy decision to ensure the security and integrity of your personal data. 

Your data protection rights

In line with the Data Protection Laws, you have the right to:

• object to processing of your personal data or request data portability; 
• Lodge a complaint with the Nigeria Data Protection Commission;
• Not to be subject to a decision solely based on automated processing of Personal Data including profiling which produces a legal effect or similar significant effect;
• Information on the source of data not collected directly from you
• Request access to, rectification, erasure or restriction of processing of your personal data, subject to certain legal conditions, you may request access. 
• You also have the right to request a copy of the personal data that we hold about you. If you make this request repeatedly, we may make a reasonable administrative fee reflective of actual cost, as permitted by law".

For any of the above requests, please send a description of your personal data concerned stating your name, customer number (or other HBM identification number) to the contact details below. We may require additional proof of identity to protect your personal data against unauthorized access. We will carefully consider your request and may discuss with you how it can best be fulfilled.

If you have given us your consent for the processing of your personal data, you can withdraw the consent at any time with future effect, i.e. the withdrawal of the consent does not affect the lawfulness of processing based on the consent before its withdrawal. In case consent is withdrawn, we may only further process the personal data where there is another legal ground for the processing.

If you have any concerns about how your personal data is handled by us or wish to raise a complaint, you can contact us at the contact details below to have the matter investigated.

Are you required to provide personal data?

As a general principle, the provision of your personal data is entirely voluntary; there are generally no detrimental effects on you if you choose not to consent or to provide personal data. However, there are other lawful basis HBM will personal data, for example because this personal data is required to process your orders, provide you with access to a web offering or newsletter or to carry out a legally required compliance screening. In these cases, it will unfortunately not be possible for HBM to provide you with what you request without the relevant personal data.

Children and Persons Lacking Legal Capacity

Where a data subject is a child or a person lacking the legal capacity to consent, the consent of the parent, legal guardian or lawful attorney, as applicable, shall be obtained prior to processing of the personal data. Appropriate mechanisms such as presentation of any government approved ID card, authenticated power of attorney as applicable, shall be deployed to verify age and consent. 

Notwithstanding the above, valid legal grounds for processing of personal data of children under the age of 18 (or other age limit defined under applicable law) or Sensitive Data (as defined below) are applicable only if and to the extent any of the processing conditions under applicable law applies, in particular if:

• It is necessary to protect the vital interests of the child or a person lacking the legal capacity to consent.
• It is required for purposes of education, medical, or social care, and undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality 
• It is necessary for proceedings before a court relating to the individual
• The data subject has given its explicit consent, unless we are prohibited by the applicable law to rely on such consent.
• The relevant personal data have been manifestly made public by the data subject. 
• The Processing is necessary for HBM to carry out obligations under employment, social security or social protection law, or a collective agreement. 
• The Processing is necessary for HBM to establish, exercise or defend against legal claims or where courts are acting in their judicial capacity. 

Retention of your personal data

Your personal data will be deleted when legally required and in accordance with HBM’s data retention policy. We will in particular retain your personal data where required for HBM to assert or defend against legal claims until the end of the relevant retention period or until the claims in question have been settled. To enforce strict storage limitation principles, where no specific statutory timebound retention period is mandated by applicable Nigerian law or active contractual terms, the retention period for your personal data will automatically lapse no later than six (6) calendar months after the original business purpose for processing has been fully accomplished. Upon expiration of this timeline, all corresponding data residues will be destroyed or irreversibly anonymized to prevent future identification

Updates to this Data Protection Notice

This Data Privacy Notice was last updated in July 2026. We reserve the right to update and change this Data Protection Notice from time to time in order to reflect and changes to the way in which we use your personal data or changing legal requirements. In case of any such changes, we will publish the changed Data Protection Notice on our website or otherwise.

Internal Redress and Standard Notices

If you reasonably believe HBM has handled your information inaccurately or acted in violation of your privacy rights, we encourage you to contact us directly to have the matter promptly investigated and resolved internally. For standardized and expedited remediation, data subjects, or authorized civil society entities acting on their behalf, may issue a formal Data Subject’s Standard Notice to Address Grievance (SNAG) directly to our DPOs via physical mail or email. This internal recourse framework operates seamlessly alongside your right to lodge a direct statutory complaint with the NDPC.

How to get in touch with us

For any questions and comments or in case you want to assert your rights, you can also contact HBM in writing at: ng-m-dataprotection@ng.huaxin.com or lodge a complaint to the Nigeria Data Protection Commission via its website https://ndpc.gov.ng/