Privacy Policy (Zambia)

1. Introduction & Scope

Puma Energy Zambia PLC ("Puma Energy", "we", "our", or "us"), in its capacity as a data controller, processes personal data of customers who opt into the PRIS loyalty programme and use its related mobile application ("PRIS App"). This Privacy Policy (the "Policy") sets out the principles and practices adopted by us regarding the collection, use, retention, disclosure and other matters relating to the transparent processing of personal data.

This Policy applies to:

• Individuals registering for the PRIS loyalty programme.
• Individuals making use of and/or transacting through the PRIS Africa App and cards.
• Any person who otherwise communicates with us in relation to the PRIS loyalty programme.
• Employees of our corporate customers registered under PRIS for Business.
• Individuals using the PRIS Fuel Card stored-value feature.
• Individuals using the PRIS for Business portal.

By using the PRIS Africa App or the PRIS for Business portal, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

2. Categories of Personal Data Collected

For the purposes of providing, maintaining and improving the PRIS loyalty programme, Puma Energy may process the following categories of information:

• Identity and Contact Information: including but not limited to your full name, government-issued identification number, mobile number, postal and/or email address, vehicle registration number and vehicle type/model.
• Employment & Corporate Relationship Data: employer name, employee ID, corporate Fuel Card allocation amount, and employment status.
• Loyalty Account and Transactional Information: including your PRIS wallet ID, accumulated balance, top-up history, redemptions, station identifiers, location and time of transactions, rewards earned and redeemed, promotional campaigns opted into, and odometer readings entered at point of sale for PRIS for Business transactions.
• Device and Technical Information: including your device type, device unique identifiers and operating system, the version of the PRIS Africa App in use, limited diagnostic or error reporting, IP address, and session logs, and location of usage.
• Stored-Value Financial Data: Fuel Card balance, top-up method (mobile money, bank transfer, debit/credit card), top-up amount, payment gateway reference numbers, and partial payment splits across payment types.
• Marketing and Communications Preferences: including records of your decision to opt into or out of receiving marketing communications from Puma Energy.

3. Manner of Collection

We collect your personal information through the following lawful means:

• Direct provision by you: including registration data, transaction instructions, and communication initiated by you with Puma Energy.
• Automated collection: including limited device, log and usage information generated when you access or interact with the PRIS Africa App or our support channels.
• Authorised partners: where required to process loyalty points, payments or top-ups, Puma Energy may receive information from authorised third parties such as mobile money operators or payment processors.
• For PRIS for Business, personal information of employees of our corporate customers may be collected from your employer.
• For PRIS Fuel Card top-ups, personal information may be received from payment processors and mobile money operators as part of payment authentication and settlement.

4. Purpose of Processing

Your personal data will only be processed for legitimate, lawful and specific purposes associated with the PRIS loyalty programme, which may include:

• Administering, operating and maintaining the PRIS Africa App and loyalty programme.
• Verifying your identity and eligibility to participate in PRIS loyalty programme.
• Recording and executing transactions, rewards and redemptions.
• Preventing, detecting and responding to fraudulent activity, misuse or security incidents.
• Providing customer support and responding to queries or complaints.
• Complying with statutory and regulatory obligations applicable to Puma Energy.
• Managing corporate accounts for PRIS for Business, including employee onboarding, fund allocation, balance management, top-up reconciliation, and redemption authorization.
• Recording vehicle details and odometer entries for fleet tracking and fuel usage reporting.
• Processing, authorizing, and reconciling Fuel Card stored-value transactions.
• Settlement of dealer accounts in respect of PRIS for Business and Fuel Card transactions.

Marketing communications (email & SMS). We will send email, WhatsApp & SMS marketing communications only with your consent. You may grant or withhold consent separately for each channel in the PRIS Africa App. You may withdraw either consent at any time by unsubscribing.

Geolocation. The PRIS Africa App will access your device location for store-finding, contextual offers, or fraud prevention only if you explicitly enable location services for the App on your device and toggle geolocation consent in the App. You may withdraw this consent at any time via device settings and in-App controls.

5. Compulsory Data & Consequences of Non‑Provision

Certain categories of information are compulsory for the establishment and operation of a PRIS account, including but not limited to name, mobile number and national identification details. Failure to provide such information will prevent Puma Energy from providing you with access to the PRIS Africa App or its services. Optional information may be provided at your discretion, and refusal to provide optional information will not restrict your ability to participate in PRIS.

For PRIS for Business, the name and mobile number of the corporate customer employee must be provided as minimum personal information. Vehicle details are required where fleet/odometer features are enabled. Failure to provide vehicle data restricts those features but does not prevent basic account use.

For PRIS Fuel Card, a mobile number and PIN are required to operate the Fuel Card. Failure to provide a payment method prevents loading value.

6. Legal Basis for Processing

Puma Energy processes personal information in PRIS on the following lawful bases:

• Consent: where you have given explicit consent, for example to receive marketing.
• Contractual necessity: to perform obligations relating to your participation in PRIS.
• Legal obligation: to comply with Zambian law and regulatory frameworks.
• Legitimate interest: where processing is reasonably required to protect Puma Energy's rights, prevent fraud or improve services, and such interests are not overridden by your fundamental rights.

7. Data Sharing & Disclosure

Puma Energy may disclose personal information to the following authorised recipients:

• Puma Energy group companies and affiliates, on a need-to-know basis.
• Service providers who support the PRIS Africa App (including IT, hosting, maintenance, payment processors), subject to binding confidentiality and data protection obligations.
• Regulatory authorities, law enforcement bodies or courts of competent jurisdiction, where disclosure is required or permitted by law.
• Third parties involved in a corporate transaction such as a merger, acquisition or sale of assets, in which case safeguards will be applied to ensure continuity of protection.
• In PRIS for Business, authorized representatives of the corporate customer may view transaction data, wallet balances, odometer entries, and vehicle assignments relating to employees associated with the corporate customer's account. The corporate customer is responsible for ensuring that its use of this information complies with applicable employment and data protection laws.
• Fuel Card transaction data may be shared with payment gateway providers and mobile money operators.

8. Cross‑Border Transfers

Your personal information may be transferred to, and stored in, countries outside Zambia for purposes of IT hosting or group-level administration. Where such transfers occur, Puma Energy will implement adequate safeguards, including contractual commitments, to ensure that your data is protected to a standard consistent with this Policy and applicable law.

9. Security Measures

Puma Energy implements appropriate technical and organisational measures to ensure the integrity and confidentiality of personal information, including encryption in transit, access restrictions, secure storage facilities, and periodic review of security protocols. While we take reasonable precautions, no system is completely secure, and Puma Energy disclaims liability for unauthorised access beyond our reasonable control.

For PRIS for Business, portal access is role-based and restricted to Corporate Admins. Employee corporate Fuel Card activation requires a two-step confirmation - employee activates via App and Corporate Admin confirms on portal. PIN authentication is mandatory for all PRIS for Business and Fuel Card redemption transactions at POS.

In the event of a data breach likely to result in material risk to your rights or freedoms, Puma Energy will notify you and, where applicable, the relevant supervisory authority within the period required by law.

10. Data Retention & Accuracy

We retain personal information for as long as is necessary to fulfil the purposes described in this Policy, including to meet legal, regulatory, tax, accounting or evidentiary requirements. Thereafter, information is securely deleted or anonymised per internal policies & procedures.

It is your responsibility to ensure that personal information provided to Puma Energy is accurate, complete and up-to-date. Puma Energy shall not be liable for consequences arising from your failure to update such information.

11. Your Rights

Subject to applicable law, you may exercise the following rights:

• Request access to the personal information held about you.
• Request deletion where information is no longer required.
• Object to certain forms of processing, including direct marketing.
• Withdraw consent previously given (without affecting lawfulness of prior processing).

Requests should be directed to the contact us form or prisafrica@pumaenergy.freshdesk.com and will be addressed in accordance with statutory timelines. Puma Energy reserves the right to refuse or charge a fee for manifestly unfounded or excessive requests.

12. Cookies & Similar Technologies

The PRIS Africa App may use cookies or similar technologies for core operational purposes (such as maintaining session state) and for limited analytical purposes. You may disable cookies through your device settings, but please note this may impair the functionality of the PRIS Africa App.

The PRIS for Business Portal uses session cookies and authentication tokens to maintain login sessions. These are essential for portal operation and cannot be disabled without impairing functionality.

13. Children

The PRIS Africa App and loyalty programme are not intended for use by individuals below the legal age of majority in Zambia. Puma Energy does not knowingly collect information from minors without parental or guardian consent. Should such data be inadvertently collected, Puma Energy will promptly delete it on being notified.

14. Amendments to this Policy

Puma Energy may amend this Policy from time to time to reflect changes in law, regulation or operational practices. Material changes will be notified through the PRIS Africa App or other reasonable communication methods. Continued use of the PRIS Africa App following such notice shall constitute acceptance of the amended Policy.

15. Contact & Complaints

For questions, requests or complaints regarding this Policy, please contact:

Data Protection Officer – Puma Energy Zambia PLC
Email: dpo@pumaenergy.com

If you are dissatisfied with Puma Energy's response, you have the right to escalate the matter to the Data Protection Commission in Zambia.