1. Introduction and scope
1.1This Privacy Policy explains how EVI Technologies Private Limited ("EVI Technologies", "we", "us", "our") collects, uses, stores, shares, and protects your personal data when you use the "EVIT Charge" mobile application, the EVIT / EVI-Grid electric-vehicle charging network, and any related website, including evi-grid.com (together, the "Service").
1.2This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), and the Consumer Protection Act, 2019 and the rules framed thereunder, each as applicable and in force from time to time.
1.3By creating an account or using the Service, you confirm that you have read and understood this Policy. Where the law requires your consent for a particular processing activity, we will seek that consent separately and you may withdraw it as described in Section 10.
1.4In this Policy, "personal data" means any data about an individual who is identifiable by or in relation to such data, and "you" / "Data Principal" means the individual to whom the personal data relates. EVI Technologies is the "Data Fiduciary" that determines the purpose and means of processing your personal data.
2. The personal data we collect
We collect only the data needed to provide the Service. Specifically:
2.1Account and identity data - your mobile number (used as your account identity and to log you in by one-time password (OTP) sent over SMS), and the name you provide.
2.2Device location - your device's location, collected to show you nearby charging stations, give directions, and enable location-based features. Location is used while you use the relevant feature and in accordance with the permissions you grant on your device; you may change location permissions at any time in your device settings (some features may not work without it).
2.3Vehicle details - the vehicle information you choose to save (such as make, model, connector type, and similar details) to improve your charging experience.
2.4Wallet, payment and transaction data - your in-app wallet balance, top-up records, prepaid holds and captures, and transaction history. Payments are processed by our third-party payment gateway (Razorpay); the app does not collect or store your full card number, CVV, or other complete card credentials - those are handled directly by the payment gateway on its secure, PCI-DSS-compliant systems. We receive only transaction status, limited reference identifiers, and masked / tokenised information needed to reconcile your wallet and issue receipts.
2.5Charging-session and receipt data - details of your charging sessions (station, connector, energy / time consumed, start / stop, cost) and receipt / invoice history.
2.6Support data - the support tickets, queries, and communications you send us, and our responses.
2.7Technical and notification data - your push-notification token and limited device / technical information needed to deliver notifications and operate the app reliably.
2.8We do not knowingly collect special-category or sensitive data beyond what is described above. We do not require you to provide more data than is necessary for the purpose stated at the point of collection.
3. How and why we use your data (purposes)
We process your personal data for the following lawful purposes:
3.1To create and secure your account and authenticate you by OTP.
3.2To provide the core charging service - locating stations, reserving, starting / stopping charging, and metering energy or time.
3.3To operate your wallet, process top-ups, place and settle prepaid holds, capture the actual amount for energy delivered, and release or refund the unused balance.
3.4To generate receipts, invoices, and session and transaction history.
3.5To provide customer support and resolve your tickets and grievances.
3.6To send you service communications and, where you have not opted out, relevant notifications about your sessions, wallet, and the Service.
3.7To maintain the safety, security, integrity, and reliability of the Service, prevent fraud and misuse, and debug and improve the Service.
3.8To comply with applicable law and respond to lawful requests from courts, regulators, and authorities.
3.9We process your personal data only for lawful purposes for which you have given consent or for other legitimate uses permitted under the DPDP Act. We do not use your personal data for purposes incompatible with those stated here without seeking fresh consent where required.
4. Legal basis and notice
4.1Where we rely on your consent, we obtain it through a clear, specific, and informed request, and you may withdraw it at any time (see Section 10).
4.2Where the law permits processing for certain "legitimate uses" (for example, to perform a service you have requested, to comply with law, or to respond to an emergency), we may process your data on that basis to the extent permitted.
4.3This Policy, together with the in-app consent notices, serves as the notice required under the DPDP Act, informing you of the personal data collected, the purposes, the manner of exercising your rights, and how to complain to the Data Protection Board of India.
5. Sharing and disclosure of your data
We do not sell your personal data. We share it only as described here:
5.1Payment gateway - with Razorpay and, where applicable, your bank / card network, to process payments, top-ups, captures, and refunds.
5.2Communication providers - with SMS / OTP providers and push-notification service providers to deliver OTPs and notifications.
5.3Charge-point operators (CPOs) - with operators of charging stations on the EVIT / EVI-Grid network (including roaming / third-party chargers), to the limited extent needed to authorise, start, meter, and settle your charging session at their station.
5.4Service providers / processors - with vendors who host, maintain, secure, and support our systems, under contracts that require them to process data only on our instructions and to protect it.
5.5Legal and protective disclosures - with courts, regulators, law-enforcement, or other authorities where required by law, and to establish, exercise, or defend legal claims, or to protect the rights, safety, and property of EVI Technologies, our users, or the public.
5.6Corporate transactions - in connection with a merger, acquisition, financing, or sale of assets, subject to the recipient honouring this Policy.
5.7We require our processors and partners to apply reasonable security safeguards. We remain responsible, as Data Fiduciary, for personal data processed on our behalf.
6. Data security
6.1We implement reasonable security practices and procedures within the meaning of the IT Act and the SPDI Rules, proportionate to the nature of the data and the Service, including access controls, encryption in transit, OTP-based authentication, and restricted internal access on a need-to-know basis.
6.2No method of transmission or storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. You are responsible for keeping your device and OTP confidential.
6.3In the event of a personal-data breach, we will act in accordance with applicable law, including any notification obligations to affected Data Principals and to the Data Protection Board of India / CERT-In, within the timelines the law prescribes.
7. Data retention
7.1We retain your personal data only for as long as necessary to fulfil the purposes set out in this Policy, to provide the Service, and to comply with legal, tax, accounting, and regulatory obligations.
7.2Account data is retained while your account is active. Transaction, payment, and receipt records are retained for the period required under applicable tax, accounting, and payment regulations [Data retention period - confirm; payment / transaction records are commonly retained up to 8 years].
7.3When personal data is no longer required for any lawful purpose and no legal obligation requires its retention, we will erase it or anonymise it in accordance with the DPDP Act.
8. Your rights as a Data Principal
Subject to the DPDP Act and applicable conditions, you have the right to:
8.1Access - obtain a summary of the personal data we process about you and the processing activities.
8.2Correction and updating - have inaccurate or incomplete personal data corrected, completed, or updated.
8.3Erasure - request erasure of your personal data where it is no longer necessary for the purpose for which it was collected and no law requires its retention.
8.4Grievance redressal - a readily available means to raise grievances with us (see Section 11).
8.5Nomination - nominate another individual to exercise your rights in the event of your death or incapacity.
8.6Withdrawal of consent - withdraw any consent you have given, as described in Section 10.
8.7To exercise any right, contact us or our Grievance Officer (Section 11). We may need to verify your identity before acting on a request. We will respond within the timelines required by law.
9. Children's data
9.1The Service is intended for users aged 18 years and above. We do not knowingly offer the Service to, or knowingly process the personal data of, a child (a person under 18) without the verifiable consent of a parent or lawful guardian, as required by the DPDP Act.
9.2We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we learn that we have collected a child's data without the required parental consent, we will take steps to delete it.
10. Withdrawal of consent
10.1You may withdraw your consent to any processing based on consent at any time, with effect for the future, by using the in-app settings or by contacting our Grievance Officer.
10.2Withdrawing consent may mean we can no longer provide some or all of the Service to you. Withdrawal does not affect the lawfulness of processing done before withdrawal, nor processing we are permitted or required to continue under the law.
11. Grievance Officer and how to contact us
11.1If you have any question, request, or grievance about your personal data or this Policy, please contact our Grievance Officer. In line with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act:
11.2Data Fiduciary: EVI Technologies Private Limited, [Registered Office Address], CIN [CIN].
11.3General contact: support@evi-grid.com.
11.4Grievance Officer: [Grievance Officer Name] - [Grievance Officer Email] / [Grievance Officer Phone].
11.5We will acknowledge your grievance within 48 hours of receipt and endeavour to resolve it within 30 days, or sooner where the law requires.
11.6If you are not satisfied with our response, you may complain to the Data Protection Board of India in accordance with the DPDP Act.
12. International and third-party links
12.1The Service may process or store data using infrastructure located in India or, subject to law, elsewhere, with safeguards in place. Any cross-border transfer is carried out in accordance with the DPDP Act and any restrictions notified by the Central Government.
12.2The Service may link to third-party sites or services (such as the payment gateway). This Policy does not cover those third parties; please review their privacy policies.
13. Changes to this Policy
13.1We may update this Policy from time to time. We will post the updated Policy at evi-grid.com and, where the change is material, notify you through the app or by other reasonable means. The "Effective Date" reflects the latest version. Your continued use of the Service after an update constitutes acknowledgement of the updated Policy, subject to any fresh consent the law requires.