Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") is issued by 1EV Technologies Private Limited ("1EV", "we", "us") under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and IT Rules, and, for international Users, GDPR principles. It applies to the 1EV mobile app, website, and admin/partner portal ("Platform"), covering station discovery, reservations, remote charging, payments, Evoins rewards, trip planning, and analytics.

By using the Platform, you agree to this Policy. 1EV operates the Platform as an aggregator of charging Stations. A Station may be a 1EV-Owned Station (owned or operated by 1EV or its group entities) or a Partner Station (owned and operated by an independent Charge Point Operator ("CPO")), as indicated on the Platform. Where a Partner Station is used, certain data is necessarily shared with the relevant CPO (see Section 6).

Read together with the 1EV Terms & Conditions, Refund & Cancellation Policy, and Cookie Policy.

2. Key Definitions

• Personal Data - data identifying an individual (DPDP Act, s.2(t)).
• Sensitive Personal Data - financial/payment details, precise location, and similar data classified as sensitive under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Data Fiduciary - 1EV, as the entity deciding purpose/means of processing.
• Data Principal - the User, as the individual to whom the data relates.
• CPO - third-party operator of EV charging Stations integrated with the Platform.

3. Information We Collect

• Identity/contact: name, mobile number, email, photo, billing address.
• Vehicle: make/model, registration number, battery/connector specs, SOC data (if telematics enabled).
• Location/GPS: precise and approximate location, with your device-level permission, for station discovery, routing, and session proximity checks. Background location (Android) and Always/While Using access (iOS) are separately disclosed and consented to per Google Play and Apple requirements.
• Charging history: session times, energy consumed, station/connector used, reservations, favourites, trip plans.
• Payment data: 1EV does not store card/CVV/UPI PIN - only tokens, transaction IDs, amount, method, and status via PCI-DSS certified gateways.
• Device data: device/OS model, identifiers, advertising ID (subject to opt-out), IP address, network type, app version.
• Cookies, analytics, and crash logs (see Cookie Policy).
• Evoins activity: points earned/redeemed/expired, referral codes, promotions.
• Support communications and any voluntarily submitted content.

4. How We Collect It

Directly from you (registration, bookings, support); automatically (cookies, SDKs, sensors); and from third parties (CPO session telemetry, payment gateway status), always subject to required permissions.

5. Purpose and Legal Basis

Consent-based processing may be withdrawn anytime (Section 9).

6. Disclosure of Information

• CPOs - name/masked contact, connector type, and session commands, to enable charging.
• Payment gateways/banks - for authorisation and settlement.
• Service providers - hosting, SMS/OTP, notifications, support, analytics, fraud detection, under confidentiality obligations.
• Successor entities - in a merger/acquisition, subject to equivalent privacy commitments.
• Government/law enforcement - only under valid legal process, minimum data necessary, with notice to you where legally permitted.
• Any other third party - only with your specific consent.

1EV does not sell Personal Data for third parties' independent marketing.

7. Cross-Border Transfer

Data is primarily hosted in India. Any transfer abroad (e.g., cloud redundancy) follows DPDP Act s.16 and government notifications, under contractual safeguards; EEA Users' transfers rely on GDPR-recognised safeguards (e.g., standard contractual clauses).

8. Data Retention

Data is deleted or anonymised after these periods unless law requires longer retention.

9. Data Security

• TLS 1.2+ in transit; AES-256 at rest for sensitive data.
• Role-based access control and audit logs (≥180 days).
• Firewalls, intrusion detection, periodic VA/PT.
• Tokenised payments; no full card/UPI storage.
• Staff confidentiality obligations and training.

Breach Notification: Affected Users and the Data Protection Board of India (or equivalent authority) will be notified per DPDP Act timelines, with nature of breach, data affected, and remedial steps.

10. Your Rights

• Access - summary of data/processing held.
• Correction & Completion of inaccurate/incomplete data.
• Erasure - where no longer necessary, subject to Section 8.
• Withdraw Consent anytime (may limit features; doesn't affect prior lawful processing).
• Grievance Redressal via the Grievance Officer.
• Nominate another person to exercise these rights on death/incapacity.

Exercise rights via privacy@1ev.co.in or in-app "Privacy & Data" settings, including self-service account deletion (Google Play/Apple compliant). Response within 15 days.

11. Children's Privacy

The Platform is for Users 18+ only. 1EV does not knowingly collect data from minors; any such data discovered will be deleted promptly. Parents/guardians may request deletion at privacy@1ev.co.in.

12. Government & Law Enforcement Requests

1EV verifies legal validity before responding, resists overbroad/unlawful requests, discloses only minimum necessary data, and notifies affected Users where legally permitted.

13. Cookies

Cookies, SDKs, and similar technologies are used for authentication, preferences, analytics, and (if consented) advertising. See the Cookie Policy for details and opt-out controls.

14. App Store Compliance

14.1 Google Play

• Clear in-context disclosure for foreground/background location.
• Payment data handled per Google Play Payments Policy.
• In-app account/data deletion available.
• Advertising ID used only for permitted purposes; resettable via device settings.
• Notification categories disclosed clearly.

14.2 Apple App Store

• ATT authorisation requested before IDFA/tracking access; opt-outs respected.
• Clear location-usage strings.
• In-app account deletion (Guideline 5.1.1(v)).
• Privacy Nutrition Label kept accurate and current.

15. Third-Party Links

Links/integrations to third-party sites, CPO systems, or gateways are governed by their own privacy policies, not this one.

16. Changes to This Policy

Updates will be notified via the Platform, email, or in-app notice; material changes may require fresh consent. Continued use after notice constitutes acceptance, unless explicit consent is legally required.

17. Grievance Officer & Contact

18. Consent

By registering, granting permissions, and using the Platform, you provide free, specific, informed consent to this Policy. Separate in-app prompts will seek granular consent where required (e.g., precise location, advertising ID, marketing).

19. Governing Law

This Policy is governed by Indian law. Disputes follow the dispute-resolution provisions of the 1EV Terms & Conditions (arbitration seated in Pune, Maharashtra; courts at Pune, Maharashtra, India for non-arbitrable matters).