Legal.

Privacy Policy

Effective date: 27 August 2025
Scope: evcharge.mobi (the website), our mobile/desktop apps (driver & operator), APIs, and related services (the “Service”).

1) Who we are (data controller)

Effective date: 27 August 2025
Scope: evcharge.mobi (the website), our mobile/desktop apps (driver & operator), APIs, and related services (the “Service”).
Legal entity: “EV Charge Mobi” Ltd. (SIA “EV Charge Mobi”).
Registration No.: 40203664660
VAT No.: LV40203664660
Registered/Postal address: Zaļa street 7-14, Riga, LV-1010, Latvia
Contact email: support@evcharge.mobi

2) Quick summary

● We run a software-first EV charging platform. To provide it, we process account information, charging/session data (kWh, time, location, price), diagnostics, and—if you allow—precise location.● We use Google services (Analytics 4, Tag Manager, optional Google Signals; Sign-in with Google; reCAPTCHA; Consent Mode v2) plus standard cloud tools for hosting, support, security and A/B testing.● We don't sell your personal data. We share it only with trusted processors and partners required to run the Service (payments, roaming, maps, fraud/security, communications).● You control consent for analytics/ads cookies, precise/background location, marketing, and optional integrations. You also have rights to access, correct, delete, port, restrict, and object.

3) When we act as controller vs processor

Controller. For direct consumer accounts and our own apps/website, we are the data controller.Processor. For business customers (e.g., fleets, site owners) we may process data on their instructions (e.g., employee charging at company sites). In those cases, your employer/organization is the controller for their purposes; this Policy still describes our safeguards.

4) What we collect

We collect data in four ways: (A) you provide it; (B) it's collected automatically; (C) we receive it from partners you connect; (D) we derive/aggregate analytics.

A. Information you provide

Account & profile. Name, email, password (hashed), phone, language, company & role (for business accounts).EV & preferences. Vehicle make/model/trim, connector type, preferred tariffs/windows, home/work sites, RFID card IDs.Billing & payments. VAT/tax details, invoice data, billing address. We do not store full card numbers. We receive tokens and limited card metadata from our payment processor (e.g., Stripe/Adyen).Support & communications. Messages, attachments, satisfaction scores, survey responses; call recordings only with your consent.Developer/partner info. If you use our APIs/portals: organization, technical contacts, IP allowlists, webhook URLs.

B. Information collected automatically

Usage & diagnostics. IP address, device IDs, OS/browser/app version, settings, crash logs, performance metrics, feature usage, timestamps, referral pages/UTM.Location. Precise location when you enable it (e.g., to find nearby chargers, automate start/stop, or route planning). Coarse location from IP/Wi-Fi.Cookies/SDKs. See §11.

C. Information from Google & other third parties (only if you connect/consent)

Google Analytics 4 and the Google tag. Pseudonymous identifiers and event data about how you use our website/app. We may enable Google Signals to understand cross-device usage where you've turned on Ads Personalization in your Google account.Google OAuth / Sign-in with Google (optional). If you choose to sign in with Google, we receive your basic profile (name, email, avatar) and a persistent identifier. We do not receive your Google password.Google reCAPTCHA. Used to protect forms from abuse; it collects device and interaction metadata for risk analysis.Maps & geolocation. Google Maps, Apple Maps or OpenStreetMap may receive device/location data when maps or geocoding are used.Payments. Our processor sends us tokens, payment status, and limited card metadata for receipts, refunds and dispute handling.Roaming & interoperability partners. If you roam (e.g., Hubject, Gireve, e-clearing/eCHARGE) or open your chargers to roaming, we exchange CDRs (charge detail records), authorization events and tariff descriptors to settle sessions.Vehicle/OEM & telematics (optional). If you connect a vehicle/account, we may receive state-of-charge, charging status, VIN-scoped IDs and odometer, where permitted.

D. Derived/aggregated information

We compute analytics (e.g., charger uptime, energy per site, queueing risk, price forecasts). These are aggregated or pseudonymized where possible.

5) Why we process your data (legal bases)

Under GDPR/EEA law we rely on:

Contract. Create and manage accounts, authenticate users, run sessions, apply tariffs/access rules, issue invoices/receipts, provide support.Legitimate interests. Secure and improve the Service; detect and prevent fraud/abuse; measure product usage; develop new features; protect legal rights. We balance these interests against your rights and freedoms.Consent. Non-essential cookies/analytics/ads, precise/background location, marketing emails/SMS/push, optional integrations (e.g., OEM linking). Withdraw anytime in Cookie Settings or device/browser settings.Legal obligations. Tax/accounting retention; responding to lawful requests; KYC/AML where applicable.

6) How we use data

● Provide, maintain and secure the Service (accounts, sessions, roaming, firmware management, diagnostics).● Show stations, routes and live availability; compute pricing; apply tariffs and access rules.● Process payments; generate receipts/invoices; manage refunds/chargebacks.● Communicate service alerts and changes to terms; respond to support requests.● Fix bugs, improve performance, plan capacity, and design new features.● Personalize UX (remember sites, language, preferred connectors) and—if you consent—tailor marketing.● Enforce terms, investigate security incidents/fraud, and protect users and Company.

7) Sharing your data

We do not sell your personal data. We share it only as needed:

Processors (service providers). Cloud hosting (e.g., AWS/GCP), databases, logs, analytics (GA4/TM), crash reporting (e.g., Firebase), email/SMS/push, customer support/CRM, A/B testing, consent management, reCAPTCHA, and security tools. They act under data-processing agreements and only on our instructions.Payments & billing. PCI-DSS compliant processors (e.g., Stripe/Adyen), fraud screening, invoicing/accounting tools.Roaming & CPO/EMSP partners. To authorize sessions, exchange CDRs, and settle roaming charges.Site owners/hosts & fleet managers. Where a charger is on private property or a corporate fleet plan, we may share session data needed for access control, billing or compliance.Corporate administrators. If you use an account managed by your employer/organization, your admin may access certain usage and billing data.Change of control. In a merger, acquisition or asset sale, data may transfer under equivalent safeguards.Authorities. When legally required or to protect rights, users or property.Advertising/remarketing partners (only with consent). Limited identifiers and events to measure and show relevant ads.

8) International transfers

If data leaves the EEA/UK, we use a lawful mechanism (e.g., adequacy decisions, EU Standard Contractual Clauses and the UK IDTA/Addendum) and perform transfer risk assessments where required. Copies are available on request where permitted by law.

9) Retention

We keep personal data only as long as necessary, then delete or anonymize it:

Account & profile: life of the account + up to 24 months (for logs/support).Charging sessions/CDRs & invoices: 10 years (or longer where tax/accounting law requires).Diagnostics & logs: 12-24 months.Marketing consents & email events: life of consent + up to 36 months.Analytics events/cookies: up to 26 months (Google Analytics defaults may apply).

10) Security

Encryption in transit and at rest; role-based access and least-privilege; MFA for staff; network segmentation; secure development and code review; backups and auditing. No system is 100% secure—if a breach affects you, we will notify you and regulators as required by law.

11) Cookies & similar technologies

We use cookies, SDKs, pixels and local storage to run and improve the Service.

CategoriesStrictly necessary (always on): security, authentication, basic functions, consent storage.Functional: remember preferences (language, sites, connectors).Analytics: Google Analytics 4 through the Google tag; we may enable IP-masking and regional data controls.Advertising/remarketing (optional): Google Ads / Display & Video 360 to measure campaigns and—if you consent—personalize ads.Your choicesManage consent any time in Cookie Settings (Google Consent Mode v2 supported).Use browser/mobile settings to block/delete cookies, limit ad IDs, or restrict background location.Google controls: Ads Settings and the Analytics Opt-out Add-on.reCAPTCHA protects forms; its use is governed by Google's Privacy Policy and Terms.

12) Your rights (EEA/UK & similar regimes)

Request access, correction, deletion, restriction, portability, or object to certain processing (including direct marketing). Where we rely on consent, you may withdraw it at any time. You may lodge a complaint with your local authority; in Latvia this is the Data State Inspectorate.

To exercise rights, email support@evcharge.mobi. We will verify your identity and respond within statutory time limits.

13) Business accounts & administrators

If you use the Service through a company, certain data (e.g., sessions at company sites, RFID IDs, invoices) may be visible to your company's administrators under their policies. They act as independent controllers for their own purposes (e.g., expense control, sustainability reporting).

14) Children

The Service is not directed to children under 16. We do not knowingly collect their data. If you believe a child provided data, contact us and we will act.

15) Do Not Track & Global Privacy Control

Our site does not currently respond to DNT signals. Where supported, we honor GPC as an opt‑out of sale/sharing for California users.

16) California (CCPA/CPRA)

We do not sell personal information for money. With consent, we may share identifiers and events for cross-context behavioral advertising. Opt out in Cookie Settings or via a GPC signal.California residents can know/access, correct, delete, opt out of sale/sharing, and limit use of sensitive information. To exercise rights, email support@evcharge.mobi. We will not discriminate for exercising these rights.Categories collected (12 months): identifiers (device IDs, contact info), commercial information (transactions), internet activity (usage analytics), geolocation (when enabled), inferences (service improvements). Sensitive data: only precise location when you opt in; used solely to provide the Service.

17) Third-party links

Our site/app may link to third-party websites or services. Their privacy practices are their own. Review their policies before providing data.

18) Changes to this Policy

We will post changes here and update the effective date. If changes are material, we will provide additional notice (e.g., in‑app banner or email).

19) Contact us

We will post changes here and update the effective date. If changes are material, we will provide additional notice (e.g., in-app banner or email).

Controller: SIA “EV Charge Mobi”, Zaļa street 7-14, Rīga, LV-1010, LatviaEmail: support@evcharge.mobi

Bring your chargers online today.

Create a free CPO Portal account and connect your first OCPP charger in minutes.