1. In short
EvCentra collects only what we need to help you find chargers, run a session, take payment and issue a GST invoice. We never sell your data. You have full rights to access, correct and delete your data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). To exercise them, email privacy@evcentra.com.
2. Who is the data fiduciary?
EvCentra Private Limited, CIN CIN allotment in progress, registered at Sy. No. 132, Bhavya's Akhila Exotica, Hydernagar, Hyderabad 500085, India, is the "data fiduciary" of your personal data under the DPDP Act.
3. What we collect
We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity | Name, mobile number, email, date of birth (optional), profile photo (optional) |
| Vehicle | Make, model, year, battery capacity, preferred plug type (all optional) |
| Location | Precise GPS only when the app is open, coarse city-level location for trip planning |
| Sessions | Site, stall, start/end time, kWh delivered, ₹ paid, session ID |
| Payments | Last 4 digits of card, UPI handle masked, payment method type. Full card / UPI VPA never stored by us — held by Razorpay. |
| Device | Device model, OS version, app version, IP address, advertising ID (if enabled) |
| Communication | Support emails, chat transcripts, voice-call recordings (with notice) |
4. How we use it
- To run the service — show you nearby chargers, route you, start sessions, take payment, issue invoices;
- To verify the network — driver-app pings cross-check operator telemetry;
- To prevent fraud and abuse;
- To respond to your support queries;
- To send essential service notifications (session start/end, payment receipts, billing);
- To send marketing — only with your explicit opt-in, and you can withdraw it at any time;
- To comply with law — GST invoicing, tax filings, lawful requests from authorities.
5. Legal basis for processing
We process personal data on one of the following legal bases under the DPDP Act:
- Consent — when you sign up, opt into marketing, share precise location, etc.;
- Contractual necessity — to perform the service you've asked for (e.g. process a payment);
- Legal obligation — GST invoicing, anti-money-laundering, lawful authority requests.
6. Who we share it with
We share the minimum necessary personal data with:
- Charging-site operators — the name and account ID of the driver starting a session at their stall (so they can run the session);
- Payment gateways — Razorpay (primary), Cashfree (whichever processes your transaction);
- Cloud infrastructure — Amazon Web Services (Mumbai region) and Google Cloud (Mumbai region);
- Customer-support tools — Zendesk (India region);
- Analytics — Plausible Analytics (cookie-less, IP-truncated);
- Law-enforcement / regulators — only on a valid legal request.
We never sell personal data and we don't share it with advertisers or data brokers.
7. How long we keep it
| Data | Retention |
|---|---|
| Account profile | Until account deletion + 30 days |
| Session history | 5 years (consumer-protection records) |
| GST invoices | 8 years (CGST Act, 2017) |
| Payment authorisation logs | 10 years (anti-money-laundering) |
| Support emails | 2 years from last interaction |
| Marketing consents | Until withdrawn + 30 days |
8. Cross-border transfers
Your personal data is primarily processed and stored within India (AWS and Google Cloud Mumbai regions). A limited subset (support tickets, error logs containing user identifiers) may be processed by sub-processors in Singapore and the United States. We rely on standard contractual clauses and the DPDP Act's "permitted-territory" framework to safeguard such transfers.
9. Security
We hold ISO 27001 controls (audit in progress). Specific measures:
- TLS 1.3 for all traffic; AES-256 for data at rest;
- mTLS plus rotating JWTs for charger telemetry;
- Least-privilege role-based access and audit logging;
- No card numbers / UPI VPAs stored on EvCentra servers;
- Quarterly third-party penetration tests; active bug-bounty programme (security@evcentra.com).
10. Your rights (DPDP Act)
You have the right to:
- Access — a copy of your personal data we hold (in machine-readable form);
- Correct or update — fix inaccurate or incomplete data;
- Erase — delete your data (subject to legal retention obligations above);
- Withdraw consent — for any processing based on consent, at any time;
- Grievance redressal — file a grievance with our Grievance Officer (Sec. 14);
- Nominate — appoint someone to exercise your rights if you become incapacitated.
To exercise any right, email privacy@evcentra.com from the email on your account, or use Settings → Privacy → Manage my data in the app. We respond within 7 business days and complete the action within 30 days.
11. Children
EvCentra is not for users under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided personal data, contact privacy@evcentra.com and we will delete it.
12. Cookies & tracking
The website uses minimal first-party cookies (session, preference) and a cookie-less analytics tool (Plausible). The app uses platform-standard device identifiers only for crash reporting. Full disclosures on the Cookie Policy.
13. DPO & contact
EvCentra has appointed a Data Protection Officer (DPO) under the DPDP Act:
Aanya Mehra · Data Protection Officer
EvCentra Pvt Ltd, Sy. No. 132, Bhavya's Akhila Exotica, Hydernagar, Hyderabad 500085
Email: privacy@evcentra.com
Phone: +91 70937 91397
You may also file a complaint with the Data Protection Board of India once it becomes operational.
14. Changes
We'll notify you in-app and by email at least 14 days before any material change. Older versions of this Policy are available on request to privacy@evcentra.com.