Privacy Policy

1. Introduction

This Privacy Policy explains how EVPlug collects, uses, shares and safeguards personal information. It is written in accordance with the Protection of Personal Information Act, 2013 ("POPIA") of the Republic of South Africa.

2. Who we are

The responsible party for your personal information is EVPlug.

3. Personal information we collect

We try to collect as little as we can. Depending on how you use the Services, we may process:

• Driver account holders (EVPlug app): name, email address, mobile phone number, securely hashed password, RFID/scan-card identifier (if issued), wallet balance, charging session history, vehicle make and model and connector type (if you choose to add it), location data when you use the in-app charger map (with your permission), and payment instrument tokens (we never store full card numbers — see "Security" below).
• Operator tracker users: name, email address, securely hashed password, role flags, and records of your activity in the admin area.
• Launch-update subscribers: email address, optional interest flag (e.g. "property partner"), and the source page you subscribed from.
• Location suggestions: province, city and location name, optional notes, optional email address, and the IP address and user-agent string of your request.
• Visitors: server log entries (IP address, URL path, referrer, browser user-agent, timestamp) and basic analytics required to operate the site and detect abuse.
• Charging session data (your own sessions): station ID, start and end timestamps, kWh delivered, ZAR billed, payment status, and any fault codes returned by the charger.
• Roaming session data: when you charge at a partner network station via the EVPlug app, or when a partner network driver charges at an EVPlug station, the OCPI Charge Detail Record (CDR) is exchanged between the operators. We share or receive session details (kWh, time, station ID, anonymised driver token), but we never share your full name, email, or full payment data with roaming partners.
• Push notification tokens: if you allow notifications in the EVPlug app, your device's push token is stored so we can tell you when your charge starts, finishes, or needs attention. The token is removed when you sign out or delete your account.
• Crash diagnostics: if the app crashes, a technical report (device model, operating system version, and the state of the app at the moment of the crash) is sent to our crash-reporting provider (Google Firebase Crashlytics) so we can fix the fault. These reports do not include your name, email, or payment details.
• Camera: the app uses your camera only to scan the QR code on a charger, with your permission. Frames are processed on your device and are never stored or sent to us.
• Location: with your permission, the app sends your position to our servers to find chargers near you. It is used for that search and is not kept as a history of your movements.
• Cookies and similar technologies: see our Cookie Policy.

We do not store full credit card numbers, CVV codes, or other sensitive payment data. Payment instruments are tokenised by our payment provider, and we receive only the token, the last four digits and the card brand.

We do not knowingly collect special personal information (race, religion, health) or the personal information of children under 18 without appropriate consent.

4. How we use it

• To provide, operate and secure the EVPlug app, website, and charging stations.
• To authenticate you and manage your account and wallet.
• To process charging sessions and bill them correctly.
• To process wallet top-ups, payments, and refunds via our payment providers.
• To exchange Charge Detail Records (CDRs) with roaming partner networks for cross-network charging.
• To communicate essential service messages (password resets, session receipts, refund notifications, charger fault alerts on your active sessions, account verification, security notices).
• To improve and prioritise our network (e.g., deciding where to put the next charging station based on usage patterns and location suggestions).
• To send you push notifications about your own charging sessions, if you have allowed them. You can switch them off at any time in your device settings.
• To debug (including through crash reports), detect abuse and protect our systems and users.
• To comply with our legal obligations (tax, AML, regulatory).

We don't sell your personal information, and we don't share it with third parties for their own marketing.

5. Legal basis

We process personal information on one or more of these lawful bases under POPIA: consent (e.g., when you subscribe to updates), performance of a contract (e.g., provisioning your account, processing your charging sessions and payments), compliance with law (e.g., tax record retention), protection of our legitimate interests (e.g., security, fraud prevention), and — in the case of publicly-available charging station operator data — the public-domain source.

6. Who we share with

We share personal information with a small number of operators that help us run the Services. Each is bound by a written agreement and may only process personal information on our instructions:

• Our infrastructure provider — application hosting, database storage, object storage, DNS, map tile service and authenticated map access.
• Our transactional email provider — sending operational messages such as password resets and invitations.
• Our deployment tooling provider — infrastructure tooling used to run the application.
• Our payment provider (Paystack) — processing wallet top-ups, card verification and charging payments. They receive your name, email and the payment amount. You provide your card details directly to them through their secure payment forms; we never see or store your full card details. Storing a card involves a small verification charge, which is reversed.
• Our notification and crash-reporting provider (Google Firebase) — delivering the push notifications you request, and receiving crash reports so faults can be fixed. Firebase does not receive your charging or payment history.
• OCPI roaming partners — when you charge at a partner network via EVPlug, or when a partner network's driver charges at an EVPlug station, we exchange Charge Detail Records (CDRs) including kWh, time, station ID and an anonymised driver token. We do not share your full name, email, or payment details with roaming partners.

We may also disclose personal information when required by law, court order or legitimate regulatory request.

7. Cross-border transfers

Our primary application region is in South Africa. Some of the third-party services we rely on — including certain infrastructure components and payment providers — operate globally and may process data outside South Africa. Where personal information is transferred across borders, we rely on POPIA section 72 protections, including binding contractual safeguards with the receiving party.

8. Retention

We keep personal information only as long as reasonably needed:

• Driver account data: retained while your account is active. If you close your account, basic data is retained for 5 years to meet tax and accounting obligations under the Tax Administration Act and the Companies Act.
• Charging session records: retained for 5 years for tax and accounting compliance.
• Payment records: retained as required by tax and AML legislation, typically 5 years.
• Server logs: kept for a short operational window (typically 90 days).
• Location suggestions: kept for as long as they remain useful to planning decisions.

You can delete your account at any time, in the app (Account → Delete account) or on the website (Settings). Deletion removes your name, email and vehicles, retires your charge cards, and signs you out of every device immediately. Charging and payment records are retained in de-identified form for the 5-year periods above, because they are financial records we are required by law to keep.

After applicable retention periods, data is deleted or fully de-identified.

9. Your rights under POPIA

You have the right to:

• Confirm whether we hold personal information about you and request a copy.
• Request correction or deletion of information that is inaccurate, out of date, misleading or unlawfully obtained, subject to retention obligations under tax and AML legislation.
• Object to processing, including for direct marketing.
• Withdraw consent where we process on the basis of consent.
• Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

Deleting your account does not require a request: the app and website both have a delete-account control that works immediately. For anything else, email our Information Officer at the address below. We'll respond within a reasonable time, usually within 30 days.

10. Security

We apply reasonable technical and organisational measures to protect personal information, including encryption in transit (TLS), password hashing, role-based access to the admin area, two-factor authentication support, regular patching, and infrastructure-level isolation. Payment data is tokenised by our payment provider — your full card number never reaches our servers. No system is perfectly secure; if we ever become aware of a security compromise affecting personal information, we will notify the Information Regulator and affected data subjects as required by POPIA.

11. Children

The Services are aimed at adults. The minimum age to register an EVPlug account is 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, please contact us so we can remove it.

12. Cookies

We use a small number of cookies to run the site and keep you signed in. Details are in our Cookie Policy.

13. Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date above. If changes are material, we'll highlight them on the site and notify account holders by email.

14. Information Officer and contact

Attention: Information Officer
Email: privacy@evplug.co.za