Privacy Policy

Effective Date: April 1, 2025

Last Updated: September 2026

DIGIHORIZON RECHARGE VEHICLE PRIVATE LIMITED ("Palipoint", "Company", "we", "us", or "our") is dedicated to protecting your privacy, personal data, and confidentiality. This Privacy Policy sets out the basis on which we collect, store, process, utilize, share, and protect your data when you use our mobile applications (Android/iOS), websites (https://www.palipoint.com), charging management portals, APIs, smart socket hardware, and related electric mobility services (the "Platform" or "Services").

This Privacy Policy complies with:

- The Digital Personal Data Protection Act, 2023 (DPDP Act - India);

- The Information Technology Act, 2000 and IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (India);

- The General Data Protection Regulation (GDPR - EU/UK);

- The California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA - USA);

- Applicable international data privacy frameworks.

1. INFORMATION WE COLLECT

We collect data directly from you, automatically through your device interactions, and through our connected charging hardware and trusted third parties.

1.1. Personal Identification Information:

- Contact Details: Full name, email address, mobile phone number, physical/billing address.

- Account Credentials: Usernames, encrypted passwords, authentication OTPs, profile photographs.

- Identity & Verification Data (KYC): Government-issued identity numbers, driver's license details, GSTIN/tax numbers (for vendors, CPOs, and certified electricians).

1.2. Vehicle, Charging & Hardware Telemetry:

- Vehicle Information: Vehicle make, model, year, battery capacity, connector standard (Type 2, CCS2, CHAdeMO, GB/T), and registration number.

- Session Telemetry: Energy consumed (kWh), charging duration, charging rate, real-time voltage/current readings, charging socket ID, battery state of charge (SoC), and RFID card identifiers.

- Swap & Socket Data: Battery pack serial numbers, smart socket energy pulses, relay switch logs.

1.3. Precise Geolocation Data:

- Background & Foreground Location: We collect your precise GPS location to locate nearby EV charging stations, battery swap kiosks, fuel outlets, route navigation, and assign local electricians. Background location is collected only when explicitly authorized by you for active navigation or station proximity alerts.

1.4. Financial & Payment Information:

- Payment Transactions: Transaction reference IDs, payment method tokens, UPI VPA IDs, invoice receipts, and refund details. (Note: Full credit/debit card numbers and CVV codes are processed directly by PCI-DSS certified payment gateways and are never stored on our servers).

- Wallet Ledger: Palipoint wallet top-up history, promotional coin rewards, deductions, and credit balance.

1.5. Technical & Usage Data:

- Device & Network Identifiers: IP address, device model, operating system version, browser type, unique device identifiers (UUID/IMEI/Advertising ID), and mobile network operator.

- Analytics & App Interactions: Screen views, clickstream logs, feature usage, crash reports, and system performance metrics.

1.6. Vendor & Electrician Professional Data:

- Electrician Certifications, background verification status, skills, service reviews, bank payout account details, and geolocation check-ins for job dispatch.

2. LEGAL GROUNDS & PURPOSES OF DATA PROCESSING

We process your personal data under legitimate legal bases, including contractual necessity, explicit consent, legal compliance, and legitimate commercial interests.

Purposes of Processing:

- Service Delivery: Enabling EV charger mapping, slot reservations, automated session initiation, battery swapping, and electrician service dispatch.

- Transaction Execution: Calculating dynamic tariffs, processing payments, issuing digital tax invoices, and managing wallet balances.

- Safety, Monitoring & Diagnostics: Monitoring IoT charger health, detecting electrical overload, preventing cable disconnection faults, and maintaining grid stability.

- Fraud Prevention & Account Security: Verifying user identities, investigating chargebacks, stopping bot attacks, and preventing misuse of promotional coins.

- Communication & Notifications: Sending real-time session updates (charging started, 80% charged, session complete, idle fee warning), booking confirmations, and customer support resolutions.

- Legal & Regulatory Compliance: Complying with statutory accounting rules, power distribution norms, tax filings, and lawful government requests.

3. COOKIES & TRACKING TECHNOLOGIES

Our web platforms use essential, functional, analytical, and advertising cookies to authenticate sessions, remember preferences, and analyze web traffic patterns. You can manage or disable non-essential cookies via your browser settings; however, certain interactive features of the Platform may become unavailable.

4. HOW WE SHARE AND DISCLOSE YOUR INFORMATION

We DO NOT sell, rent, or trade your personal data to third parties for monetary gain. We only disclose data in the following strictly controlled scenarios:

4.1. Independent Vendors, CPOs & Electricians: When you initiate a charging session or book a service, relevant details (name, vehicle type, location, slot time) are shared with the host station operator, CPO, or assigned technician to fulfill the service.

4.2. Authorized Service Providers: We partner with vetted third-party vendors for:

- Payment Gateway Services (Razorpay, PhonePe, Paytm, Stripe, PayPal);

- Cloud Hosting & Database Infrastructure (AWS, Google Cloud, Microsoft Azure);

- SMS, WhatsApp & Push Notification Gateways;

- Maps & Navigation APIs (Google Maps API, MapmyIndia);

- Analytics & Performance Monitoring Tools.

4.3. OCPI Roaming Hubs & Interoperability Partners: For cross-network EV roaming, session authorization tokens and metering data are exchanged securely with participating charging networks.

4.4. Corporate Restructuring: In the event of a merger, acquisition, divestiture, or sale of assets, user data may be transferred to the acquiring entity under equivalent confidentiality obligations.

4.5. Legal Mandates & Law Enforcement: We may disclose information if required by law, subpoena, court order, or formal request by statutory regulatory or law enforcement authorities.

5. INTERNATIONAL & CROSS-BORDER DATA TRANSFERS

Palipoint operates primarily from India while serving enterprise and individual users globally. If you access our Services from the EU, UK, US, or other regions, your data may be transferred to, stored, and processed in India and global cloud servers. We implement standard contractual clauses (SCCs) and robust technical safeguards to ensure your data receives an adequate level of protection across all jurisdictions.

6. DATA SECURITY & STORAGE PRACTICES

6.1. Security Controls: We implement strict technical, physical, and organizational security measures, including SSL/TLS 256-bit encryption in transit, AES-256 encryption at rest, tokenized API authentication, role-based access control (RBAC), and regular vulnerability assessments.

6.2. No Absolute Guarantee: While we enforce enterprise-grade security, no method of transmission over the Internet or electronic storage is 100% secure. You are responsible for safeguarding your personal login credentials.

7. DATA RETENTION PERIODS

We retain your personal data only as long as necessary to fulfill the purposes outlined in this Policy, maintain your active account, satisfy statutory accounting, tax, and legal requirements (typically 5 to 8 years for transactional and billing records under Indian company law), or resolve outstanding disputes. When no longer required, data is irreversibly anonymized or securely deleted.

8. YOUR PRIVACY RIGHTS & CHOICES

Depending on your geographical jurisdiction, you possess specific statutory rights regarding your personal information:

8.1. Under the Indian DPDP Act, 2023:

- Right to Access: Request a summary of your personal data being processed.

- Right to Correction & Erasure: Request rectification of inaccurate data or deletion of data no longer required.

- Right to Grievance Redressal: Access rapid internal grievance mechanisms.

- Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.

8.2. Under GDPR (EEA / UK Users):

- Right of Access, Rectification, and Erasure ("Right to be Forgotten");

- Right to Restrict Processing and Right to Object to processing based on legitimate interests;

- Right to Data Portability;

- Right to withdraw consent at any time without affecting prior lawful processing;

- Right to lodge a complaint with your local Data Protection Supervisory Authority.

8.3. Under CCPA / CPRA (California Residents):

- Right to know what personal information is collected, disclosed, or shared;

- Right to delete personal information collected from you;

- Right to correct inaccurate personal information;

- Right to opt-out of the "sale" or "sharing" of personal data (Palipoint does not sell personal data);

- Right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, please submit a written request to contact@palipoint.com. We will verify your identity before processing your request within the statutory timeline.

9. CHILDREN'S PRIVACY

Our Services are strictly not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we discover that a minor has provided us with personal information, we will take immediate steps to delete such records.

10. THIRD-PARTY LINKS & PLATFORMS

Our Platform may contain links to third-party websites, external CPO portals, or hardware manufacturers. We have no control over and assume no responsibility for the content, privacy practices, or data collection policies of any third-party services.

11. UPDATES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy at our sole discretion to reflect changes in our technology, business practices, or statutory legal obligations. Material changes will be notified via our app, website, or email notification. Your continued use of the Services after the updated Effective Date constitutes acceptance of the modified Privacy Policy.

12. GRIEVANCE OFFICER & DATA PROTECTION CONTACT

In accordance with the Information Technology Act, 2000, the DPDP Act, 2023, and global data protection regulations, please direct all queries, requests, or privacy grievances to:

Data Protection & Grievance Officer

DIGIHORIZON RECHARGE VEHICLE PRIVATE LIMITED

Registered Office: Plot No-2108/2453, At-Krushna Nagar, Jaleswar, Baleswar - 756032, Odisha, India

D-U-N-S: 95-731-7025

Email: contact@palipoint.com

Website: https://www.palipoint.com