Privacy Policy

We collect personal data from you in three ways: information you provide directly, information generated automatically when you use our services, and information received from third-party partners.

• Account registration: Full name, phone number, email address, and chosen password when you create an EVHub account.
• Payment information: Mobile money account numbers (MTN MoMo, Airtel Money, Vodafone Cash), bank card details (tokenised — we never store raw card numbers), and billing address where required.
• Identity verification: National ID or passport number for identity verification in accordance with Ghana's AML/CFT regulations and Nigeria's KYC requirements.
• RFID card registration: Physical delivery address when you order an EVHub RFID access card.
• Business & partner information: Company name, registration number, director details, site address, and bank account information for partner and CPO onboarding agreements.
• Communications: Content of messages you send us via live chat, email, or support tickets, including session details, complaints, and feedback.
• Voluntary profile information: Vehicle make, model, and battery capacity, which you may optionally provide to receive more accurate charging time estimates.

• Session data: Start and end times, station identifier, connector type, energy delivered (kWh), peak power (kW), cost, and payment method used for every charging session.
• Telemetry data: Real-time OCPP MeterValues transmitted by charging stations — including voltage, current, power factor, temperature, and State of Charge (SoC) where reported by your EV.
• Location data: GPS coordinates when you use the station-finding feature in the EVHub app (only if you grant location permission). We do not track your location outside of active app use.
• Device & app data: Device model, operating system, app version, crash logs, IP address, and app interaction events (screens viewed, buttons tapped).
• RFID usage: Timestamps and station identifiers each time your RFID card is presented at a charger.

• Payment processors: Transaction confirmations and failure codes from MTN, Airtel, Flutterwave, and card networks — not raw financial data.
• OCPI roaming partners: Session and Charge Detail Record (CDR) data for sessions completed on partner CPO networks under roaming agreements.
• Identity verification providers: Verification status (pass/fail) from KYC partners — we do not receive copies of your identity documents.

We use your personal data only for purposes that are necessary to provide our services, comply with our legal obligations, or pursue legitimate interests where these do not override your rights.

Under Ghana's Data Protection Act 2012 (Act 843) and Nigeria's Nigeria Data Protection Regulation 2019 (NDPR) and Nigeria Data Protection Act 2023 (NDPA), we must have a valid legal basis for each category of personal data we process. Our primary bases are:

• Contractual necessity: Processing required to deliver the service you signed up for — account management, charging sessions, and payments.
• Legal obligation: Processing required by Ghanaian or Nigerian law, including KYC obligations under the Anti-Money Laundering Act (Ghana) and AML/CFT regulations (Nigeria), and consumer-protection reporting.
• Legitimate interests: Processing where we have a compelling business reason that does not override your rights — primarily fraud prevention, service improvement, and network security. We carry out a Legitimate Interests Assessment (LIA) before relying on this basis.
• Consent: Processing for optional activities — marketing communications and certain cookie categories. Consent is freely given, specific, informed, and unambiguous, and you may withdraw it at any time without detriment.

We do not process sensitive personal data (health, biometrics, political views, religion) unless legally required to do so and only with explicit consent.

We do not sell your personal data. We share it only where necessary to deliver our services, comply with law, or protect safety — and always subject to contractual data protection obligations.

• Cloud infrastructure: Amazon Web Services (AWS) — hosts EVHub's CSMS, API, and data systems on servers within the EU and Africa regions.
• Payment processors: MTN MoMo API, Airtel Money, Flutterwave — solely to process payment authorisation and confirmation. They receive only what is necessary for the transaction.
• SMS/push notification providers: Twilio and Firebase Cloud Messaging — to deliver session alerts, OTP codes, and account notifications.
• KYC/identity verification: Smile Identity — for identity document verification during account setup. They process identity data on our behalf and do not retain it beyond verification.
• Customer support platform: Zendesk — stores support ticket history and communications. Data is deleted per our retention schedule.
• Analytics: Mixpanel (app analytics) and Google Analytics (website analytics) — receive anonymised or pseudonymised event data only.

When you charge on a partner CPO's network using your EVHub account or RFID card, we share a pseudonymous token identifier and Charge Detail Record (CDR) with that partner. Your name and payment details are not shared — only the token, energy consumed, and billing amount needed to settle the roaming fee.

• We may disclose personal data to the Ghana Data Protection Commission (DPC), the National Information Technology Development Agency (NITDA) in Nigeria, law enforcement agencies, or courts when required by a valid legal order, subpoena, or regulatory request.
• We will notify you of such requests wherever legally permitted to do so.

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

EVHub primarily processes and stores data in Ghana and Nigeria. Some of our service providers (such as AWS and Twilio) may process data in the European Union, United Kingdom, or United States. When this occurs, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms that bind our service providers to equivalent privacy standards.
• Adequacy decisions: Where the destination country has been granted an adequacy decision by relevant regulatory authorities.
• Binding Corporate Rules: For transfers within corporate groups subject to BCR approval.

You may request details of the specific safeguards applicable to any particular data transfer by contacting our Data Protection Officer.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our standard retention periods are:

When the retention period expires, data is securely deleted or irreversibly anonymised. Where data must be retained longer due to an ongoing legal dispute, regulatory investigation, or court order, we will retain it only for that purpose and restrict access to it.

Under the Ghana Data Protection Act 2012 and Nigeria's NDPA 2023, you have the following rights in relation to your personal data. We honour all valid requests within 30 days, and will explain in writing if an extension or exemption applies.

• In the EVHub app: Account → Privacy → Data Requests — for access, deletion, and download requests.
• By email: privacy@evhubltd.com — include your registered phone number and the nature of your request.
• By post: Data Protection Officer, EVHub Limited, Accra, Ghana.

Our website (evhubltd.com) uses cookies and similar technologies. The EVHub mobile app does not use browser cookies but uses equivalent device-level identifiers for analytics and crash reporting.

You can manage your cookie preferences at any time via the Cookie Settings link in the website footer, or by adjusting your browser settings. Note that disabling functional or analytics cookies will not affect your ability to use the EVHub charging network.

EVHub's services are not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. In Ghana, the age of digital consent is 18 as defined by the Data Protection Act 2012. In Nigeria, the NDPA 2023 sets the age of consent at 18.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete that data promptly. If you believe we may have collected data from a minor, please contact us immediately at privacy@evhubltd.com.

We implement technical and organisational security measures proportionate to the sensitivity of your data and the risks involved in processing it.

• All data in transit is encrypted using TLS 1.3.
• All data at rest is encrypted using AES-256.
• Payment card data is tokenised — raw card numbers are never stored on EVHub systems.
• API access uses OAuth 2.0 with short-lived JWT tokens and refresh token rotation.
• OCPP charger connections use mutual TLS certificate authentication.
• Database access is restricted by role-based access control (RBAC) with least-privilege principles.
• Multi-factor authentication (MFA) is enforced for all EVHub staff systems.
• Penetration testing is conducted by a qualified third party at least annually.

• All staff with access to personal data complete mandatory data protection training on joining and annually thereafter.
• Access to production systems is limited to staff with a documented operational need.
• A formal Data Breach Response Plan is in place, tested annually.
• Vendors and processors are assessed for security compliance before engagement.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (Ghana DPC / Nigeria NITDA) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

We may update this Privacy Policy from time to time to reflect changes in our services, applicable law, or industry best practice. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification to your registered email address at least 30 days before the new policy takes effect.
• Display a prominent in-app notification requiring you to review and acknowledge the updated policy on your next login.
• Maintain an archive of previous versions of this policy, available on request.

Your continued use of EVHub's services after the effective date of an updated policy constitutes acceptance of the changes. If you do not accept a material change, you may close your account before the effective date — your data will be handled in accordance with the policy in effect at account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us through any of the following channels. We aim to respond to all privacy-related requests within 5 business days.