Privacy Policy

2. The Information We Collect

Depending on whether you are an EV driver, station attendant, or charge point operator, we collect the following categories of information:

3. Vehicle & Charging Telemetry

When your electric vehicle is connected to a Tharwa EV charging station, our Open Charge Point Protocol (OCPP) engine exchanges continuous telemetry with the charger:

• Energy Metrics: Total electricity dispensed (kWh), starting and stopping meter readings, current power delivery rate (kW), voltage, current amperage, and power factor.
• Session Duration: Plug-in timestamp, active charging duration, session end timestamp, and vehicle disconnect timestamp.
• Hardware & Safety Diagnostics: Connector temperature readings, ground fault alerts, pilot signal states, and emergency stop triggers to guarantee physical and electrical safety.

This telemetry is necessary to bill your session accurately, prevent battery degradation or overvoltage, and provide you with live charging curve insights.

4. How We Use Your Information

We process your personal information strictly for legitimate operational purposes:

5. Legal Bases for Processing

Under the NDPR and applicable data protection legislation, we only process your personal data under the following legal bases:

• Contractual Necessity: To deliver charging sessions, authenticate users, and manage digital wallets in accordance with our Terms of Service.
• Legal Obligation: Complying with Nigerian tax legislation, fiscal reporting, and Anti-Money Laundering (AML) directives.
• Legitimate Interests: Protecting the physical security of charging infrastructure, preventing fraudulent charge-backs, and optimizing network grid stability.
• Consent: For sending optional promotional communications, surveys, or location-based station recommendations. You may withdraw consent at any time.

6. Payment Processing & Financial Security

All digital wallet funding, card processing, and bank account payouts on Tharwa EV are executed via Paystack Payments Limited, a Central Bank of Nigeria (CBN) licensed Payment Service Provider and PCI-DSS Level 1 certified entity.

When a Dedicated Virtual Account (DVA) is provisioned for your wallet, your name and phone number are verified to create the secure collection account. Tharwa EV does not possess or store your banking PINs, biometric credentials, or unmasked credit card details. Any temporary authorization hold placed on your wallet balance during an active charging session is reconciled automatically down to the exact kobo upon session termination.

7. Geolocation & Queue Management

With your explicit device permission, we collect precise latitude and longitude coordinates while the Tharwa EV mobile application is open to:

• Display nearby charging hubs and navigate you to the closest available charging connector.
• Calculate travel ETA and maintain your position in the station's live virtual queue.
• Verify your physical presence at the station forecourt to initiate safety unlocks.

You can disable location tracking at any time in your mobile device operating system settings, though this will require manually searching for station names or typing charger IDs.

8. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to advertisers.

We share personal data strictly with trusted service providers under binding data processing agreements:

• Station Operators & Attendants: Station operators receive operational details (e.g. vehicle model, queue reference code, connector type, energy delivered) necessary to service your vehicle. They do not receive your password, full payment instruments, or home address.
• Infrastructure & Cloud Providers: Supabase and Amazon Web Services (AWS) for secure, encrypted cloud hosting and telemetry storage.
• Notification Services: Firebase Cloud Messaging (Google FCM) and SMS gateway providers to send session start/stop notifications, security OTPs, and receipts.
• Regulatory Authorities: Law enforcement or statutory bodies where required by a valid court order or under Nigerian law.

9. Data Security & Storage

We implement bank-grade administrative, technical, and physical safeguards to safeguard personal information:

• Encryption: All data transmitted between user apps, charging stations, and backend APIs is encrypted using Transport Layer Security (TLS 1.3). Sensitive database records are encrypted at rest using AES-256.
• Access Controls: Strict role-based access control (RBAC) ensures only authorized personnel can access operational telemetry.
• Vulnerability Management: Continuous penetration testing, security scanning, and automated intrusion detection.

10. Data Retention Schedules

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected:

• Active Accounts: Account profiles and wallet balances are retained as long as your account remains active.
• Charging Logs & Invoices: Charging transaction records are retained for seven (7) years to comply with statutory accounting and tax regulations in Nigeria.
• Live Location & Queue Logs: Ephemeral queue tracking coordinates are expunged within thirty (30) days of session completion.

11. Your Legal Rights & Account Deletion

Under the NDPR and applicable data protection regulations, you possess enforceable rights regarding your data:

• Right of Access: Request a full copy of the personal information and charging history we hold about you.
• Right to Rectification: Update or correct inaccurate account details directly in the app or portal.
• Right to Data Portability: Request an export of your session logs in machine-readable JSON/CSV format.
• Right to Erasure (Account Deletion): Request permanent deletion of your Tharwa EV account and personal data.

12. Cookies & Analytics

Our web portals utilize essential cookies and secure local storage tokens strictly required for user authentication, CSRF security, and maintaining your session state. We do not deploy invasive third-party cross-site advertising trackers. You can manage cookie settings via your browser preferences.

13. Contact our Data Protection Officer (DPO)

If you have questions, feedback, or complaints regarding this Privacy Policy or our compliance with the Nigeria Data Protection Regulation, please reach out to our designated Data Protection Officer:

If you believe your data protection inquiry has not been resolved satisfactorily, you retain the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.