Privacy Policy

This Policy applies to personal data relating to:

• EV drivers
• Registered SupaChaja users
• Visitors using QR charging
• USSD users
• Fleet drivers
• Fleet Managers
• Vehicle owners
• CPO personnel
• Station operators
• Site Hosts
• Business customers
• Advertisers and brand representatives
• Suppliers and service providers
• Website and app visitors
• Individuals who communicate with SupaChaja

It does not apply to anonymized information that can no longer reasonably identify an individual.

Depending on the service, SupaChaja may act as a data controller, a data processor, or in some cases share responsibility with another organization.

SupaChaja generally acts as a data controller where we determine why and how personal data is processed for purposes such as:

• Creating Driver accounts
• Providing SupaChaja-operated charging services
• Processing Platform payments
• Managing customer support
• Operating our applications and websites
• Administering Digital RFID identities
• Preventing fraud
• Carrying out our own business operations

Where SupaChaja provides CPMS or related services to a third-party CPO, fleet customer or enterprise customer, SupaChaja may process certain information on that organization's instructions. SupaChaja uses appropriate written data-processing arrangements and vendor oversight where required.

The information collected depends on how you interact with SupaChaja.

Account and Identity Information:

• Name
• Mobile telephone number
• Email address
• Account username
• Authentication credentials
• Preferred language
• Account type
• Customer or fleet identifier
• Other information required to maintain your account

Vehicle Information:

• Vehicle registration number
• Make and model
• Model year
• Vehicle type
• Charging connector type
• Charging capability
• Fleet affiliation
• Vehicle ownership or authorization information where required
• Digital RFID identifier

Vehicle information may become personal data where it can be associated with an identifiable Driver or vehicle owner.

Charging Session Information:

• Station and charger ID
• Connector used
• Station location
• Charging-session start and end times
• Energy delivered
• Charging duration
• Session status
• Charging power
• Tariff
• Amount charged
• Payment status
• Transaction reference
• Vehicle associated with the session
• Driver or fleet account associated with the session
• Charger or session fault information

Payment Information:

• Transaction amount
• Mobile-money telephone number
• Payment method
• Payment-provider transaction reference
• Authorization status
• Billing details

Sensitive payment credentials may be processed directly by banks, mobile-money operators or payment gateways. SupaChaja does not require users to disclose their M-PESA PIN to SupaChaja personnel. PINs used to authorize mobile-money transactions should only be entered into the authorized payment workflow.

Where card payments are processed by an external payment gateway, SupaChaja may use payment tokens or transaction references rather than retaining complete card credentials.

Fleet Information:

• Fleet Manager contact details
• Organization details
• Driver identities
• Vehicle assignments
• Digital RFID identities
• Permitted charging stations
• Fleet tariffs
• Charging limits
• Session records
• Consolidated billing records
• Energy-consumption reports

CPO and Site Host Information:

• Telephone and email information
• Organization information
• Station ownership information
• Bank or settlement information
• CPMS user credentials
• Station configuration
• Transaction and settlement data
• Contractual information

Advertiser Information:

• Brand or company name
• Representative contact information
• Billing information
• Campaign requirements
• Campaign creatives
• Contracted locations
• Campaign schedules
• Proof-of-flight information
• Screen-performance information
• Commercial correspondence

Unless separately disclosed, ordinary DOOH advertising delivery does not require SupaChaja to identify individual people viewing a billboard. If SupaChaja introduces future audience-measurement technologies involving identifiable individuals, cameras, biometrics or similar higher-risk technologies, we will assess the privacy impact and provide additional notice where required.

Device and Technical Information:

• IP address
• Device type
• Browser type
• App version
• Device identifiers
• Approximate network location
• Login activity
• Timestamps
• Session logs
• Diagnostic information
• Security events
• Platform usage information

Location Information:

Where you grant location permission, the SupaChaja mobile app may use location information to identify charging stations near you, provide navigation, improve station search results and support location-dependent Platform functionality. You can control device-level location permissions through your phone settings. Use of precise device location is not required for every SupaChaja service.

Customer Support and Communications:

We may retain information you provide through telephone calls, email, customer-support forms, WhatsApp or other approved support channels, in-app communications, complaints, surveys or fault reports.

Directly from you: when you register, enter vehicle information, initiate charging, make a payment, contact support or enter into a commercial relationship with SupaChaja.

Automatically through the Platform: when you use our app, website, QR web application, CPMS or charging infrastructure.

From your Fleet Manager or employer: where they enroll you or your vehicle into a fleet account.

From CPOs and Site Hosts: where necessary to operate charging stations or resolve charging-session issues.

From payment providers: to confirm transactions, refunds or payment status.

From business partners and service providers: where permitted and necessary to provide our services.

SupaChaja processes personal data only where we have an appropriate lawful basis. We may use personal data for the following purposes:

Provide Charging Services:

• Create accounts
• Identify Drivers and vehicles
• Authenticate charging sessions
• Connect users to chargers
• Calculate energy consumption
• Operate session start and stop commands
• Display charging progress
• Provide receipts

Process Payments:

• Payment authorization
• Reconciliation
• CPO settlement
• Fleet billing
• Refunds
• Fraud prevention

Operate Fleet and Digital RFID Services:

• Associate vehicles with fleet accounts
• Authenticate vehicles
• Control access to private or hybrid stations
• Determine authorized tariffs
• Assign charging permissions
• Consolidate billing

Operate the CPMS:

• Station configuration
• Charger monitoring
• Fault detection
• Utilization reporting
• Operator administration
• CPO settlement
• Support

Provide Customer Support:

• Failed charging sessions
• Incorrect charges
• Payment disputes
• Charger faults
• Account problems
• Vehicle compatibility concerns
• Complaints

Improve Our Services:

• Improve charger reliability
• Understand network utilization
• Identify high-demand charging areas
• Improve user experience
• Develop new features
• Diagnose technical issues
• Optimize network operations

Where reasonably possible, we use aggregated or anonymized information for service improvement and analytical purposes.

Performance of a contract: where processing is needed to provide charging, fleet, CPMS, advertising or other services requested by you.

Consent: where you have freely provided informed consent, including for certain marketing, optional device permissions or other processing requiring consent.

Legal obligation: where information must be processed or retained to satisfy applicable tax, accounting, regulatory, law-enforcement or other legal requirements.

Legitimate interests: where necessary for legitimate business purposes such as cybersecurity, fraud prevention, service improvement, network planning or protecting SupaChaja's rights, provided those interests do not improperly override individual rights.

Vital interests: in exceptional circumstances where processing is necessary to protect life or physical safety.

Mobile App:

The app may process:

• Account data
• Charging history
• Vehicle information
• Location where permitted
• Payment information
• Push-notification identifiers
• Session activity

QR Web App:

Scanning a QR code may connect your browser to a specific charger. The QR workflow may process:

• Charger ID
• Browser information
• Session details
• Guest or account information
• Payment transaction information
• IP/network information

USSD:

The USSD workflow may process:

• Mobile number
• Station and charger selection
• Vehicle registration
• Charging amount
• Fleet authorization
• Transaction status

USSD communications also pass through the relevant mobile-network operator.

SupaChaja's Digital RFID system assigns a unique digital identity to registered vehicles. The Digital RFID may be used to:

• Authenticate the vehicle
• Determine authorized charging locations
• Verify fleet membership
• Apply applicable fleet tariffs
• Approve a charging session
• Direct session charges to the appropriate fleet account

A Digital RFID is a Platform credential and is not itself proof of legal vehicle ownership. SupaChaja does not require Digital RFID to be a physical card.

SupaChaja may use charging-session information to calculate environmental indicators such as:

• Electricity consumed
• Estimated fuel displacement
• Estimated greenhouse-gas emissions avoided
• Carbon intensity
• Network-level emissions reductions
• Other environmental performance metrics

Where appropriate, this information may be aggregated, anonymized or pseudonymized for sustainability reporting, environmental-impact reporting, climate-finance analysis, carbon-project development, verification, audit or carbon-market activities.

Individual Driver identity will not ordinarily be necessary for public environmental reporting. Where a regulatory authority, auditor, verifier, registry or carbon-program standard requires supporting records, SupaChaja may disclose the minimum information reasonably necessary subject to applicable safeguards and law.

SupaChaja may use automated systems, rules and analytics to support:

• Session authorization
• Fleet access control
• Fraud detection
• Abnormal transaction detection
• Charger monitoring
• Dynamic tariffs
• Network optimization
• Security monitoring
• Service recommendations

Where a decision is based solely on automated processing and produces a legal or similarly significant effect on an individual, applicable data-protection rights may include the ability to request human intervention or review.

Our websites and web applications may use cookies and similar technologies for authentication, session management, security, remembering preferences, performance analytics and improving website functionality.

Where required, users will be provided with choices regarding non-essential cookies. SupaChaja should maintain a separate Cookie Notice identifying the cookies used, their purpose, duration and third-party involvement.

SupaChaja may send information about new charging stations, Platform features, EV products, charging offers, network updates, fleet services or other SupaChaja products and services.

Where consent is required, marketing communications will only be sent after obtaining the necessary consent. Marketing messages will provide a reasonable way to unsubscribe or opt out. You may unsubscribe from marketing without affecting essential operational messages relating to your account, payment, safety or charging sessions.

SupaChaja will not use identifiable personal data for unrelated third-party commercial purposes without an appropriate lawful basis. We may use aggregated or anonymized statistics for legitimate commercial and strategic purposes where the information can no longer reasonably identify an individual.

Charging Point Operators: charging-session delivery, charger support, fault investigation, transaction reconciliation and station operations.

Fleet Managers: authorized fleet vehicles and Drivers, including charging activity, energy consumption, station usage, tariffs, billing and vehicle-level reports.

Payment Providers: mobile-money operators, banks, card processors and payment gateways.

Technology Providers: cloud hosting, communications, software, analytics, mapping, cybersecurity and customer-support providers .

Professional Advisers: lawyers, auditors, insurers or accountants where necessary.

Regulators and Government Authorities: where disclosure is required or permitted by applicable law.

Business Transactions: where SupaChaja undergoes financing, restructuring, merger, acquisition or sale, subject to appropriate confidentiality and data-protection safeguards.

SupaChaja uses appropriate contractual arrangements and due diligence for processors and vendors where required.

SupaChaja's DOOH advertising business does not give Brand Advertisers unrestricted access to Driver account information, charging histories, telephone numbers or payment records.

Advertisers may receive campaign-performance or audience information in aggregated form where individuals are not identified. Any future use of identifiable Driver information for advertiser targeting would require a valid lawful basis and additional disclosure or consent where required.

Some service providers may process or host personal data outside Kenya. Where personal data is transferred internationally, SupaChaja will take reasonable steps to ensure the transfer satisfies applicable Kenyan requirements, which may include:

• Appropriate contractual safeguards
• Assessment of the recipient jurisdiction
• Security controls
• Necessity of the transfer
• Consent where specifically required

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, contractual, accounting, tax, dispute-resolution, security and regulatory requirements.

Account information: while the account remains active and for an appropriate period afterward.

Charging and transaction records: as necessary for billing, reconciliation, accounting, fraud prevention and legal compliance.

Fleet and Digital RFID records: while the relevant fleet relationship or vehicle authorization remains active and afterward where necessary.

CPO and commercial agreements: for the contractual relationship and applicable legal-retention period.

Support records: as necessary to resolve complaints, disputes and operational matters.

Security logs: for an appropriate security-monitoring period.

Marketing preferences: while marketing is active and thereafter as necessary to maintain opt-out records.

When personal data is no longer required, SupaChaja will delete, securely destroy, anonymize or otherwise render it inaccessible in accordance with applicable policy and law.

SupaChaja uses technical and organizational measures designed to protect personal data against unauthorized access, loss, destruction, alteration, unlawful disclosure, misuse and unauthorized processing.

Depending on the systems involved, measures may include:

• Access controls
• Role-based permissions
• Authentication controls
• Encryption where appropriate
• Secure communications
• Monitoring and audit logs
• System backups
• Vulnerability management
• Network security
• Restricted administrative access
• Employee confidentiality requirements
• Vendor-security assessments
• Incident-response procedures
• Staff training

No technology system can guarantee absolute security.

SupaChaja aims to consider privacy and data minimization when developing new Platform features and services. Where proposed processing is likely to create a high risk to individuals' rights and freedoms, SupaChaja will assess whether a Data Protection Impact Assessment ("DPIA") is required before implementation.

This may be particularly relevant to future technologies involving:

• Systematic location tracking
• Large-scale behavioral analytics
• Biometric identification
• Advanced automated decision-making
• Novel vehicle identification
• Extensive data integration
• High-risk advertising measurement

SupaChaja maintains procedures for identifying, assessing, containing and responding to personal-data incidents. Where a breach meets applicable notification requirements, SupaChaja will notify the Office of the Data Protection Commissioner and affected individuals as required by law.

Where affected individuals face a significant risk, communications may include:

• The nature of the breach
• Information affected
• Measures taken
• Recommended protective actions
• An appropriate contact point

Be Informed

Understand what personal data is collected, why it is processed and who may receive it.

Access Your Personal Data

Request confirmation and access to personal data held about you.

Correct Your Information

Ask SupaChaja to rectify information that is incorrect or incomplete.

Request Deletion

Ask for deletion where personal data is no longer required, has been processed unlawfully or another lawful ground for erasure applies.

Restrict Processing

Request that certain processing is temporarily or permanently limited where applicable.

Object to Processing

Object to certain processing, including direct marketing.

Withdraw Consent

Where processing is based on consent, you can withdraw that consent without affecting processing lawfully carried out before withdrawal.

Data Portability

Where applicable, request certain personal data in a structured, commonly used and machine-readable form.

Challenge Certain Automated Decisions

Where applicable, request human review of qualifying solely automated decisions.

We may need to verify your identity before fulfilling a request. Some requests may be restricted where retaining or processing information is required by law or necessary to protect another person's rights.

Privacy requests may be submitted to:

Company

SupaChaja Limited

Email

info@supachaja.com

Website

www.supachaja.com

Please clearly describe the request and provide sufficient information for us to verify your identity and locate the relevant information. SupaChaja will respond within applicable statutory timelines.

If you are dissatisfied with how a privacy request or complaint has been handled, you may escalate the matter to Kenya's Office of the Data Protection Commissioner.

SupaChaja's Driver and commercial Platform services are intended for individuals who are legally capable of entering into the relevant service arrangement. We do not knowingly create independent charging accounts for children under 18 without appropriate authority.

If we become aware that personal data belonging to a child has been collected improperly, we will take reasonable steps to delete or otherwise appropriately process the information. Any future SupaChaja service intentionally directed toward minors will be subject to appropriate parental or guardian controls and additional safeguards.

SupaChaja serves users across a broad range of devices, literacy levels and connectivity conditions. We aim to provide understandable privacy information through accessible channels including the mobile application, website, QR web application and, where practicable, other communication formats.

The Platform may contain links to websites, payment systems, maps, app stores or other third-party services. Those organizations may process personal data under their own privacy policies. SupaChaja is not responsible for independent third parties' privacy practices where SupaChaja does not control their processing. We encourage users to review the privacy information of third-party services they use.

SupaChaja may update this Privacy Policy to reflect new products, new technologies, changes to charging or fleet services, changes to payment systems, legal or regulatory developments, new advertising capabilities, new carbon-market activities or changes to our data-handling practices.

Material changes will be communicated through the Platform or other appropriate means. The current version and effective date will be displayed on the SupaChaja website.

For questions, complaints, rights requests or concerns about SupaChaja's handling of personal data, contact:

Company

SupaChaja Limited

Location

Nairobi, Kenya

Email

info@supachaja.com

Website

www.supachaja.com