Voltz Energy Solutions Ltd ("Voltz", "we", "us", "our") operates a mobile EV charging and roadside assistance service, with depots in Westerham and Southampton, United Kingdom. We are the data controller for the personal data described in this policy.

Registered office: 6 The Flyers Way, Westerham, Kent TN16 1DE

Company number: 15501132

We collect the following categories of personal data when you book or use our mobile charging service:

• Contact details: name, phone number, email address

• Vehicle information: make, model, registration, vehicle type, and any details you provide about a fault or condition affecting your vehicle

• Location data: the address or coordinates where your vehicle is located, and access instructions (e.g. gate codes, parking restrictions) needed for our operative to reach you

• Payment data: we do not directly store your card details. Payments are processed via our payment provider, Teya, through a secure hosted payment link. See Section 5 below

• Service records: booking history, callout outcomes, charging session data (e.g. kWh delivered), and any communications between you and Voltz or our operatives

• Recovery-related information: if your vehicle cannot be charged and you choose to arrange recovery, we may hold limited details of that arrangement where our operative assists you in sourcing a recovery provider

We use your personal data to:

• Take payment for and fulfil your booking, including dispatching a mobile charging unit and operative to your location

• Communicate with you about your booking, including estimated arrival times, delays, and outcome of the callout

• Assess site safety and access requirements before and during deployment

• Provide customer support and resolve any disputes or complaints

• Maintain records for accounting, tax, and regulatory compliance purposes

• Improve our service, including analysing callout outcomes and operational performance

• Meet our legal and health & safety obligations, including those relating to our operatives' safety at your location

We rely on the following legal bases under UK GDPR:

• Contract: processing necessary to perform the booking you have made with us

• Legal obligation: where we must retain records for tax, accounting, or health & safety purposes

• Legitimate interests: for service improvement, fraud prevention, and operative safety planning, where this does not override your rights

• Consent: where you have separately agreed, for example to marketing communications

Payments are handled by Teya, our third-party payment processor, via a secure hosted payment link. Teya collects and processes your card details directly; Voltz does not receive, store, or have access to your full card number. Teya's processing is subject to its own privacy policy and is PCI DSS compliant. We recommend you review Teya's privacy notice for details of how it handles your payment data.

We may share your data with:

• Teya, to process your payment

• Our operatives and depot staff, to the extent necessary to attend your booking safely and effectively

• Third-party recovery providers, only where you have asked our operative to help you source recovery, and only to the extent necessary to make that introduction. Any subsequent data sharing with a recovery provider you engage is between you and that provider, and is not governed by this policy

• Our IT and software providers, who help us operate booking, dispatch, and payment systems, under appropriate data processing agreements

• Regulators, insurers, or legal advisors, where required by law or to establish, exercise, or defend legal claims

We do not sell your personal data to third parties.

Where any of our service providers store or process data outside the UK, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement or adequacy regulations, before any such transfer takes place.

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, and no longer. Where a period is stated below, this is a maximum: we will delete or anonymise data sooner if it is no longer needed for that purpose.

• Booking and financial records (invoices, payment references, callout records): 6 years from the end of the financial year they relate to, in line with HMRC recordkeeping requirements and the standard contract limitation period under the Limitation Act 1980

• Health & safety records relating to a callout (e.g. incident reports, risk assessments): 3 years from the date of the callout, reflecting the standard personal injury limitation period. Where a record relates to a minor, or involves a reportable incident under RIDDOR, we will retain it for longer where appropriate to reflect the extended period in which a claim could be brought

• Payment card data: not held by Voltz. Teya retains this in line with its own retention policy and PCI DSS obligations; Voltz retains only the transaction reference and amount, subject to the 6-year period above

• Marketing consent and communication preferences: retained while consent remains active, plus 12 months after you unsubscribe or your consent lapses, to allow us to evidence compliance if a complaint is raised

• Vehicle telematics or location logs generated by our charging units: 30 days, unless the data relates to a specific incident or dispute, in which case it is retained only for as long as needed to resolve that matter

Where data is no longer required, we securely delete or anonymise it.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you

• Request correction of inaccurate data

• Request erasure of your data, subject to our legal retention obligations

• Object to or restrict certain processing

• Request data portability, where technically feasible

• Withdraw consent at any time, where processing is based on consent

• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, please contact us using the details in Section 12.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including restricting access to booking and location data to staff who need it to fulfil your service.

We may update this policy from time to time to reflect changes in our service or legal requirements. The current version will always be available at voltzgroup.co.uk/privacy-policy, and material changes will be dated at the top of this document.

If you have questions about this policy or how we handle your data, please contact:

Voltz Energy Solutions Ltd

Email: privacy@voltzgroup.co.uk

Address: 6 The Flyers Way, Westerham, Kent TN16 1DE