EVChargeLK Privacy Policy

The data controller for the Services is EV CHARGE LK (PVT) LTD, Company No. PV00370339, No. 252, Coco Village, Isabel Estate, Weeralanda, Kumarakattuwa 61032, Sri Lanka. Privacy enquiries and data-subject requests may be submitted to info@evchargingpoint.lk.

We operate primarily in Sri Lanka. We design this Policy to comply with applicable Sri Lankan law, including the Personal Data Protection Act, No. 9 of 2022 as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, the Consumer Affairs Authority Act, No. 9 of 2003 and applicable e-commerce directions, and the Electronic Transactions Act, No. 19 of 2006 as amended. The core processing, controller and processor provisions of the PDPA are scheduled to commence on 1 January 2027 under Gazette Extraordinary No. 2498/16; we are adopting these controls in advance where practicable.

Account and identity data: name, email address, mobile number, login credentials or authentication identifiers and account preferences.

Vehicle data: vehicle make/model, battery/range information, charging preferences and other vehicle information you choose to provide.

Location and trip data: current or approximate location, searched start and destination locations, routes, charging-stop selections, saved trips and navigation-related information. Location data is treated as personal data where it can identify or be linked to you.

Charging activity data: charging-point searches, station views, bookings, favourites, reviews, support requests and other interactions with the Services.

Subscription and transaction data: subscription plan, transaction identifiers, purchase status, dates, currency, refunds and platform receipt information. Where Apple or Google processes the payment, we generally receive transaction/status information rather than your full card number.

Device and technical data: IP address, device type, operating system, app version, language, crash logs, diagnostics, identifiers and security information.

Communications: information you provide when contacting us, including support correspondence.

Website data: cookies, similar technologies and usage information as described in the Cookie and Tracking Policy.

Create and administer your account.

Provide the charging-point map, nearest-charger search and trip-planning functions.

Calculate or recommend charging stops using vehicle range, trip route and station data.

Provide navigation links and map functionality.

Process subscriptions, verify purchases, manage entitlements, refunds and support.

Maintain, secure, troubleshoot and improve the Services.

Communicate service notices, security alerts, account information and support responses.

Prevent fraud, abuse, unauthorized access and misuse.

Comply with legal obligations and respond to lawful requests.

Send promotional or direct marketing communications only where permitted by applicable law and, where required, with your consent.

Depending on the activity, processing may be necessary to perform a contract with you, to take steps at your request before entering into a contract, to comply with a legal obligation, to protect legitimate interests that are not overridden by your rights, or to obtain your consent. We will not treat consent as a substitute for another appropriate legal basis where the law permits a different basis.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing lawfully carried out before withdrawal, and some Services may no longer function if the relevant data is unavailable.

EVChargeLK uses device location to show your current position, find nearby charging points, support trip planning and provide location-aware features. We aim to request the minimum location permission needed. If the app only needs your location while you are using the feature, we will prefer foreground/while-in-use access.

If a future feature requires background location—for example, an active trip-monitoring feature while the app is not visible—we will request the relevant permission only where necessary, provide a prominent in-app disclosure before requesting the permission, and use the data only for the disclosed feature. Google Play treats device location as personal and sensitive data and requires additional controls for background access.

The Services may use Google Maps Platform, Google Maps SDKs, Places services, routing services or other map providers. Map providers may process location, device, usage and map-request information under their own terms and privacy policies. Our Privacy Policy describes our handling of data; it does not replace a third-party provider’s privacy policy.

Where Google Maps Platform is used, our Terms of Use will state that use of the relevant map functionality is subject to Google’s applicable terms, and our Privacy Policy will disclose the use of Google Maps APIs and incorporate the Google Privacy Policy by reference.

Service providers and processors: hosting, databases, cloud infrastructure, analytics, crash reporting, customer support, authentication, email/SMS, security and other technology providers acting on our instructions.

App stores and payment providers: Apple, Google and/or other payment providers, where applicable, for subscription processing and transaction support.

Map and routing providers: providers such as Google Maps Platform when required to provide map, places or routing functionality.

Charging station operators: where necessary to support a booking, station information, customer request or business relationship; we will not disclose more personal data than reasonably necessary.

Professional advisers, insurers, auditors or authorities where required for legal, regulatory, security or dispute-resolution purposes.

Corporate transactions: in connection with a merger, acquisition, financing, restructuring or sale of relevant assets, subject to applicable law.

We do not sell personal data as a standalone commercial product. We will not share device location for advertising purposes where prohibited by platform policy or applicable law.

Some service providers may process information outside Sri Lanka. Where cross-border processing is used, we will implement the safeguards and contractual controls required by applicable Sri Lankan data-protection law, including the PDPA requirements applicable to cross-border data flows from 1 January 2027, and will provide additional information where required.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including account operation, service records, security, dispute handling, accounting and legal obligations. Retention periods differ by data category. When data is no longer required, we will delete, anonymise or securely dispose of it, subject to lawful retention requirements.

We use reasonable technical and organisational safeguards appropriate to the risks, including access controls, authentication controls, encryption in transit where supported, secure hosting practices, logging, backups and incident-response procedures. No internet transmission or storage system can be guaranteed to be completely secure.

We maintain procedures to identify, contain, investigate, document and remediate personal-data incidents. Where the PDPA or other applicable law requires notification to the Data Protection Authority or affected individuals, we will make the required notification within the applicable legal timeframe. We do not state a fixed statutory 72-hour period in this Policy because Sri Lanka’s current PDPA section 23 leaves the notification period to rules made under the Act.

Request access to personal data we hold about you, subject to applicable law.

Request correction or completion of inaccurate or incomplete data.

Request erasure where legally available.

Withdraw consent where processing relies on consent.

Object to processing where the applicable law provides that right.

Request review of qualifying automated decision-making where applicable.

Submit a privacy complaint to us and, where applicable, to the Data Protection Authority of Sri Lanka.

Requests may be submitted to info@evchargingpoint.lk. We may need to verify your identity before fulfilling a request. Certain requests may be limited or refused where permitted by law.

You may request deletion of your EVChargeLK account through the in-app account settings and through the account-deletion facility made available on our website. We will delete associated personal data unless we are required or permitted by law to retain particular records, such as transaction, security, fraud-prevention or dispute records. Any retained information will be segregated and retained only for the permitted purpose.

EVChargeLK is intended for general users and is not directed to children. Do not create an account or provide personal data if you are not legally permitted to do so. If we learn that we have collected personal data in circumstances where collection was not permitted, we will take appropriate steps to delete or otherwise handle the information in accordance with applicable law.

Our website may use essential cookies and, where enabled, analytics or preference technologies. See our separate Cookie and Tracking Policy.

We may update this Policy to reflect changes to the Services, technology, law or our processing practices. We will publish the revised Policy with an updated effective date and, where appropriate, provide additional notice.

Privacy Contact: info@evchargingpoint.lk
Website: https://evchargingpoint.lk/
Data Protection Authority of Sri Lanka: https://www.dpa.gov.lk/