Privacy Policy

1. Introduction

Current Power Solutions LLC ("Current Power," "we," "us," or "our"), a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 7053939190, is committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently.

This Privacy Policy explains what personal data we collect through the Current Power mobile application ("App") and our electric vehicle charging network ("Network"), why we collect it, who we share it with, how long we keep it, and the rights available to you.

We process personal data in accordance with the Saudi Arabia Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations ("PDPL"). This Policy forms part of, and should be read together with, our Terms and Conditions.

Current Power Solutions LLC is the data controller responsible for the personal data described in this Policy. For any privacy question, request, or complaint, contact us at info@current-power.com.

2. Scope

• This Policy applies to all Users of the App and the Network, to visitors of our websites, and to individuals who apply to host a charger as a Current Power partner.
• It does not apply to the independent data processing practices of third parties, including payment gateways, map providers, app stores, and mobile operating system vendors, whose own privacy policies govern their processing of your data.

3. Personal Data We Collect

We collect only the data we need to operate the App and Network. The categories below reflect the data actually processed by our services.

3.1 Account and identity data

• Name, email address, and password (stored only as a salted cryptographic hash — we never store your password in readable form).
• Optional profile details you choose to provide: first and last name, mobile number, profile photo, biography, date of birth, gender, and address details (city, country, postal code).
• Where you sign in with Google or Apple, the identifier, name, email address, and profile picture released to us by that provider. We do not receive your password for those accounts.
• Your language, theme, and notification preferences.

3.2 Vehicle data

• Vehicle nickname, make, model, year, colour, battery capacity, maximum charging power, and connector compatibility.
• Optionally, your vehicle identification number (VIN), licence plate number, and any RFID charging tag associated with your Account.

3.3 Location data

• Your device's approximate or precise location, collected only while the App is open and in use, and only after you grant location permission, in order to show nearby Charging Stations, calculate distances, and provide routing.
• We do not track your location in the background and we do not build location histories or movement profiles about you.
• Destination searches and route requests you enter, and stations you bookmark or rate.
• You may revoke location permission at any time in your device settings, or disable location use within the App's settings screen. Station discovery by map will be limited if you do so.

3.4 Charging session data

• Charging Station and connector used, session start and stop times, stop reason, meter readings and interim power/energy samples reported by the charger, total energy delivered in kWh, applicable tariff, and total cost.
• Session status updates streamed to your device in real time while charging is active.
• Aggregated statistics derived from your sessions, shown to you in the App's history and analytics views.

3.5 Payment and billing data

• Payment method details in tokenised form only: a gateway token, card brand, last four digits, expiry month and year, and cardholder name. We do not store your full card number, magnetic stripe data, or CVC/CVV on our systems.
• Card details you enter in the App are transmitted directly to our PCI DSS compliant payment gateway for tokenisation. Where you pay with Apple Pay, we receive only the payment result and a device-specific token.
• Transaction records: amounts, currency, status, gateway reference, refunds, wallet balance and wallet top-up or deduction history.
• Strong customer authentication (3-D Secure) is performed by your card issuer within a secure web view; we do not receive your authentication credentials.

3.6 Device and technical data

• Device brand, manufacturer, model, device name, operating system and version, app version, and a device identifier used to register your device with your Account.
• Push notification token issued by Apple Push Notification service or Firebase Cloud Messaging, used solely to deliver notifications to your device.
• Server log data generated automatically when your device or browser contacts our services: IP address, date and time, requested endpoint, response status, and user agent. This is used for security, abuse prevention, rate limiting, and fault diagnosis.

3.7 Support and communications data

• The content of support requests, fault reports, ratings, reviews, and correspondence you send us, together with any information you choose to include.
• Where you submit an in-app problem report, technical context about your device, app version, and the screen you were on is attached to help us reproduce the issue.
• In-app notifications we have sent you and whether they have been read.

3.8 Partner and host data (applies only if you apply to host a charger)

• National ID number and an image of your national identity document, mobile number, and verification status.
• Bank payout details: bank name, account holder name, IBAN, and account type, together with payout records and bank transfer references.
• Charger and site details: serial number, brand and model, connector type, pricing, electricity utility account and meter identifiers, site address and coordinates, availability schedule, and site photographs.
• These categories include sensitive identity and financial data and are collected only where necessary to verify your eligibility, meet regulatory and anti-fraud obligations, and pay you your earnings.

4. How We Collect Personal Data

• Directly from you: when you register, complete your profile, add a vehicle or payment method, apply to become a partner, or contact support.
• Automatically: from your device and from our servers when you use the App, and from Charging Stations during a Charging Session.
• From third parties: from Google or Apple when you use social sign-in, and from our payment gateway when a payment succeeds, fails, or is refunded.

5. Why We Use Your Personal Data and Our Legal Basis

We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects for you or for behavioural advertising profiling.

6. Sharing and Disclosure

We share personal data only where necessary, and only with the following categories of recipients:

• Payment service providers. Our payment gateway processes card tokenisation, payments, 3-D Secure authentication, and refunds. Payment card networks and your card issuer receive the data necessary to complete the transaction.
• Mapping and routing providers. Map tiles, place searches, and route calculations are served by our maps provider, which receives the coordinates or search text necessary to answer the request.
• Push notification providers. Apple and Google deliver notifications to your device using the push token issued by your operating system.
• Identity providers. Google and Apple, where you choose to sign in through them.
• Hosting and infrastructure providers. Providers of cloud hosting, databases, caching, real-time messaging, and media processing, acting on our instructions under confidentiality obligations.
• Charger hosts and partners. Where you charge at a partner-hosted station, the partner receives limited session and settlement information, which may include your display name, the energy delivered, session duration, and the amount payable to them. They do not receive your contact details, payment credentials, or location history.
• Professional advisers and auditors. Legal, accounting, and audit advisers bound by professional confidentiality.
• Competent authorities. Regulators, law enforcement, courts, and tax authorities where disclosure is required by applicable law or is necessary to establish, exercise, or defend legal claims.
• Corporate transactions. An acquirer or successor entity in connection with a merger, acquisition, restructuring, or sale of assets, subject to this Policy continuing to apply to the transferred data.

All service providers acting as processors on our behalf are engaged under agreements that restrict them to processing personal data solely for the purposes we specify and require appropriate security safeguards.

7. Cross-Border Transfers

• We host and process personal data primarily within the Kingdom of Saudi Arabia. Certain service providers described in Section 6 may process limited data outside the Kingdom.
• Where personal data is transferred outside the Kingdom, we do so only on a basis permitted by the PDPL and its Implementing Regulations, and only after taking steps to ensure an adequate level of protection, including contractual safeguards and limiting the transfer to the minimum data necessary.
• You may contact us at info@current-power.com for information about the safeguards applied to a specific transfer.

8. Retention

We keep personal data only for as long as necessary for the purposes described in this Policy, or for longer where required by law.

Where we are required to retain transaction records after your Account is closed, we minimise the data retained to what the applicable obligation requires.

9. Security

• All traffic between the App, our websites, and our servers is encrypted in transit using TLS.
• Passwords are stored only as salted one-way hashes; we cannot recover or read them.
• Payment card data is tokenised by our PCI DSS compliant gateway and is not stored on our systems.
• Access to production systems and personal data is restricted to authorised personnel on a need-to-know basis and is authenticated.
• We apply rate limiting, monitoring, and logging to detect and respond to abuse and unauthorised access attempts.
• No method of transmission or storage is completely secure. You are responsible for keeping your Account credentials confidential and for securing the device on which the App is installed. Notify us immediately at info@current-power.com if you believe your Account has been compromised.
• Where a personal data breach occurs, we will notify the competent supervisory authority and affected Users where required by the PDPL and within the timeframes it prescribes.

10. Data Stored on Your Device

• The App stores certain data locally on your device so it can function, including your session token, basic account details, language and theme preference, your selected vehicle, recent searches, and any active charging session state.
• You can clear this data at any time by signing out of the App, or by uninstalling or clearing the App's data through your device settings.
• Our websites use only the cookies and equivalent technologies necessary to deliver and secure the site. We do not use advertising or cross-site tracking cookies.

11. Your Rights

Subject to the conditions and exceptions of the PDPL, you have the right to:

• Be informed of the legal basis and purposes for which we collect your personal data.
• Access your personal data and request a copy of it in a readable, portable format.
• Request correction of personal data that is inaccurate, incomplete, or out of date.
• Request destruction of personal data that is no longer necessary for the purposes for which it was collected.
• Withdraw your consent at any time where our processing relies on consent, including location access, push notifications, and marketing messages.
• Object to or restrict processing based on our legitimate interests, in the circumstances permitted by law.
• Lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) as the competent supervisory authority.

You can exercise many of these rights directly in the App by editing your profile, managing your vehicles and payment methods, adjusting notification settings, and revoking location permission. For anything else, email info@current-power.com from the address registered to your Account. We will respond within thirty (30) days of receiving a valid request, and will tell you if we need an extension or additional information to verify your identity. Exercising your rights is free of charge.

Where we cannot fully satisfy a request, for example because we must retain transaction records to meet a legal obligation or to defend a legal claim, we will explain the reason.

12. Account Closure and Deletion

• You may close and delete your Account at any time from within the App (Menu → Profile → Delete Account), from our account deletion page, or by emailing info@current-power.com.
• Before we can close your Account, any outstanding balance must be settled and any active Charging Session must be completed.
• On closure we delete or anonymise your profile, vehicle, device, and preference data, and remove your stored payment tokens. Financial and session records are retained in minimised form for the statutory periods described in Section 8.
• We will confirm completion of your deletion request within thirty (30) days.

13. Children

• The App and Network are intended for Users aged 18 years or older, consistent with our Terms and Conditions. We do not knowingly collect personal data from children.
• If we become aware that we have collected personal data from a person under 18 without the consent of their guardian, we will delete it promptly. If you believe this has occurred, contact info@current-power.com.

14. Third-Party Services and Links

• The App and Network integrate or link to third-party services, including map providers, payment processors, identity providers, and app stores.
• Those services process your data under their own privacy policies. We do not control, and are not responsible for, their practices. We encourage you to review their policies before use.

15. Changes to This Policy

• We may update this Policy to reflect changes in our services, technology, or legal obligations.
• Material changes will be communicated through the App, by email, or by other reasonable means at least fourteen (14) days before they take effect, and the "Last Updated" date at the top of this page will be revised.
• Where a change requires your consent under applicable law, we will obtain it before the change applies to you. Continued use of the App or Network after the effective date of a revised Policy indicates acceptance of the update.

16. Contact Us

• Company: Current Power Solutions LLC (شركة حلول قوة التيار)
• Commercial Registration: 7053939190
• Privacy enquiries and data subject requests: info@current-power.com
• Website: www.current-power.com
• Kingdom of Saudi Arabia

If you are not satisfied with our response, you may escalate your complaint to the Saudi Data & Artificial Intelligence Authority (SDAIA).