Privacy Policy

Effective date: 21 October 2025

1. Introduction and scope
2. Key definitions
3. Data protection principles
4. Lawful bases for processing
5. Categories of personal data collected
6. How we collect your data
7. How we use personal data
8. Consent and withdrawal
9. Transparency and fair processing
10. Purpose limitation
11. Data minimisation and accuracy
12. Data retention
13. Security and confidentiality
14. Personal data breaches
15. International transfers
16. Data subject rights
17. Automated decision‑making and profiling
18. Direct marketing and cookies/SDKs
19. Sharing personal data
20. Contact details and complaints
21. Changes to this notice
22. Children

1. Introduction and scope

This privacy notice explains how Grine Technologies Ltd (also referred to as we, us or our) collects, uses and protects personal data in connection with our power‑bank rental service and any associated websites or mobile applications (the Service). It describes your rights and how to exercise them. We comply with the retained EU law version of the General Data Protection Regulation (UK GDPR), the Data Protection Act 2018. This notice applies to anyone who uses or intends to use the Service. It supplements, and does not replace, our internal data protection policies.

2. Key definitions

Personal data - information relating to a living individual who can be identified directly or indirectly. This includes names, contact details, device identifiers, location data, payment details and any other information we collect that can identify you.

Processing - any operation performed on personal data, such as collection, recording, organisation, storage, modification, retrieval, consultation, disclosure, erasure or destruction.

Controller - the organisation that decides why and how personal data is processed. We are the controller of the data collected through the Service.

Data subject - the person to whom personal data relates. In this notice, "you" refers to data subjects who use the Service.

Special category data - sensitive personal data such as information about health, racial or ethnic origin, religious beliefs or sexual orientation. We generally do not collect special category data in the course of providing the Service.

3. Data protection principles

We process personal data in accordance with the following principles derived from the UK GDPR:

Lawfulness, fairness and transparency - we process data only where we have a legal basis, we act fairly and openly, and we provide clear information about how we use your data.
Purpose limitation - we collect data for specified, explicit and legitimate purposes and do not use it for other incompatible purposes.
Data minimisation - we collect only the data needed for our purposes and no more.
Accuracy - we keep personal data accurate and up to date.
Storage limitation - we retain data for as long as necessary to fulfil our purposes and then delete or anonymise it.
Integrity and confidentiality - we protect personal data with appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Transfer limitation - we only transfer personal data outside the UK when we have a lawful basis and appropriate safeguards.
Rights and accountability - we respect your rights as a data subject and can demonstrate our compliance with these principles.

4. Lawful bases for processing

We must have at least one legal basis for processing your personal data. Depending on the context, we rely on:

Contractual necessity - we process data to perform our contract with you, including creating and managing your account, providing the Service, taking security deposits and rental fees, arranging refunds, and communicating with you.
Legal obligations - we process data to comply with laws and regulations, such as accounting, tax and consumer protection, and to respond to lawful requests from authorities.
Legitimate interests - we process data to pursue our legitimate business interests, such as operating and improving the Service, preventing fraud and misuse, ensuring the safety of devices and our network, conducting analytics, and communicating service updates. We balance these interests against your fundamental rights and freedoms.
Consent - where we need your consent (for example, for marketing communications or the use of optional cookies), we will request it in a clear and specific way. You may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

5. Categories of personal data collected

We may collect the following categories of data:

1. Identity and contact data

Full name, email address, telephone number and any other details you provide.

2. Account credentials

Passwords or authentication tokens used to access your account.

3. Payment and deposit information

Partial card details (last four digits and expiry date), card token generated by our payment processor, deposit amount and transaction history. We do not store full card numbers.

4. Rental and usage data

Unique account or device identifiers, the date, time and location of each rental and return, the duration and fees, information about the power bank (e.g. battery charge level), and any credits or penalties applied.

5. Technical and device data

IP address, device type, operating system, app version, device settings, log files and crash reports, mobile advertising identifiers (for example, IDFA on IOS, AAID on Android), in-app analytics and messaging SDK identifiers, and device diagnostics (for example, crash logs).

6. Location data

Approximate location data to show nearby charging stations. We do not collect precise GPS location without your permission. Where enabled, the app may use precise location to show nearby stations and to support lost-device investigations.

7. Communications data

Emails, messages, enquiries, support requests and our responses.

8. Marketing preferences

Records of your consent to receive marketing and promotional materials.

9. Age and parental consent information

Date of birth (to ensure legal eligibility to contract). We do not knowingly collect data from anyone under 13.

6. How we collect your data

We obtain personal data:

Directly from you when you create an account, use the Service, fill in a form, contact us or sign up for marketing.
Automatically when you use our app or website, through cookies, analytic tools and device logs.
From third parties when you choose to sign in via Apple, Google or similar providers (we receive basic profile data and authentication tokens), from payment processors, and from venue partners regarding the status of power‑bank returns.

7. How we use personal data

We use personal data for the following purposes:

Providing the Service - managing accounts, authenticating users, processing rentals, deposits, payments and refunds, and sending receipts and notifications.
Customer support - handling queries, complaints, feedback and resolving disputes.
Safety and security - verifying users' identities where necessary, preventing fraud and misuse of devices, monitoring returns, and enforcing our terms and conditions.
Service improvement - analysing usage patterns to optimise station placement, app performance and user experience; developing new features; testing and improving our infrastructure.
Marketing - sending promotional messages about our products and services where you have consented to receive them; measuring the effectiveness of campaigns; offering incentives or credits. You can opt out at any time.
Compliance and protection - complying with legal obligations, responding to lawful requests from authorities, enforcing our terms of service and protecting our rights, privacy, safety or property, or that of others.

Marketing Communications: We use promotional emails and in-app messages only with your consent or, where permitted, under the soft-opt in for existing customers about similar products or services. You can opt out at any time via unsubscribe links or the app settings.

When we rely on consent to process your data, we will ask for it separately and clearly. Consent must be freely given, specific, informed and unambiguous. We do not use pre‑ticked boxes or silence to imply consent. You may withdraw your consent at any time by contacting us using the details in section 20. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9. Transparency and fair processing

We are committed to being open and transparent about how we use your personal data. We provide this privacy notice when you first provide personal data or soon afterwards if we obtain it from a third party. If we want to use your data for a new purpose that is incompatible with this notice, we will explain the new purpose and, if necessary, request your consent.

10. Purpose limitation

We only use personal data for the purposes described in this notice or for compatible purposes. If we intend to use data for a new or different purpose, we will update this notice and, where required, ask for your consent.

11. Data minimisation and accuracy

We collect only the personal data necessary for our purposes and no more. We take reasonable steps to ensure that the data we hold is accurate and up to date. Please contact us if your details change so that we can update our records.

12. Data retention

We retain personal data for as long as necessary to fulfil the purposes described in this notice and to comply with legal, accounting and reporting requirements. Typically:

Account and rental records - while your account is active and for six years after the last rental, to comply with tax, accounting and limitation periods.
Payment and transaction records - for seven years, in line with tax and anti‑fraud regulations.
Technical logs and analytics data - up to 12 months unless needed longer for security investigations.
Marketing preferences and consent records - retained until you withdraw consent or we cease marketing to you, and in any case for as long as needed to demonstrate compliance.

We may retain data for longer if required by law or necessary to resolve disputes. When the retention period ends, we securely delete or anonymise the data.

13. Security and confidentiality

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss or destruction, including:

Encryption and pseudonymisation of sensitive data;
Access controls and authentication mechanisms;
Firewalls and intrusion detection systems;
Regular security testing and auditing;
Staff training on data protection and confidentiality;
Physical security measures for our premises and equipment.

We require our service providers to implement similar protections.

Where we use reputable cloud providers, we configure services to apply encryption at rest and in transit and role-based access controls.

14. Personal data breaches

A personal data breach is any incident that compromises the availability, confidentiality or integrity of personal data. We have procedures to detect, investigate and notify relevant authorities of a breach in accordance with UK GDPR requirements. If a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

15. International transfers

We currently host and process personal data in the UK and/or EEA regions (including on Google Cloud in the region we specify). If we need to transfer personal data outside the UK: (a) we will rely on a UK adequacy regulation where available; or (b) we will implement appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with transfer risk assessments. Details are available on request.

16. Data subject rights

You have the following rights under data protection law:

Right to be informed - to receive clear and transparent information about how we use your data (this notice).
Right of access - to obtain a copy of your personal data and information on how we process it.
Right to rectification - to request that we correct inaccurate or incomplete data.
Right to erasure - to ask us to delete your data when we no longer need it or when you withdraw consent.
Right to restrict processing - to require us to restrict the processing of your data in certain circumstances.
Right to data portability - to receive your data in a machine‑readable format and transfer it to another controller.
Right to object - to object to processing based on our legitimate interests or for direct marketing.
Right not to be subject to automated decision‑making - we do not use automated decision‑making or profiling that produces legal or similarly significant effects; if we do in future, we will tell you and allow you to contest such decisions.

We will normally respond within one month but may extend the period if the request is complex. We have an internal complaint‑handling mechanism and will acknowledge complaints within 30 days.

To exercise any of these rights, please contact us using the details below. You will not have to pay a fee, but we may refuse or charge a fee if your request is unfounded, repetitive or excessive. We may require proof of your identity.

17. Automated decision‑making and profiling

We do not currently make decisions based solely on automated processing or profile individuals in a way that has legal or similarly significant effects. If we introduce such functionality in the future, we will provide notice and a mechanism for you to object or request human intervention. We may use non-significant profiling to tailor promotions and messages. You can object at any time.

18. Direct marketing and cookies/SDKs

Website (cookies). Our informational website (hosted by GoDaddy) uses essential cookies needed for core functionality. We do not set analytics or marketing cookies unless we tell you and, where required, obtain your consent. See our Cookie Policy for details.

App (SDKs). Our mobile app uses software development kits (SDKs) and similar technologies. We use:

Strictly necessary SDKs (e.g. to keep you signed in, process rentals, deliver service messages).
Analytics SDKs (to understand performance and improve reliability) - we will ask for your consent where required.
Marketing/personalisation SDKs (to tailor promotions, e.g. promo codes based on your rental history) - we will obtain your consent and provide a preference centre where you can enable/disable Analytics and Marketing separately.

You can change these settings at any time within the app. Withdrawing consent will not affect strictly necessary technologies.

We may share your personal data with:

Service providers - such as payment processors, IT support, cloud hosting, analytics providers, customer service platforms, and marketing or communications tools. They may only process data on our behalf and under our instructions.
Venue partners - businesses that host our power‑bank stations. They may receive aggregated usage data and, where necessary to resolve a dispute (for example, if a power bank is not returned), limited identifying information.
Group companies and affiliates - if we operate through subsidiaries or related entities. They must follow this notice.
Regulators, law enforcement and courts - where required by law or to protect our rights or those of others.
Professional advisers - such as lawyers, auditors and insurers for advice and services.
Business transferees - if we sell or restructure our business, data may be transferred to the new owner, who must continue to respect this notice.

We require third parties to respect the security of your data and to process it in accordance with the law. We do not allow our service providers to use your data for their own purposes.

20. Contact details and complaints

To exercise your rights or contact us with queries or complaints, please write to our Data Privacy Manager:

Email: privacy@gt-powerbank.com

Post: Grine Technologies Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

Although we are not currently required to appoint a Data Protection Officer, we have appointed a Data Privacy Manager responsible for overseeing compliance. For complaints, we will acknowledge receipt within 30 days and aim to resolve them promptly. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are unhappy with our response.

21. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our services or legal requirements. We will post updates on our website and, where appropriate, notify you by email or in‑app notification. The latest version will always be available on our website. Please review it regularly.

22. Children

Our Service is not intended for children under 13. If you believe a child under 13 has provided personal data, please contact us so we can delete it. Users aged 13-17 may use the Service with the knowledge and permission of a parent or guardian where appropriate.