Privacy Policy

Effective date: 14 September 2026 for new Users and for all Guests. If you registered as a Host before 14 September 2026, this version applies to you from 14 October 2026; until then the previous version applies.

1. INTRODUCTION

1.1 About This Policy

This Privacy Policy ("Policy") explains how KD Industries Ltd, a company registered in England and Wales (Company No. 16052026), trading as "GuestCharge" ("we", "us", "our"), collects, uses, shares and protects personal data when you use our platform, website and services (collectively, the "Service").

We handle personal data in accordance with:

(a) the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, each as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), if you are in the United Kingdom;

(b) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (EU GDPR) and the national laws implementing the ePrivacy Directive (2002/58/EC), if you are in the European Economic Area (EEA); and

(c) applicable United States federal and state privacy laws, including the California Online Privacy Protection Act and, to the extent it applies to us, the California Consumer Privacy Act, if you are in the United States.

Where this Policy refers to the "GDPR" without qualification, it means the UK GDPR or the EU GDPR, whichever applies to you. Section 14 contains additional information for people in the EEA and Section 15 contains additional information for people in the United States.

1.2 Data Controller Information

For the purposes of data protection law, GuestCharge is the Data Controller for personal data collected through the Platform, except where explicitly stated otherwise in this Policy.

Contact Details:

1.3 Scope

This Policy applies to:

(a) Visitors to our website at guestcharge.co;

(b) Users of our web application at app.guestcharge.co;

(c) Hosts who register Charging Equipment on the Platform;

(d) Guests who use the Platform to access charging services;

(e) Anyone who contacts us or interacts with our services; and

(f) Guests whose booking details a Host shares with us through a connected Property Management System (PMS), so that we can send them charging information before they arrive.

---

2. DATA WE COLLECT

2.1 Information You Provide

2.1.1 Account Registration (Hosts)

2.1.2 Account Registration (Guests)

Guests may use the Service without creating a full account. We collect:

2.1.3 Charger Registration (Hosts)

2.1.4 Communications

2.1.5 Booking Information from a Connected PMS

If a Host connects a Property Management System to their GuestCharge account (currently Lodgify, Uplisting or Hospitable), we receive booking information from that PMS so that we can send the Host's upcoming guests a link to the Host's Charger and its price before they arrive.

We request the minimum booking data needed for this purpose and we do not use it for marketing. For this processing we act as a processor on behalf of the Host, who is the controller of their guests' booking data. The Host's own privacy notice covers the collection of that data, and the Host instructs us to process it under the data processing terms in Section 16 of our Terms and Conditions. If a Guest then starts a Charging Session, we become the controller of the session and payment data described elsewhere in this Policy. Booking data is deleted when the Host disconnects the PMS or closes their account.

2.2 Information Collected Automatically

2.2.1 Usage Data

When you use the Service, we automatically collect:

2.2.2 Location Data

We collect location data as follows:

We do not track Guest movement, request precise device location, or store continuous location history. Guests reach a Charger by scanning the QR code on it; we do not operate a public map or directory of Chargers.

2.2.3 Cookies and Similar Technologies

We use cookies and similar technologies for:

For detailed information, see Section 11 (Cookie Policy) below.

2.3 Information from Third Parties

2.4 Data Received from Charger Manufacturer Platforms

Some chargers connect to GuestCharge through the charger manufacturer's own cloud platform rather than directly. Where this is the case (for example, with Easee chargers), the manufacturer discloses to us personal data relating to the Host and their charger so that we can operate the charger and bill charging sessions.

In this arrangement, GuestCharge and the manufacturer each act as independent Data Controllers: each is separately responsible for its own handling of the data, and we are not joint controllers. We process the data we receive only for the purposes described in this Policy, principally to provide and bill the charging service, and we determine our own lawful basis for doing so (generally contractual necessity for providing the Service to the Host, and our legitimate interest in accurate billing and support).

We provide this Policy as our privacy notice for that processing. The manufacturer provides its own privacy notice for the data it controls.

---

3. HOW WE USE YOUR DATA

3.1 Lawful Bases for Processing

We process your personal data only where we have a valid legal basis:

3.2 Specific Processing Purposes

3.2.1 Service Delivery

• Creating and managing user accounts
• Facilitating charging sessions between Hosts and Guests
• Processing payments and Host payouts
• Sending transactional notifications (session receipts, payment confirmations)
• Providing customer support

3.2.2 Security and Fraud Prevention

• Monitoring for suspicious activity
• Preventing and investigating fraud
• Enforcing our Terms and Conditions
• Protecting the safety of users

3.2.3 Legal Compliance

• Responding to lawful requests from authorities
• Maintaining records for tax and accounting purposes
• Complying with anti-money laundering obligations

3.2.4 Service Improvement (Legitimate Interest)

• Analysing usage patterns to improve the Platform
• Conducting research and development
• Testing new features

3.2.5 Marketing (with appropriate basis)

• Sending promotional communications (with consent or where permitted under PECR for existing customers)
• Personalising your experience

You can opt out of marketing communications at any time by:

• Replying "unsubscribe" to any marketing email, or clicking the unsubscribe link where one is included
• Emailing team@guestcharge.co

3.3 Legitimate Interests Assessment

Where we rely on legitimate interests, we have conducted balancing tests to ensure our interests do not override your fundamental rights. Key considerations include:

You have the right to object to processing based on legitimate interests. Contact us at team@guestcharge.co.

---

4. DATA SHARING

4.1 Sharing with Other Users

4.2 Third-Party Service Providers (Processors)

We share data with service providers who process data on our behalf:

Note: Your payment card details are processed directly by Stripe and are never stored on our servers.

4.3 Controller-to-Controller Sharing

In certain circumstances, we share data with, or receive data from, parties who act as independent Data Controllers:

4.4 Hosts as Controllers

Important: When Guests charge at a Host's location, the Host may become a Data Controller for certain personal data relating to that interaction (such as the fact that a specific Guest used their charger, session timing, and energy consumed).

Hosts are responsible for their own compliance with data protection laws for any data they collect or receive through the Platform. GuestCharge provides Hosts with only the minimum data necessary for service delivery and dispute resolution.

4.5 Business Transfers

If GuestCharge is involved in a merger, acquisition, or sale of assets, your personal data may be transferred. We will notify you of any such change and any choices you may have.

4.6 Legal Requirements

We may disclose personal data where required by law or where we believe disclosure is necessary to:

• Comply with a legal obligation
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing
• Protect the safety of users or the public
• Protect against legal liability

---

5. DATA RETENTION

5.1 Retention Periods

We retain personal data only for as long as necessary:

5.2 Anonymisation

Where we retain data for analytics or historical purposes beyond the retention period, we anonymise or aggregate the data so that it can no longer identify you.

5.3 Soft Deletion

When you request account deletion:

1. Your account is immediately marked as inactive ("soft delete")
2. Personal data is anonymised within 30 days
3. Transaction records are retained (with personal identifiers removed) for 6 years
4. Backups are overwritten according to our backup schedule (maximum 90 days)

---

6. INTERNATIONAL TRANSFERS

6.1 Where Data is Processed

Your personal data is primarily stored and processed in the United Kingdom (AWS eu-west-2, London). Some of our service providers process data in other countries, principally the United States.

6.2 If You Are in the United Kingdom

Transfers to the EEA are covered by the UK's adequacy regulations. Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the recipient is certified to it, and otherwise on the Information Commissioner's International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

6.3 If You Are in the EEA

Because we are established in the United Kingdom, your personal data is transferred from the EEA to the UK. That transfer is covered by the European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031, so no additional safeguard is required. Onward transfers to the United States rely on the EU-US Data Privacy Framework where the recipient is certified to it, and otherwise on the EU Standard Contractual Clauses. If the Data Privacy Framework ceases to be available, we will rely on the Standard Contractual Clauses already included in our agreements with those providers.

6.4 If You Are in the United States

Your personal data is transferred to and stored in the United Kingdom and is processed by Stripe and Google in the United States as described above. UK data protection law applies to our handling of it.

6.5 Copies of Safeguards

You can request a copy of the relevant transfer mechanism by contacting team@guestcharge.co.

---

7. YOUR RIGHTS

7.1 Summary of Rights

Under the UK GDPR and the EU GDPR (Articles 15 to 22), you have the following rights:

7.2 How to Exercise Your Rights

7.2.1 How to Make a Request

Email team@guestcharge.co with the subject line "Data Subject Request: [right]" (for example "Data Subject Request: access"). Include your full name, the email address associated with your account or Charging Session, and a description of what you are asking for. We will confirm receipt and may ask you to verify your identity (Section 7.3). Hosts can update their contact details and pricing in their account settings at any time.

7.2.2 Response Times

We will respond to valid requests within one (1) month. This period may be extended by up to two (2) additional months for complex requests, in which case we will inform you within the first month.

7.3 Identity Verification

To protect your data, we may need to verify your identity before processing requests. We will never ask for unnecessary information.

7.4 Limitations

Your rights may be limited in certain circumstances, for example:

• Where we need to retain data for legal compliance
• Where erasure would prejudice ongoing legal proceedings
• Where data is necessary to establish, exercise, or defend legal claims

We will explain any limitations when responding to your request.

7.5 Complaints

Complaining to us. We operate a data protection complaints procedure. If you are unhappy with how we have handled your personal data, email team@guestcharge.co with the subject line "Data Protection Complaint", or write to the postal address in Section 13. We will acknowledge your complaint within thirty (30) days, look into it without undue delay, and tell you the outcome and any action we are taking. In the UK this procedure is required by section 164A of the Data Protection Act 2018.

Complaining to a regulator. You also have the right to complain to a supervisory authority at any time:

• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
• EEA: the data protection authority of the EU or EEA country where you live, where you work, or where the issue arose. The European Data Protection Board publishes the list at edpb.europa.eu.
• United States: see Section 15.

We would appreciate the opportunity to address your concerns first.

---

8. SECURITY

8.1 Technical Measures

We implement appropriate technical measures to protect your personal data:

8.2 Organisational Measures

8.3 Your Responsibilities

You are responsible for:

• Keeping your account credentials confidential
• Using strong, unique passwords
• Logging out from shared devices
• Reporting any suspected unauthorised access

8.4 Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it: the ICO in the UK, and the competent data protection authority for data relating to people in the EEA. Where the breach is likely to result in a high risk to you, we will tell you directly without undue delay. If you live in the United States, we will also give any notice required by the data breach notification law of your state.

We keep a breach register documenting all incidents. Where a breach relates to data shared with an integration partner acting as an independent controller (such as a charger manufacturer platform), we will notify that partner without undue delay in accordance with our agreement with them.

---

9. SPECIFIC PROCESSING ACTIVITIES

9.1 Location Data

9.1.1 Host Location Data

We do not publish Charger locations in any public map or directory. Guests reach a Charger by scanning the QR code on it.

9.1.2 Guest Location Data

We do not:

• Track Guest movement over time
• Access precise GPS location from Guest devices
• Share Guest location with Hosts

9.2 Payment Data

All payment card data is processed directly by Stripe. GuestCharge does not have access to full card numbers. We receive only:

• Last four digits of card number
• Card type and expiry month/year
• Transaction confirmation/status

For Host payouts, bank details are stored by Stripe as part of their Connect service.

9.3 OCPP Communication Data

Our Platform communicates with OCPP-enabled chargers. We collect:

• Charger status updates
• Meter readings
• Session start/stop events
• Error codes and diagnostics

This data is necessary for service functionality and billing accuracy. Where a charger connects through a manufacturer's cloud platform rather than directly, some of this data reaches us via that platform (see Section 2.4).

9.4 Automated Decision-Making

We use automated processing for:

We do not make decisions with legal or similarly significant effects based solely on automated processing without human review.

---

10. CHILDREN'S PRIVACY

The Service is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal data from children.

If we become aware that we have collected data from a child, we will take steps to delete that information promptly. If you believe we have collected data from a child, please contact us at team@guestcharge.co.

---

11. COOKIE POLICY

11.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to website owners. Similar technologies include web beacons, pixel tags, and local storage.

11.2 How We Use Cookies

GuestCharge uses cookies and similar technologies for the following purposes:

11.2.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be switched off. They include:

Without these cookies, the Platform cannot function properly.

11.2.2 Functional Cookies

These cookies enable enhanced functionality and personalisation:

11.2.3 Analytics Cookies

These cookies help us understand how visitors interact with our Platform. They are only set after you give consent through our cookie banner, and you can withdraw consent at any time.

Analytics data is anonymised where possible and is used only to improve our service.

In the United Kingdom, the law now allows some statistical cookies to be set on an opt-out basis. We have chosen to keep asking for your consent before setting analytics cookies wherever you are.

11.2.4 Advertising Cookies

These cookies let us see which advertisements lead to someone creating an account, so we can stop paying for advertising that does not work. They are only set after you accept marketing cookies through our cookie banner, and you can withdraw consent at any time. If you decline, the advertising providers' scripts are never loaded at all.

We do not use these cookies to build advertising profiles, and we never share your name, address or payment details with an advertising provider. Where a sign-up is reported to an advertising provider, your email address is sent only as an irreversible SHA-256 hash, never in readable form.

Meta (Facebook and Instagram). With your consent, the Meta Pixel tells Meta which pages of our website you visit, together with your IP address and browser details. If you then create a Host account, our server also tells Meta, through its Conversions API, that you signed up and, later, that you finished setting up your account. It sends a hashed email address, a hashed account ID and country, and the IP address and browser details of your sign-up. If you have not accepted marketing cookies, nothing is sent. The Meta Pixel never loads on the pages Guests use to charge, pay or view a receipt.

11.3 Third-Party Cookies

Some cookies are placed by third-party services that appear on our pages:

11.4 Managing Cookies

11.4.1 Browser Settings

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored and delete them individually
• Block third-party cookies
• Block cookies from specific sites
• Block all cookies
• Delete all cookies when you close your browser

Note: Blocking all cookies will affect the functionality of this and many other websites.

11.4.2 Browser-Specific Instructions

11.4.3 Opt-Out Links

You can opt out of analytics and advertising cookies using these links:

• Google Analytics: tools.google.com/dlpage/gaoptout
• Google Ads personalisation: adssettings.google.com
• OpenAI Ads: withdraw marketing consent using the Cookie settings link in the footer of any page on this site. Declining stops the OpenAI script loading at all
• Meta (Facebook and Instagram): withdraw marketing consent using the Cookie settings link in the footer of any page on this site. Declining stops the Meta Pixel loading at all, and withdrawing later removes the _fbp and _fbc cookies. You can also control how Meta uses information from other websites in your Facebook or Instagram settings, under Ads preferences

11.4.4 Changing Your Choice

The first time you visit, our cookie banner asks for your choice. Accept all turns on marketing and analytics cookies. Manage preferences lets you turn each category on or off, or Reject all. If you close the banner without choosing, no optional cookies are set and we ask again on the next page.

You can change your choice at any time using the Cookie settings link in the footer of every page. When you turn a category off, we stop the related scripts and delete the cookies they set. We remember your choice in the strictly necessary gc_consent cookie (Section 11.2.1): for 12 months if you accepted any optional cookies, or for 6 months if you rejected them all. After that we ask again.

To see how many visitors accept or reject cookies, the banner records each choice (accepted, rejected, a custom choice, or no choice) as an anonymous count. The count reads and stores nothing on your device, sends no cookies, and keeps no IP address, browser details or other information that could identify you.

11.5 Do Not Track and Global Privacy Control

Some browsers include a "Do Not Track" (DNT) feature. There is no industry standard for interpreting DNT signals and we do not currently respond to them.

We do honour the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we do not set advertising cookies and we do not share your data with advertising providers, whatever you choose on the cookie banner. For California residents this is treated as a request to opt out of "sharing" under the CCPA (Section 15). GPC does not affect analytics cookies, which are set only if you accept them on the cookie banner.

11.6 Updates to This Cookie Policy

We may update this Cookie Policy from time to time. Changes will be reflected in the "Last Updated" date of this Privacy Policy.

---

12. CHANGES TO THIS POLICY

We may update this Policy from time to time. Changes will be communicated through:

• Email notification to your registered address
• Prominent notice on the Platform
• Update to the "Last Updated" date

Material changes affecting your rights will be notified at least thirty (30) days before taking effect.

Your continued use of the Service after changes become effective constitutes acceptance of the updated Policy.

---

13. CONTACT US

KD Industries Ltd (trading as GuestCharge)

Postal Address:
Data Protection Contact
KD Industries Ltd
69 Marlborough Place, London, NW8 0PT, United Kingdom

Company Registration Number: 16052026

---

14. ADDITIONAL INFORMATION FOR EEA USERS

This Section applies if you are in the European Economic Area. It supplements the rest of this Policy, which applies to you in full.

14.1 Who We Are and Our EU Representative

KD Industries Ltd is established in the United Kingdom and has no establishment in the European Union. Because we offer the Service to Hosts and Guests in the EEA, the EU GDPR applies to our processing of your personal data (Article 3(2) EU GDPR), and we have appointed a representative in the EU under Article 27 EU GDPR.

You can contact our EU representative on any matter relating to our processing of your personal data, instead of or as well as contacting us directly.

14.2 Legal Bases

The legal bases in Section 3 are the same under the EU GDPR (Article 6(1)(a), (b), (c) and (f)). We do not rely on legitimate interests for anything that requires your consent under the ePrivacy rules of your country, such as non-essential cookies.

14.3 International Transfers

Your personal data is transferred to the United Kingdom under the European Commission's adequacy decision for the UK, and onward to the United States as described in Section 6.3.

14.4 Your Rights

You have the rights described in Section 7 under Articles 15 to 22 EU GDPR, and the right to lodge a complaint with the supervisory authority of the EU or EEA country where you live, where you work, or where the alleged infringement took place (Article 77 EU GDPR). We respond to requests within one month, extendable by two further months for complex requests.

14.5 Hosts in the EEA

If you are a Host in the EEA, you are the controller of your guests' booking data and we process it on your behalf as described in Section 2.1.5 of this Policy and Section 16 of our Terms and Conditions.

---

15. ADDITIONAL INFORMATION FOR UNITED STATES RESIDENTS

15.1 Scope

This Section applies if you live in the United States. It supplements the rest of this Policy. The United States has no single federal privacy law; this Section addresses the California Online Privacy Protection Act (which applies to us), the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA"), and the comprehensive privacy laws of other states. We are a small business and, at the date of this Policy, we do not meet the revenue or volume thresholds that bring us within the CCPA or the comprehensive privacy laws of other states. We honour the rights in Section 15.5 for all US residents anyway, and we will comply with those laws in full if and when they apply to us.

15.2 Categories of Personal Information We Collect

In the preceding twelve (12) months we have collected the following categories of personal information. Section 2 gives the detail.

• Identifiers: name, email address, phone number, postal address, IP address and account identifiers.
• Commercial information: charging sessions, payments and payouts.
• Internet or other electronic network activity: pages viewed, device and browser information, and, where you have consented, analytics and advertising cookie data.
• Geolocation data: charger addresses supplied by Hosts, and approximate location derived from a Guest's IP address. We do not collect precise geolocation from your device.
• Payment information: payment cards are processed by Stripe. We never receive full card numbers; we receive only the last four digits, card type and expiry (Section 9.2). Host bank details are held by Stripe.
• Identity verification data: identity documents that Hosts provide for verification, processed by Stripe.
• Booking information received from a Host's PMS about that Host's guests (Section 2.1.5).

We collect this information from you, from your device, from Stripe, from charger manufacturer platforms (Section 2.4), from PMS providers (Section 2.1.5), from Google if you sign in with Google, and from fraud prevention services (Section 2.3).

15.3 How We Use and Disclose Personal Information

We use personal information for the purposes in Section 3: providing and operating the Service, billing and payouts, customer support, security and fraud prevention, legal compliance, analytics and, with your consent, advertising measurement. We disclose it to the service providers and other recipients listed in Section 4, for the purposes stated there. We keep it for the periods in Section 5.

15.4 Sale and Sharing; Global Privacy Control

We do not sell personal information and have not done so in the preceding twelve (12) months.

With your consent, we share internet activity information with advertising providers, currently Google, Meta and OpenAI, to measure which advertisements lead to account sign-ups (Section 11.2.4). Under the CCPA this may count as "sharing" for cross-context behavioural advertising. You can opt out at any time using Cookie settings in the website footer. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of sharing.

We do not knowingly sell or share the personal information of anyone under 16.

15.5 Your Rights

Whether or not a state privacy law applies to us, US residents may ask us to:

• confirm whether we process your personal information and give you access to it, in a portable format;
• correct inaccurate personal information;
• delete your personal information;
• opt out of the sale or sharing of personal information, and of targeted advertising;
• limit the use of sensitive personal information (we do not use sensitive personal information other than to provide the Service); and
• not be discriminated against for exercising these rights.

To exercise them, email team@guestcharge.co with the subject line "US Privacy Request". We will verify your identity as described in Section 7.3, and you may use an authorised agent to make a request on your behalf if the agent provides your written permission. We will respond within forty-five (45) days, extendable once by a further forty-five (45) days where reasonably necessary, and we will tell you if that happens. If we decline a request, we will explain why and you may ask us to reconsider by replying to our decision.

15.6 Do Not Track

See Section 11.5.

15.7 California "Shine the Light"

California Civil Code §1798.83 permits California residents to request information about our disclosures of personal information to third parties for their own direct marketing purposes. We do not make such disclosures.

15.8 Data Breaches

See Section 8.4. We will notify affected US residents in accordance with the breach notification law of their state.

15.9 Changes to This Policy

We notify changes as described in Section 12. The effective date is shown at the top of this Policy.

---

BY USING THE GUESTCHARGE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.

---

Last Updated: 14 September 2026