Privacy Policy

Battery Enlighta is operated by [Company legal name], [registered address], India (“we”). For personal data about the people who use our service, we decide why and how it is processed and act as the data fiduciary (DPDP Act) and controller (GDPR).

Our customers’ battery records are mostly product data, not personal data. Where a customer puts personal data into a battery record (for example a vehicle identification number that can be linked to a person), the customer decides its use and we process it on their behalf.

• Account data: your name, work email, company, role, and a hashed (never readable) password.
• Company data: company name, type, GSTIN, postal address, contact email, website, manufacturer and factory codes.
• Battery and passport data entered by customers, their suppliers or their systems, including vehicle identification numbers.
• Supplier contacts: the name of the person who sends data through a supplier link.
• Documents uploaded to passports, such as declarations and test reports.
• Security records: an audit log of changes (who, what, when), and sign-in attempts with network address, kept to protect accounts.

• To provide the service you or your company signed up for: accounts, BPANs, passports, sharing and integrations.
• To meet legal duties that apply to battery passports, such as keeping passports available under EU Regulation 2023/1542.
• To keep the service secure: preventing password guessing, detecting misuse and keeping a tamper-evident audit log.
• To send service emails: confirming your address, password resets and notices about your account. We do not send marketing without your consent.

Under the DPDP Act we process personal data with your consent, given when you create an account, and for legitimate uses the Act allows. Under the GDPR we rely on performing our contract with you (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), and our legitimate interest in keeping the service secure (Art. 6(1)(f)).

• The public: only the public tier of a battery passport, which EU law requires to be openly available. It contains no personal data unless a customer adds some.
• Other companies: restricted passport data reaches only companies the battery’s producer approves, the operator responsible for the battery, and verified authorities.
• Service providers who run parts of the service for us: Supabase (database and file storage, Frankfurt), Vercel (application hosting, Frankfurt) and Resend (email). They may use the data only to provide their service to us.
• Authorities where the law requires it.

We do not sell personal data.

Data is stored in the European Union, in Frankfurt, Germany (database by Supabase; application servers by Vercel in the same region). Storing it there is a transfer outside India, which the DPDP Act allows except to countries the Government of India restricts. Any transfer outside the EU will be made only as the GDPR allows, with suitable safeguards.

• Account data: while the account is active, and up to [period] after it closes.
• Battery passports: for as long as the law requires them to stay available, which can extend beyond the battery’s life and beyond your account.
• Audit and security records: [period].
• Email links for confirmation and password reset expire within 24 hours and 1 hour.

We use a single cookie, needed to keep you signed in. It expires after 14 days or when you log out. We do not use advertising or tracking cookies.

You can ask to access, correct, update or erase your personal data, withdraw consent, and nominate someone to act for you, as the DPDP Act provides. People in the EU also have the GDPR rights to restriction, portability and objection, and may complain to their data protection authority.

Some data cannot be erased while the law requires it to be kept, such as passport records under EU Regulation 2023/1542. We will tell you when that applies.

Passwords are hashed; sign-in attempts are limited; sessions expire; connections use https; passports are digitally signed; and every change is recorded in a tamper-evident audit log. If a personal data breach occurs, we will notify affected people and the authorities as the law requires.

The service is for businesses and is not meant for anyone under 18.

Grievance Officer: [name], [email], [address]. We will respond within [period]. If you are not satisfied, you may approach the Data Protection Board of India.

We will post changes here with a new date, and tell account holders by email about significant changes before they take effect.