EVIQ Privacy Policy

Last updated: 26 April 2026 · Effective immediately

This Privacy Policy explains how NISR AL-SAMAA AL-DAOLIA FOR GENERAL TRADING AND CONTRACTING COMPANY LTD. ("EVIQ", "we", "us") collects, uses and protects information when you use our EV charging-management platform.

1. Information we collect

• Account data: full name, email, phone, country, preferred currency.
• Authentication data: hashed password, OTP codes, session and refresh tokens.
• Vehicle & charging data: session times, energy delivered (kWh), duration, station and connector ID, state-of-charge readings.
• Wallet & payment data: balance, transactions, payment-gateway references. We do not store full card numbers.
• Notification preferences: which channels (email / WhatsApp / SMS / Telegram) you have opted into.
• Device & technical data: IP address, browser type, OS version, app version.
• Meta WhatsApp data: message IDs, delivery-status events and timestamps for audit purposes.

2. How we use your information

• To create and authenticate your account.
• To start, monitor, settle, and bill charging sessions.
• To process wallet top-ups and apply or refund charges.
• To send transactional notifications on your chosen channels.
• To detect fraud, abuse, and unauthorised use.
• To comply with applicable laws and regulators' requests.

We do not use your data for advertising or sell it to third parties.

3. Sharing of information

We share data only as needed to provide the service:

• Payment gateways (ZainCash, FIB, AsiaPay, Stripe, etc.) — receive transaction amount, currency and reference.
• Notification carriers (Meta WhatsApp, Twilio, Infobip, Telegram, email provider) — receive only recipient and message body.
• Public authorities only when legally compelled, and only the minimum data required.

EVIQ does not use any third-party data processor or cloud host for Meta Platform Data — it is stored only on physical servers operated by EVIQ.

4. Retention

• Account data — kept while active. Deleted within 30 days of an account-deletion request.
• Charging sessions, transactions, invoices — 7 years (Iraqi accounting/tax compliance).
• OTP codes — deleted after use or after 10 minutes.
• WhatsApp message IDs — 12 months.
• Server access logs — 30 days.

5. Your rights

You can at any time:

• Access — request a copy of your data.
• Correct — update your profile or email us.
• Delete — see User Data Deletion.
• Restrict / Object — disable specific notification channels.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — in Settings → Notifications, or by emailing us.

To exercise any of these rights, email privacy@ev.iq. We respond within 30 days.

6. Security

Passwords are bcrypt-hashed (cost 12). Sessions use short-lived JWT (15 min) with rotating refresh tokens (30 days). All API traffic is TLS-encrypted. The Meta WhatsApp access token is stored encrypted at rest in a private-network Redis.

7. Government and legal requests

We respond to lawful requests from public authorities only when (1) the request originates from a legitimate authority with a valid legal basis under Iraqi law, (2) the scope is proportionate, and (3) we disclose only the specific data points requested. Every request is logged in our internal Compliance Register.

8. Children

EVIQ is not intended for users under 18. We do not knowingly collect personal data from minors.

9. Changes to this policy

We may update this policy. Material changes are communicated by email and in-app notice at least 14 days before they take effect.

10. Contact