GEV Privacy Notice

    Last updated: 30th July 2026

    Table of Contents

    1. Who we are

    GlenEV Technologies Ltd. t/a GEV (referenced as "GEV", "we", "us" or "our") is the data controller of personal data processed in connection with our Electric Vehicle (EV) charging services, including the GEVTopUp platform and our support and installation services to companies, housing developments and apartment complexes.

    Registered office: Trinity Building 1, IDA Business Park, Southern Cross Road, Bray, Co. Wicklow A63 HY38
    Company registration number: 611560

    This Notice applies to personal data we process about: (i) end-users and EV drivers who use the GEVTopUp app or our charging services; (ii) staff and service administrators of our business customers; and (iii) visitors to our website.

    2. How to contact us

    If you have any questions about this Notice or how we handle your personal data, or if you wish to exercise any of your rights, please contact us at:

    • Email: DPO@gev.ie
    • Post: Trinity Building 1, IDA Business Park, Southern Cross Road, Bray, Co. Wicklow A63 HY38

    GEV has appointed a Data Protection Officer who reports to our CEO and oversees our data protection compliance. You can contact our Data Protection Officer using the details above.

    3. What personal data we collect

    3.1 End-users / EV drivers

    Depending on how you use our services (for example, via the GEVTopUp mobile app or web portal), we may collect:

    • Identification information: full name, e-mail address, mobile device identifier, IP address
    • Location data (used only to position the map when the app is opened)
    • Personal ID number and vehicle registration number — only where this is required by the relevant site operator or Controller
    • Contact information: phone number, physical address (including Eircode)
    • MPRN number (for home charging customers, where relevant to energy billing)
    • Charging session data: session times, energy consumed, charge point location, and related billing/payment information
    • Device information: device make, model, and operating system version

    3.2 Staff / service administrators of our business customers

    • Name and business e-mail address
    • Phone number and job position (where provided)
    • Employer information

    3.3 Website visitors

    If you visit our website, we may collect limited technical data (such as IP address and browser type) through cookies and similar technologies.

    4. How we collect your personal data

    • Directly from you, when you register for or use the GEVTopUp app, request a charging installation, or contact our support team
    • From your employer or site operator, where they act as the data controller and instruct us or our platform provider to process your data (for example, staff/administrator accounts)
    • Automatically, through your use of charge points, our mobile app, and our website (e.g. device identifiers, session data)

    6. Who we share your personal data with

    We share personal data with the following categories of recipients:

    • AMPECO Ltd. – our charge point management software provider, which processes personal data on our behalf as a data processor.
    • Sub-processors engaged by AMPECO, including:
      • Amazon Web Services (EU) – cloud hosting infrastructure
      • OneSignal, Inc. (USA) – push notification services (confirmed enabled for GEV)
      • Atlassian (Australia) – service desk and incident management (limited to staff/administrator name and e-mail; enablement status for GEV to be confirmed)
      • Anthropic, Google, and OpenAI (USA) – AI-assisted platform features via CoOperator (confirmed enabled for GEV)
    • Site operators, property developers, or employers who instruct us or our platform provider in relation to charging services at their sites
    • Allstar Business Solutions Limited ("Allstar") – where you avail of the Allstar Homecharge product through GEV, we share your name, home address, and vehicle registration number with Allstar, for the performance of our agreement with Allstar, including the provision of the Homecharge product to you. GEV and Allstar each act as independent data controllers in respect of this data. For details of how Allstar (part of the Corpay group) processes your data as controller, please see: https://allstarcard.co.uk/privacy-policy
    • Professional advisers, auditors, and regulators, where required by law

    We do not sell personal data. Where third parties process personal data on our behalf, they do so under a written agreement requiring them to protect it in accordance with applicable data protection law.

    7. International transfers

    Personal data is primarily hosted within the European Economic Area (EEA), in AWS data centres located in the EU. Push notification services (OneSignal) and AI-assisted platform features (CoOperator, via Anthropic, Google, and OpenAI) are enabled for GEV and involve transferring limited categories of personal data to service providers located in the United States. Service desk ticketing (Atlassian, Australia) may also be used; we are confirming its enablement status.

    Where this occurs, the transfer is protected by European Commission Standard Contractual Clauses under Article 46 GDPR, together with supplementary technical and organisational measures (such as encryption and data minimisation) applied by our platform provider.

    Separately, where we share data with Allstar Business Solutions Limited in the United Kingdom (see Section 6), this transfer is covered by the European Commission's UK adequacy decision (renewed in December 2025, valid until December 2031), which recognises the UK as providing an adequate level of data protection. No additional safeguards are required for this transfer.

    You may request further information about these safeguards by contacting us using the details in Section 2.

    8. Data retention

    • We retain personal data for as long as necessary to provide the Services, for the duration of our contract with you or your employer/site operator, or until a valid erasure request is fulfilled.
    • Following termination of your relationship with us, we retain personal data only where necessary to comply with our legal, tax, or accounting obligations under Irish law, or to establish, exercise, or defend legal claims, after which it is deleted or anonymised.
    • Personal data processed on our behalf by AMPECO may be retained for the periods set out in our Data Processing Agreement with AMPECO — for example, up to 6 months for backup and audit-logging purposes, and up to 5 years for billing and financial audit purposes.
    • GEV is finalising a documented internal data retention schedule setting out specific periods by data category.

    9. Your rights

    Subject to applicable conditions and exemptions under GDPR, you have the right to:

    • Access the personal data we hold about you
    • Rectify inaccurate or incomplete personal data
    • Erasure of your personal data ("right to be forgotten")
    • Restrict or object to certain processing, including processing based on legitimate interests
    • Data portability, where processing is based on consent or contract and carried out by automated means
    • Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

    You can exercise most of these rights directly within the GEVTopUp app or via our website, or by contacting us using the details in Section 2. We aim to respond to all requests within one month.

    You also have the right to lodge a complaint with a supervisory authority. In Ireland, this is the Data Protection Commission (21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; www.dataprotection.ie).

    10. Security

    We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include:

    • Encryption of company devices (e.g. BitLocker) and of data in transit and at rest on our hosting infrastructure
    • Two-factor authentication (2FA) and access controls restricting data access to authorised personnel on a need-to-know basis
    • Physical security controls at our offices and at our cloud infrastructure provider's data centres
    • Confidentiality obligations (including NDAs) binding all GEV employees and contractors
    • Regular internal training on GDPR principles and data handling procedures
    • Maintenance of a cyber liability insurance policy to mitigate the financial impact of any cyber-related incident

    In the event of a personal data breach affecting your personal data, we have documented incident response procedures to identify, investigate, contain, and remediate the incident. Where we act as a processor on behalf of a business customer, we notify that customer without undue delay. Where we act as controller, we will notify the Data Protection Commission without undue delay and, where required, notify affected individuals, in accordance with our obligations under GDPR.

    11. Automated decision-making

    We do not currently use your personal data for any processing which produces legal effects concerning you, or which similarly significantly affects you, based solely on automated decision-making, including profiling.

    If this changes in the future, we will update this Notice accordingly and provide you with information about the logic involved, as well as the significance and envisaged consequences of such processing, in line with our obligations under GDPR.

    12. Changes to this Notice

    We may update this Notice from time to time to reflect changes in our processing activities or legal requirements. The "Last updated" date at the top of this Notice indicates when it was last revised. We encourage you to review this Notice periodically.

    13. Contact

    If you have questions, concerns, or requests relating to this Notice or our handling of your personal data, please contact us at DPO@gev.ie.