Privacy Policy

1. Overview & Scope

WAVhz (hereinafter “WAVhz”, “we”, “our”, or “us”) is a vertically integrated Battery Energy Storage System (BESS) company operating across the full value chain — from procurement and system design to installation, operation, maintenance, grid balancing, demand flexibility, and energy management. Our services serve Grid (utility/large-scale), Commercial & Industrial (C&I), and Residential market segments.

This Privacy Policy applies to:

• All visitors to www.wavhz.com
• Registered users of any WAVhz platform or portal
• Customers who procure, install or operate WAVhz Grid, WAVhz Home, or WAVhz Core/Flex systems
• Business partners, vendors, contractors, and their representatives
• Job applicants and prospective employees
• Any individual whose personal data is processed in connection with WAVhz services

This Policy does NOT apply to third-party websites, services, or platforms linked from our website. We encourage you to review the privacy policies of those services independently.

2. Legal & Regulatory Framework

WAVhz operates in compliance with the following applicable laws and regulations:

2.1 Indian Law (Primary)

• Digital Personal Data Protection Act, 2023 (DPDP Act) — India’s primary data protection legislation
• Information Technology Act, 2000 and IT (Amendment) Act, 2008
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Consumer Protection Act, 2019 and E-Commerce Rules, 2020
• Electricity Act, 2003 and applicable CERC/SERC regulations
• Companies Act, 2013 (data retention by corporate entities)

2.2 International Frameworks

• General Data Protection Regulation (GDPR) — applicable where EU/EEA residents’ data is processed
• California Consumer Privacy Act (CCPA) / CPRA — applicable where California residents’ data is processed
• UK GDPR — applicable for United Kingdom residents
• Personal Data Protection Act (PDPA) — Singapore
• ISO/IEC 27001 information security standard (our guiding framework for data security)

3. Data Controller / Data Fiduciary Identity

For the purpose of applicable data protection laws, the Data Controller / Data Fiduciary is:

4. Personal Data We Collect

We collect personal data only to the extent necessary to provide our products and services, and to comply with legal obligations.

4.1 Identity & Contact Data

• Full name, title, gender
• Email address, telephone number, mobile number
• Postal address, billing address, installation site address
• Government-issued identification (where required for regulatory compliance — e.g. Aadhaar, PAN, passport)

4.2 Account & Commercial Data

• Username, password (encrypted), account preferences
• Order history, service contracts, procurement records
• Payment information (processed via PCI-DSS compliant third-party gateways — WAVhz does not store raw card data)
• GST number, company registration number (for B2B customers)

4.3 Technical & System Data

• Battery system performance metrics, charge/discharge cycles, state of health (SoH), state of charge (SoC)
• Energy consumption and generation data from installed systems
• Grid interaction data, demand flexibility event participation
• WAVhz Core / WAVhz Flex system telemetry and remote monitoring data
• IP address, device identifiers, browser type, operating system
• Website usage data, cookies, session data, clickstream data

4.4 Location Data

• Installation site GPS coordinates (required for system design and grid connection)
• Approximate location derived from IP address (for website visitors)

4.5 Special Category / Sensitive Data

WAVhz does not intentionally collect special category personal data (e.g. health data, biometric data, political opinions). Where regulatory compliance (e.g. subsidy applications) requires such data, it is collected with explicit consent and processed under appropriate safeguards.

4.6 Data Collected From Third Parties

• Credit reference agencies (for commercial credit assessment)
• Distribution companies (DISCOMs), grid operators, and government subsidy portals
• Marketing and lead generation partners (where consent has been obtained)

5. Purpose of Processing & Legal Basis

We process personal data for the following purposes, each grounded in an appropriate legal basis:

5.1 Automated Processing & Optimisation

Certain WAVhz systems, including WAVhz Core and WAVhz Flex, may use automated analytics, machine learning, forecasting models, and optimisation algorithms to improve battery performance, energy efficiency, demand flexibility participation, and grid responsiveness.

Such processing may include automated charge/discharge recommendations, telemetry analysis, energy usage forecasting, and operational optimisation.

WAVhz does not use automated processing to make legally binding decisions or similarly significant decisions affecting individuals without appropriate human oversight, except where permitted by applicable law or explicitly agreed by the customer.

6. Data Sharing & Disclosure

WAVhz does not sell your personal data. We share data only in the following circumstances:

6.1 Service Partners & Processors

• Installation and maintenance sub-contractors (data shared under processing agreements)
• Cloud hosting and IT infrastructure providers (AWS, Azure or equivalent — under standard contractual clauses)
• Payment gateways and banking partners (PCI-DSS compliant)
• Customer support platforms and CRM providers

6.2 Regulatory & Grid Authorities

• Central Electricity Regulatory Commission (CERC) and State Electricity Regulatory Commissions (SERCs)
• Distribution companies (DISCOMs) and grid operators for interconnection and metering data
• Ministry of New and Renewable Energy (MNRE) for subsidy scheme reporting
• Other government authorities as required by law

6.3 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring, personal data may be transferred as part of the transaction, subject to the same protections under this Policy. We will notify affected individuals as required by applicable law.

6.4 Legal Requirements

We may disclose personal data where required by court order, law enforcement request, or other legal process, provided we will, where permitted, notify you before complying.

7. Cross-Border Data Transfers

Where personal data is transferred outside India or the EEA, WAVhz ensures appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions (where applicable)
• Binding Corporate Rules (for intra-group transfers)
• Compliance with Section 16 of India’s DPDP Act 2023 (cross-border transfer restrictions)

You may request details of applicable transfer mechanisms by contacting legal@wavhz.com.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this Policy, and in accordance with applicable legal obligations:

• Customer & contract data: 7 years after contract termination (Indian tax and company law requirements)
• System performance & telemetry data: Duration of service + 5 years (for warranty, O&M, and regulatory purposes)
• Payment records: 8 years (Income Tax Act and GST requirements)
• Marketing data: Until consent is withdrawn
• Website analytics data: 26 months
• Job applicant data: 6 months (unsuccessful), 2 years (successful, forming part of employment record)
• Legal dispute data: Duration of proceedings + 3 years

Upon expiry of the applicable retention period, data is securely deleted or anonymised.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

9.1 Rights Under DPDP Act 2023 (India)

• Right to access — obtain a summary of your personal data and how it is processed
• Right to correction & erasure — correct inaccurate data or erase data where grounds exist
• Right to grievance redressal — raise complaints with our Grievance Officer
• Right to nominate — nominate another individual to exercise your rights in case of death or incapacity

9.2 Rights Under GDPR (EU/UK)

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / ‘Right to be forgotten’ (Article 17)
• Right to restrict processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)
• Right to withdraw consent at any time (without affecting prior processing)
• Right to lodge a complaint with a supervisory authority

9.3 Rights Under CCPA (California)

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale or sharing of personal information
• Right to non-discrimination for exercising privacy rights

To exercise any of these rights, please contact: legal@wavhz.com. We will respond within 30 days (or as required by applicable law).

10. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience and analyse usage patterns.

Cookie Types We Use:

• Strictly Necessary Cookies: Essential for website function (cannot be disabled)
• Analytics Cookies: Understand how visitors use our site (e.g. Google Analytics — anonymised)
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Deliver relevant advertising (only with consent)

You can manage cookie preferences via our Cookie Consent banner or your browser settings. Note that disabling certain cookies may affect website functionality. For details, see our Cookie Policy at www.wavhz.com/cookies.

11. Data Security

WAVhz implements industry-standard technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure:

• AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Role-based access control (RBAC) with multi-factor authentication
• Regular penetration testing and vulnerability assessments
• ISO/IEC 27001-aligned information security management
• Incident response and data breach notification procedures
• Employee data protection training and confidentiality obligations

In the event of a data breach affecting your rights, we will notify you and relevant authorities as required by applicable law (within 72 hours under GDPR; as prescribed under DPDP Act / CERT-In guidelines in India).

12. Children’s Privacy

Our services are not directed to individuals under the age of 18 (or the applicable age of digital consent in the relevant jurisdiction). We do not knowingly collect personal data from minors. If we become aware that personal data has been collected from a minor without verifiable parental consent, we will delete it promptly. To raise a concern, contact: legal@wavhz.com.

13. Third-Party Links & Integrations

Our website and products may contain links to third-party websites, government portals, DISCOM portals, and payment gateways. WAVhz is not responsible for the privacy practices of such third parties. We encourage you to review their privacy policies before providing any personal data.

14. Grievance Redressal (India)

In compliance with the Information Technology Act 2000 and the DPDP Act 2023, WAVhz has appointed a Grievance Officer:

If you are dissatisfied with our response, you may escalate your complaint to the Data Protection Board of India (once constituted under the DPDP Act) or other applicable regulatory authority.

15. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our business, legal requirements, or data practices. Material changes will be communicated via:

• Prominent notice on www.wavhz.com
• Email notification to registered users
• In-app notification (where applicable)

Continued use of our services following notice of changes constitutes your acceptance of the updated Policy. The current version will always be available at www.wavhz.com/privacy.

16. Contact Us