1. Who we are
Velspak Energy (“Velspak”, “we”, “us”) builds and operates a connected electric vehicle charging network based in Lekki, Lagos, Nigeria. We are the data controller for the personal data described in this policy.
We process personal data in line with the Nigeria Data Protection Act 2023 (“NDPA”) and the regulations and guidance of the Nigeria Data Protection Commission (“NDPC”).
2. Information we collect
Information you give us
- Account details — your name, email address, phone number and password (stored in hashed form), or your Google account name and email if you sign in with Google.
- Vehicle details — information you choose to add about your EV, such as make, model and connector type, so we can show compatible chargers.
- Support messages — what you send us when you contact support or give feedback.
Information created when you use Velspak
- Charging sessions — the station and charger used, start and end times, energy delivered, cost and session status.
- Wallet and payments — top-ups, balances, payments, refunds, subscription plan and billing history. Card details are collected and stored by our payment processor, Paystack, not by us. We only receive a reference, the card type and its last four digits.
- Bookings — reservations you make and whether they were used or cancelled.
Information from your device
- Location— with your permission, your device's location to show nearby chargers, distances and directions. You can turn this off at any time in your device settings.
- Device and app data — device model, operating system, app version, push notification token, IP address and crash diagnostics.
3. How we use your information
- Create and manage your account and verify your email or phone number.
- Show chargers near you, their availability and directions to them.
- Start, stop, monitor and bill charging sessions and bookings.
- Process wallet top-ups, payments, subscriptions and refunds.
- Send receipts, security codes and service messages about your account.
- Send push notifications about your sessions, and — if you choose — expansion news such as new stations and corridors.
- Provide customer support and resolve disputes.
- Detect and prevent fraud, abuse and security incidents.
- Fix bugs, keep the service reliable and plan where to expand the network.
- Meet our legal, tax and accounting obligations.
We do not sell your personal data.
4. Legal bases for processing
Under the NDPA we rely on the following lawful bases:
- Contract — to provide the account, charging, booking and payment services you sign up for.
- Consent — for precise location, push notifications and marketing messages. You can withdraw consent at any time without affecting what we did before.
- Legal obligation — to keep financial records and respond to lawful requests from authorities.
- Legitimate interests — to keep the service secure, prevent fraud and improve the network, where those interests are not overridden by your rights.
5. Who we share it with
We share personal data only with service providers who help us run Velspak, under contracts that require them to protect it and use it only on our instructions:
| Provider | Purpose | Data involved |
|---|---|---|
| Google (Firebase, Google Maps Platform, Google Sign-In) | Maps, station search and directions; push notifications; crash reporting; signing in with Google | Approximate or precise location, device identifiers, push token, crash diagnostics, Google account name and email (if you use Google Sign-In) |
| Paystack | Wallet top-ups, card payments and subscription billing | Name, email, phone, payment amount and reference. Card details go directly to Paystack — we never see or store your full card number. |
| Transactional email provider (e.g. SendGrid) | Verification codes, password resets, receipts and booking confirmations | Name, email address and the content of the message |
| Charge point operators and network partners | Starting, stopping and billing charging sessions on their hardware | Charger ID, session times, energy delivered and a session or account reference |
| Cloud hosting providers | Running our servers, database and backups | Any of the data described in this policy, stored on our behalf |
We may also disclose personal data:
- where required by law, regulation, court order or a lawful government request;
- to protect the safety, rights or property of our users, the public or Velspak;
- as part of a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.
6. International transfers
Some of our providers store or process data outside Nigeria. Where that happens, we rely on the transfer mechanisms permitted by the NDPA — such as an adequacy decision or contractual safeguards — so your data receives a comparable level of protection.
7. How long we keep it
- Account data — for as long as your account is open, then deleted or anonymised within a reasonable period after you close it.
- Payment and transaction records — for as long as tax and accounting laws require, typically six years.
- Charging session data — while your account is open; after that we keep only anonymised data to plan the network.
- Support messages — for up to two years after the conversation ends.
8. How we protect it
We use encryption in transit (HTTPS/TLS), hashed passwords, access controls that limit staff access to what their role needs, and logging of administrative actions. No system is completely secure; if a breach affects your personal data in a way that is likely to put you at high risk, we will notify you and the NDPC as the law requires.
9. Your rights
Under the NDPA you have the right to:
- be told how your personal data is used (this policy);
- access a copy of the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data deleted where we no longer have a reason to keep it;
- restrict or object to certain processing, including direct marketing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you.
To exercise any of these rights, email info@velspak.com. We may need to verify your identity first, and we will respond within the time the law allows. To have your account and its data deleted, you can also submit an account deletion request. If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.
10. Location, notifications & marketing
- Location— turn location access on or off in your phone's settings. Without it you can still search for stations manually.
- Push notifications— turn them off in your phone's settings or in the app. Essential messages about payments and security may still be sent by email.
- Marketing — unsubscribe using the link in any marketing email or by contacting us.
11. Children
Velspak is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Cookies & this website
This public website does not use advertising or analytics cookies. If you request live EV headlines, our server fetches them from the publishers on your behalf; your browser does not contact those publishers until you click a story. The staff login area uses strictly necessary, secure cookies to keep authorised staff signed in. Links to other websites are governed by those websites' own privacy policies.
13. Changes to this policy
We may update this policy as Velspak grows. We will change the “last updated” date above and, for significant changes, tell you in the app or by email before they take effect.