Privacy policy

This Privacy Policy explains how Osprey Charging Network Ltd (company number 08460233) (we, us, our) collects, uses, shares, and retains personal data in connection with the Circuit fleet card, fleet management platform (Platform), driver mobile app (App), and home-charge reimbursement service (Home-Charge Refund) (together, the Services).

Our head office is at 3rd Floor, Martin House, 5 Martin Lane, London EC4R 0DP. Our VAT number is GB161207640. We operate the website at www.circuitpay.co.uk

We are a data controller registered with the Information Commissioner's Office (ICO). We disclose Charging Data to Fleet Customers who act as independent controllers in respect of that data for their own fleet management purposes — further details are set out in section 9 below.

This Privacy Policy applies to:

1. fleet managers and authorised contacts who hold a fleet account (Fleet Customers);
2. drivers registered on the Platform by a Fleet Customer (Drivers); and
3. visitors to our website.

Our Data Protection Officer (DPO) can be contacted at dataprotection@ospreycharging.co.uk.

To exercise any of your data subject rights, please contact our DPO at the address above.

This Privacy Policy covers:

1. the categories of personal data we collect and receive;
2. the purposes for which we process personal data and the legal bases we rely on;
3. how we share personal data with third parties;
4. how long we keep personal data;
5. your rights in relation to your personal data; and
6. our use of cookies and similar technologies.

This Privacy Policy does not cover the data practices of Fleet Customers acting as independent data controllers in respect of their own Drivers. Fleet Customers should provide their Drivers with their own privacy information before adding them to the Platform.

Fleet account data: When a Fleet Customer applies for the Services, we collect the company name and registration number, authorised contact names, email addresses, country of operation, and payment details (including direct debit mandate information).

Driver registration data: Fleet Customers provide us with the full name, email address, and home address of each Driver they add to the Platform.

Charging session data: Each time a Driver uses the Circuit card or App to access an electric vehicle charge point (EVCP), we receive a charging data record (CDR) from the relevant charge point operator (CPO). This includes the time, location, duration, energy consumed (kWh), and cost of each session (Charging Data).

Home-Charge Refund data: Where a Driver participates in the Home-Charge Refund service, we collect and access:

1. the Driver's home or installation address;
2. home energy account details and energy tariff information;
3. data from the Driver's home charge point (Home CP), including session records;
4. telematics data from the Driver's corporate electric vehicle (Corporate EV); and
5. records identifying whether charging sessions are for business or private purposes (Home-Charge Data).

Credit and financial data: We carry out credit checks on Fleet Customer applicants and, where appropriate, on an ongoing basis during provision of the Services. This involves sharing information with and receiving information from third-party credit reference agencies.

Flexible demand data: Where we deploy demand flexibility or grid-balancing services, we process charging session data and vehicle charging patterns relating to Drivers.

Fraud and security data: We process transaction data, usage patterns, and account activity for the purpose of detecting and preventing fraud.

Marketing data: We process contact details of Fleet Customers and Drivers for the purpose of marketing similar products and services, subject to consent and applicable rules under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

Website and cookie data: When you visit our website and App, we collect technical data such as IP address, browser type, device information, and pages visited. Please see section 14 (Cookies) for further detail.

We do not collect any special categories of personal data (such as health, biometric, or genetic data) in connection with the Services.

We collect personal data:

1. directly from Fleet Customers, when they submit an application, set up a Fleet Account, or contact us;
2. directly from Drivers, when they download the App, create a Driver account, and accept the relevant terms;
3. automatically, through the App, Platform, and card transactions when Drivers use EVCPs;
4. from third-party CPOs, who send us CDRs following each charging session;
5. from third-party credit reference agencies in connection with credit checks;
6. from providers of the Home CP and the Driver's domestic electricity supplier in connection with the Home-Charge Refund service; and
7. from direct vehicle APIs installed in Corporate EVs, where applicable.

We process personal data for the following purposes and on the following legal bases under the UK General Data Protection Regulation (UK GDPR):

Where we rely on legitimate interests as our legal basis, those interests are: operating a safe and commercially viable electric vehicle charging service; preventing fraud and protecting the security of accounts and systems; and developing and improving our Services. We have assessed that these interests are not overridden by the fundamental rights and freedoms of the individuals concerned.

Where we rely on consent (including for the Home-Charge Refund service and for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact our DPO or, for marketing, use the opt-out link in any marketing communication.

We share personal data with the following categories of third party in connection with the Services:

1. Fleet Customers (as independent controllers): Fleet Customers can access Charging Data for their Drivers through the Platform. Fleet Customers are responsible for ensuring they have an appropriate lawful basis under UK GDPR for sharing driver personal data with us and for providing drivers with appropriate privacy information before adding them to the Platform.
2. Charge point operators: We receive CDRs from CPOs in connection with charging sessions. CPOs may receive confirmation of authorised charging requests.
3. Credit reference agencies: We share information with credit reference agencies to carry out credit checks in accordance with our Terms. These agencies act as independent controllers. We currently use Creditsafe Business Solutions Limited, whose privacy policy is available at https://www.creditsafe.com/gb/en/legal/privacy-policy.html. Credit searches may be recorded on the Driver's or Fleet Customer's credit file.
4. Payment processors: We share necessary payment data with our payment processor to collect Variable Direct Debit payments.
5. Home-Charge Refund providers: Where applicable, we share Driver personal data with providers who facilitate the Home-Charge Refund service, including evenergy (home charger API integrations and home charge refund administration). Where any provider processes personal data as an independent controller, that processing is governed by the provider's own privacy notice.
6. Domestic electricity suppliers: We share Driver information with the Driver's domestic electricity supplier solely for the purpose of processing Home-Charge Refund payments.
7. Group companies: Any member of our group of companies may provide the Services and may receive and process personal data for that purpose.
8. Professional advisers: We may disclose personal data to our legal, financial, and other professional advisers where reasonably necessary.
9. Regulatory and law enforcement authorities: We may disclose personal data where required to do so by law, court order, or the direction of a regulatory or law enforcement authority.

We do not sell personal data to third parties.

The Services are currently provided within the United Kingdom only. Where any personal data is transferred outside the UK (a Restricted Transfer), we will only do so where:

1. the transfer is to a country subject to UK adequacy regulations made under Article 45 UK GDPR;
2. appropriate safeguards are in place under Article 46 UK GDPR, including a UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses; or
3. an exception under Article 49 UK GDPR applies.

At the date of this Privacy Policy, our approved sub-processors are UK-established or their transfer safeguard status is under review (please refer to Schedule 2 of the Data Processing Annex to the Terms for the current list). We will notify Fleet Customers of any Restricted Transfer and the applicable safeguards before such transfer takes effect.

When a Fleet Customer adds a Driver to the Platform, Charging Data relating to that Driver becomes accessible to the Fleet Customer through the Platform. We and the Fleet Customer are each independent controllers in respect of Charging Data: We process it for the purposes of providing the Services (outlined in this policy), while the Fleet Customer processes it for its own fleet management purposes. Each party independently determines the purposes and means of its own processing of Charging Data.

As independent controllers, each of us and the Fleet Customer is individually responsible for its own compliance with UK GDPR in respect of Charging Data, including transparency obligations to Drivers, handling data subject rights requests, and notifying the ICO of any personal data breach.

Fleet Customers are responsible for providing Drivers with privacy information about their own processing of Charging Data before adding them to the Platform, and for handling data subject rights requests from Drivers in relation to the Fleet Customer's own processing. Drivers may also contact us directly in relation to our processing of their Charging Data.

We retain personal data only for as long as is necessary for the purposes for which it was collected, in accordance with Article 5(1)(e) UK GDPR. Our standard retention periods are:

Where we are legally required to retain personal data for a longer period (for example, for tax, accounting, or regulatory purposes), we will retain it for that longer period and no longer.

Following termination of the contract, we will either return to the Fleet Customer or securely delete all Driver personal data, except where we are required by law to retain it or where it has been anonymised in accordance with industry-standard techniques.

We implement and maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, in accordance with Article 32 UK GDPR. These measures include, as a minimum:

1. pseudonymisation and encryption of personal data in transit and at rest, where appropriate to the level of risk;
2. measures to ensure the ongoing confidentiality, integrity, availability, and resilience of our processing systems and services;
3. the ability to restore access to personal data in a timely manner in the event of a physical or technical incident; and
4. processes for regularly testing, assessing, and evaluating the effectiveness of our technical and organisational security measures.

Fleet Customers are responsible for maintaining prudent and reasonable security standards in relation to their use of the Platform and App, including protecting Fleet Account credentials from unauthorised access.

Under UK GDPR, you have the following rights in relation to your personal data:

1. Right of access: you have the right to request a copy of the personal data we hold about you.
2. Right to rectification: you have the right to ask us to correct inaccurate or incomplete personal data.
3. Right to erasure: you have the right to ask us to delete your personal data in certain circumstances.
4. Right to restriction of processing: you have the right to ask us to restrict the way we process your personal data in certain circumstances.
5. Right to data portability: you have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where technically feasible.
6. Right to object: you have the right to object to processing based on legitimate interests, including profiling, and to object to direct marketing at any time.
7. Rights relating to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, unless we have your explicit consent or it is otherwise permitted by law.

To exercise any of these rights, please contact our DPO at dataprotection@ospreycharging.co.uk. We will respond within one calendar month of receiving your request, in accordance with Articles 12–22 UK GDPR.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that took place before withdrawal.

If you are not satisfied with how we handle your personal data or respond to your rights request, you have the right to lodge a complaint with the ICO:

1. website: www.ico.org.uk;
2. telephone: 0303 123 1113; or
3. post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We may send you marketing communications about similar products and services offered by us, by email and push notification, where permitted by PECR.

For electronic marketing to business contacts, we rely on the soft opt-in under regulation 22 of PECR, where we have previously provided Services to the Fleet Customer or its Drivers and are marketing similar services. In all other cases, we will only send marketing communications with your prior consent.

You can opt out of marketing at any time by contacting us at support@circuitpay.co.uk.

Opting out of marketing will not affect our ability to send you service-related communications that are necessary for the performance of the contract.

We use cookies in accordance with our cookies policy.

For further information about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.

We may update this Privacy Policy from time to time to reflect changes in the law, our data processing activities, or our Services. We will post the updated policy on our website and update the "Last updated" date at the top of this page.

Where changes are material, we will notify Fleet Customers by email at least 30 days before the changes take effect, in accordance with our Terms.

We encourage you to review this Privacy Policy periodically. Your continued use of the Services following notification of any changes constitutes acceptance of the updated policy.

This Privacy Policy is governed by, and construed in accordance with, the law of England and Wales.

The primary legislation applicable to our data processing activities includes:

1. the UK General Data Protection Regulation (UK GDPR), as defined by the Data Protection Act 2018 (DPA 2018) in conjunction with the European Union (Withdrawal) Act 2018;
2. the Data Protection Act 2018;
3. the Data (Use and Access) Act 2025;
4. the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR); and
5. any other applicable UK data protection legislation as amended or replaced from time to time.