Terms & conditions

Osprey Charging Network Ltd (company number 08460233) (we, us and our) is a company registered in England and Wales and our head office is at 3rd Floor, Martin House, 5 Martin Lane, London EC4R 0DP. Our VAT number is GB161207640. We operate the website www.circuitpay.co.uk.

To contact us or make a complaint please contact your account manager using the telephone number or email address provided during onboarding, or contact our customer service via email at support@circuitpay.co.uk. How to give us formal notice of any matter under this Contract is set out in clause 20.2.

You acknowledge and agree that any member of the Osprey group of companies may provide the Services under this Contract without the need for formal amendment to these Terms, and references to we, us and our shall be construed accordingly.

The Services referred to in these Terms are the provision by us to you, our Fleet Customer, of:

1. a radio frequency identification card (Card) made available by us to you, that can be used to access electric vehicle charge points and pay for electric vehicle charging;
2. fleet management platform enabling you to access and charge corporate EVs, manage invoicing and payments and obtain home-charging reimbursements for your fleet drivers (Platform);
3. driver mobile app that permits access to electric vehicle charge points (App); and
4. reimbursement for charging at home of corporate EVs for business use in partnership with your Drivers' domestic electricity supplier (Home-Charge Refund).

Our contract. These terms and conditions (Terms) apply to the application by you for the Services and supply of Services by us to you and your fleet drivers (Drivers) (Contract). They apply to the exclusion of any other terms that you seek to impose or incorporate, or which are implied by law, trade custom, practice or course of dealing.

Entire agreement. The Contract is the entire agreement between you and us in relation to the Services. You acknowledge that you have not relied on any statement, promise or representation or assurance or warranty that is not set out in the Contract.

Updates. We may make updates to these Terms from time to time. The most up to date version displayed on our website will apply to your use of the Services and our Contract will be deemed to have been updated accordingly. If we propose to make changes to your Contract that are materially detrimental to you, we will give you at least 30 days' written notice of the changes. If you do not agree with the changes, you can terminate this Contract in accordance with clause 18 without penalty, however you will still be required to pay for any Services you have already received.

Submitting your application. You may submit your application for the Services through our website. Your application is an offer by you to purchase the Services subject to these Terms (Application).

Application requirements. By submitting an Application, you are agreeing to this Contract and you will:

1. register your company details (including company name and number, email and country) as part of the Application process;
2. set up payment arrangements with us before you can access public charging through the App and/or using the Card;
3. provide us with the full name, email and home address of your Drivers;
4. provide us with an address that allows you to receive the Card(s) by post;
5. ensure your Drivers are aware they need a mobile phone that gives access to the App on iOS or Android;
6. provide us with any information and permissions we require to take payment;
7. make any changes to your payment arrangements or Contract via email, or your online account;
8. keep all your and your Drivers' personal details accurate and up to date;
9. inform us promptly if a Driver leaves your business, and ensure you retrieve their Card so this can be reused;
10. ensure that you have obtained prior consent from your Drivers to share their personal data with us and that you have made them aware that their charging data can be viewed by our business and your business, which includes information such as time, location and cost of charge. By adding a Driver to the Platform, you are confirming you have received their consent to do so.

Input errors. You are responsible for ensuring that all details contained in your Application are complete and accurate.

Credit check. By submitting an Application, you consent to us carrying out credit checks at any time in relation to your Application and continued provision of the Services. Such checks will be carried out by third party credit reference agencies. You authorise us to share such information as is reasonably necessary with such credit reference agencies for the purposes of carrying out these credit checks.

Acknowledging receipt of your Application. After you submit your Application, you will receive an email from us acknowledging that we have received it, but please note that this does not mean that your Application has been accepted. Our acceptance of your Application will take place as described in clause 4.6.

Accepting your Application. Our acceptance of your Application takes place when we send an email to you to accept it (Application Confirmation), at which point and on which date (Commencement Date) the Contract between you and us will come into existence.

If we cannot accept your Application. If we are unable to supply you with the Services for any reason, we will inform you of this by email and we will not process your Application. If you have already paid for any Services, we will refund you the full amount.

Cooling-off period. You may cancel the Contract within 14 days of your receipt of the Application Confirmation (Cooling-off Period). If you cancel during the Cooling-off Period, but Charges have already been incurred by you or your Drivers, you are still responsible for paying those Charges up to the date of cancellation.

Cancellation after cooling-off period. You can also cancel the Contract at any time after the Cooling-off Period by giving us not less than 30 days' written notice in accordance with clause 5.3. Cancellation will be effective on the later of:

1. you paying to us all sums due up to the date of cancellation; and
2. the date your cancellation notice expires.

How to cancel. To cancel the Contract, you must email your dedicated account manager with the details provided during onboarding or email our customer services team at support@circuitpay.co.uk. If you are emailing us, please include details of your Application to help us to identify it.

Refunds on cancellation. If you cancel the Contract during the Cooling-off Period, we will refund you in full for any fees paid in advance for Services that were not received (if any), by the method you used for payment. We may deduct from any refund an amount for the supply of the Services provided for the period up to the time when you gave notice of cancellation in accordance with clause 5.3.

Electric Vehicle Charge Points (EVCPs). To charge an electric vehicle using an EVCP as part of the Services, you and your Drivers will need to use the Card or the App on the payment terminal of a relevant EVCP.

EVCP property. All EVCPs are the property of the relevant charge point operator that operates the relevant charging hardware and corresponding charging network (CPO). We shall have no liability for third party service providers, CPOs or third party apps. You will be responsible for ensuring you and your Drivers comply with the terms and conditions of any such third party service providers, CPOs or third party apps that you are notified of.

Flexible demand. We reserve the right to generate revenue from flexible EV demand, including but not limited to deploying demand flexibility services and/or grid balancing services. In such cases, we will, in good faith, deploy a mutually beneficial sharing arrangement.

Credit limit. Each Card and/or Fleet Account will have a credit limit set (at our discretion) and notified to you by us (Credit Limit). We display Credit Limits in the Platform. We may reduce your Credit Limit based on our assessment of risk or your ability to repay. If you or your Drivers exceed your Credit Limit, we may suspend access to charging services until payment is received.

Card restrictions. Any Card may only be used to pay for charging at EVCPs in the UK.

Replacement Cards. If we send you replacement or additional Cards, they will be linked to your Fleet Account and this Contract applies to them all. We may charge reasonable fees for replacement or additional Cards as set out in clause 12.5.

Unused Cards. Where you or any of your Drivers have Cards that are no longer required, you must notify us immediately so that we can deactivate them and arrange for their return or secure destruction.

Protecting your Fleet Account and Card details. You must (and procure that each of your Drivers must):

1. keep the Card and Fleet Account details safe and not allow anyone else to use them without your authorisation;
2. ensure that you comply with any reasonable instructions that we may give about using the Card; and
3. implement reasonable measures to prevent and/or detect unauthorised payments and/or fraudulent use of your Card and/or Fleet Account and minimise losses as a consequence of fraud.

Telling us about lost or compromised Cards. You must (and procure that each of your Drivers must) freeze your Card via the Platform and notify us as soon as possible via contacting your account manager using the telephone number or email address provided during onboarding, or contacting our customer service via email at support@circuitpay.co.uk:

1. if any Cards or Fleet Account details are lost or stolen (if you later find them you must destroy them); or
2. if you think any Cards or Fleet Account details may have been compromised (which includes if they are used without proper authorisation).

Liability for payments. You will:

1. (subject to 7.7(b)) not be responsible for any fraudulent Card payments if the Cards and/or Fleet Account details are lost or stolen or if a Card is misused before you receive it, after you either (i) tell us or (ii) block the relevant Card via your Platform. If someone uses your Cards and/or Fleet Account details and obtained them with your permission, you may be liable for all payments which take place; and
2. be liable for all Card payments from lost or stolen Cards and/or Fleet Account details if you or any of your Drivers have acted fraudulently or if any payments were made because you or any of your Drivers deliberately or negligently failed to keep your Cards and/or Fleet Account details secure; and
3. be liable for fraudulent use of the Home-Charge Refund service by your Drivers.
4. be responsible for your Drivers' acts and omissions in their use of the Card and the App.

Fleet Account creation. After receipt of your Application Confirmation your management account will be created (Fleet Account) enabling you to access and charge your corporate EVs, manage invoicing and payments and obtain home-charging reimbursements for your Drivers from our online platform (Platform).

Fleet Account restrictions. You are not permitted to share your Fleet Account with any other person. We are not responsible for any unauthorised use of your Fleet Account and we reserve the right to suspend or terminate your Fleet Account if we suspect unauthorised use.

Driver App use. The App requires a mobile device with iOS or Android operating system. Your Drivers may download a copy of the App onto their mobile device and view, use and display the App in connection with charging their corporate EV only. From time to time we may automatically update the App to improve performance, enhance functionality, reflect changes to the operating system or address security issues. If your Drivers choose not to install such updates they may not be able to continue using the App.

Licence restrictions. You and (in respect of the App) your Drivers will:

1. not rent, lease, sub-license, loan, provide, or otherwise make available, the Platform and/or App in any form, in whole or in part to any person;
2. not copy the Platform and/or App, except as part of the normal use of the Platform and/or App or where it is necessary for the purpose of back-up or operational security;
3. not translate, merge, adapt, vary, alter or modify, the whole or any part of the Platform and/or App, nor permit the Platform and/or App or any part of them to be combined with, or become incorporated in, any other programs, except as necessary to use the Platform and/or App on devices as permitted in these Terms;
4. not disassemble, de-compile, reverse engineer or create derivative works based on the whole or any part of the Platform and/or App nor attempt to do any such things; and
5. comply with all applicable technology control or export laws and regulations that apply to the technology used or supported by the Platform and/or App.

Acceptable use restrictions. You and (in respect of the App) your Drivers must:

1. not use the Platform and/or App in any unlawful manner, for any unlawful purpose, or in any manner inconsistent with these Terms, or act fraudulently or maliciously;
2. not infringe our intellectual property rights or those of any third party in relation to your use of the Platform and/or App;
3. not transmit any material that is defamatory, offensive or otherwise objectionable in relation to your use of the Platform and/or App;
4. not use the Platform and/or App in a way that could damage, disable, overburden, impair or compromise our systems or security or interfere with other users;
5. not collect or harvest any information or data from the Platform and/or App or our systems or attempt to decipher any transmissions to or from the servers running the Platform and/or App; and
6. maintain prudent and reasonable security standards and protections in relation to use of the Platform and/or App.

Driver eligibility. You may invite Drivers to participate in the Home-Charge Refund service by adding them to the Platform.

Driver conditions. You shall procure that each Driver satisfies the following conditions before using the Home-Charge Refund service:

1. has a compatible, functioning charge point installed at their home (Home CP) to facilitate the charging of their corporate electric vehicle (Corporate EV) and ensures that their Home CP maintains an uninterrupted internet connection;
2. downloads the App, creates a Driver account and accepts the terms and conditions therein;
3. provides all information reasonably requested by us in order to provide the Home-Charge Refund services, including accurate, complete and up-to-date information about their home energy account, energy tariff, Corporate EV, Home CP, the Home CP installation address and records of when the Home CP is used to charge the Corporate EV for business purposes;
4. has obtained all permissions and consents necessary to use the Home-Charge Refund services for their Corporate EV at their home;
5. consents to us (and any third parties involved in providing any part of or all of the Home-Charge Refund services): (i) accessing the data from the provider of the Home CP and/or directly from the Home CP and sharing this with you in connection with provision of the Home-Charge Refund services; (ii) accessing the data from or relating to any telematics system installed in the Driver's Corporate EV; (iii) contacting the Driver's domestic electricity supplier for the purposes of transferring payments, commencing and performing the Home-Charge Refund services; (iv) receiving and accessing the Driver's domestic electricity supplier accounts and other related documentation of the Driver and the information contained within them; and (v) making payments and receiving refunds from the Driver's domestic electricity supplier; and
6. under no circumstances will the Home-Charge Refund service be provided in relation to private/non-business EV charging.

Our Home-Charge Refund services. To provide the Home-Charge Refund services we will:

1. access data from the compatible Home CP to receive charge session data and kWh used by each Driver to charge their Corporate EV (Home-Charge Data);
2. access data from your Driver's domestic electricity supplier to determine the electricity tariff applied to charging the Driver's Corporate EV at their home; and
3. make payment directly to your Driver's domestic electricity supplier based on the Home-Charge Data and invoice this amount to your business account. Such payments may be displayed in the App and the Platform.

Our commitment and conditions. We are committed to reimbursing your Drivers' domestic electricity suppliers directly for electricity used to charge Corporate EVs at home, subject to:

1. receiving all necessary home energy account details and explicit consent from the respective Drivers;
2. the Driver's domestic electricity supplier, Corporate EV, any charge point provider, Home CP, Driver's internet connection, any Driver or any third party outside of our control not preventing us from performing the Home-Charge Refund services;
3. the Driver's domestic electricity supplier, any charge point provider, Home CP, or any Driver providing the data necessary for us to perform the Home-Charge Refund services; and
4. compliance with applicable law or regulations.

Service restrictions. The Home-Charge Refund services are only available for Corporate EVs used for business purposes. You are responsible for ensuring that your Drivers only use the Home-Charge Refund services for Corporate EVs and not for domestic or personal vehicles.

Commission. We will receive a commission, referral fee or other financial benefit in connection with the installation of a Home CP from our partner supplier in connection with the Home-Charge Refund services. The amount of such commission may not be fixed and may vary. The existence of this commission arrangement does not affect the prices charged for the Services.

It is your responsibility to ensure that:

1. the terms of your Application are complete and accurate;
2. you cooperate with us in all matters relating to the Services;
3. you pay to us all Charges you and/or your Drivers incur under this Contract;
4. you provide us with such information and materials we may reasonably require in order to supply you with the Services, and ensure that such information is complete and accurate in all material respects;
5. your Drivers are aware of and comply with these Terms, our Privacy Policy and you will be responsible for any breach by any of your Drivers;
6. you notify us immediately upon becoming aware a Card is lost, stolen or being used fraudulently or by an unauthorised person; and
7. your Drivers provide accurate, complete and up-to-date home energy account details for the Home-Charge Refund services and inform us promptly of any changes.

If our ability to perform the Services is prevented or delayed by any failure by you to fulfil any obligation listed in clause 10.1 (Your Default):

1. we will be entitled to suspend performance of the Services until you remedy Your Default, and to rely on Your Default to relieve us from the performance of the Services, in each case to the extent Your Default prevents or delays performance of the Services. In certain circumstances Your Default may entitle us to terminate the Contract under clause 18;
2. we will not be responsible for any costs or losses you sustain or incur arising directly or indirectly from our failure or delay to perform the Services; and
3. it will be your responsibility to reimburse us on written demand for any costs or losses we sustain or incur arising directly or indirectly from Your Default.

We are currently unable to perform the Services outside of the UK.

In consideration of us providing the Services you must pay our charges (Charges) in accordance with this clause 12.

Platform fee: in consideration for providing the Services, we will charge you 2.5p per kWh processed via Platform.

Charges for Corporate EV charging. These Charges are based on the charging data record (CDR) sent to us by the relevant CPO. The Charges include (but are not limited to): volume of electricity consumed, connection fees, time spent charging, and parking fees.

Delayed charging data. We are only able to invoice for CDRs that we receive from the relevant CPO. There is sometimes a delay in CPOs sending the relevant data to us, and therefore the charges appearing on your weekly invoice may not include all charging data from the previous period. Delayed data will be processed and added to the next available invoice after we receive the requisite CDR from the CPO. This may mean that you are invoiced for Charges outside of the period that they were completed in. We reserve the right to invoice you up to 365 days after a charging session was completed.

Other reasonable costs. We can also charge you for other reasonable costs under certain circumstances. We will tell you how much such costs are at the time and will provide a breakdown if you ask us for one. These can include costs arising from the following:

1. additional or replacement Cards. We will issue one Card per Driver when you sign up and have registered your payment arrangements with us. We will issue additional or replacement Cards within 14 days of them being requested, and we may charge reasonable fees for these replacements;
2. charges we are required to pass on to our customers by law or regulation or a regulatory authority; and
3. any reasonable costs we incur (including administration costs) because you or any of your Drivers failed to comply with the Terms of this Contract.

VAT. Our Charges are exclusive of VAT. Where VAT is payable in respect of some or all of the Services you must pay us such additional amounts in respect of VAT, at the applicable rate, at the same time as you pay the Charges. We will provide you with a VAT invoice.

Subscription model. There is currently no subscription fee for access to the Services. However, we reserve the right to introduce a subscription fee in the future upon providing you with at least 30 days' written notice. If we introduce a subscription fee and you do not wish to continue with the Services, you may terminate this Contract in accordance with clause 18.2 without penalty.

Payment method. You will be required to pay by Variable Direct Debit, unless we agree an alternative payment arrangement with you. You will provide us with a direct debit mandate form acceptable to us on our request and will ensure that a valid direct debit mandate exists at all times during the course of this Contract.

Invoicing frequency. Periodically, we will add an invoice in the Invoices section of your online account and email you an invoice. This will include Charges that we have been able to successfully process from the CPO.

Payment terms. Payment will be due within 7 days of the invoice date.

Failed payments. If your Variable Direct Debit fails, we will contact you to resolve the outstanding balance. We may restrict your access to the Platform, suspend the Services and Home-Charge Refund services and your Drivers may be prevented from using the Card and/or App until we receive the outstanding sums. You are responsible for ensuring that payment can be made in full on the due date.

Fraudulent transactions. We reserve the right to refuse to process any transaction we deem fraudulent or suspicious.

Late payment. If you fail to make a payment under the Contract by the due date, then, without limiting our remedies under clause 18, you will have to pay interest on the overdue sum from the due date until payment of the overdue sum, whether before or after judgment. Interest under this clause 13.6 will accrue in accordance with the Late Payment of Commercial Debts (Interest) Act 1998 and the Late Payment of Commercial Debts Regulations 2002.

Payment in full. You shall pay all amounts due under the Contract in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).

All intellectual property rights in or arising out of or in connection with the Services will be owned by us.

We will process personal data provided by you and your Drivers in accordance with our Privacy Policy, the terms of which are incorporated into this Contract.

Both you and we will comply with the obligations in the Data Processing Annex.

Your attention is particularly drawn to this clause.

Liability that cannot be excluded. Nothing in the Contract limits any liability which cannot legally be limited, including liability for:

1. death or personal injury caused by negligence; and
2. fraud or fraudulent misrepresentation.

Excluded losses. Subject to clause 16.2, we will not be liable to you, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with the Contract for:

1. loss of profits;
2. loss of sales or business;
3. loss of agreements or contracts;
4. wasted expenses;
5. loss of revenue;
6. loss of or damage to goodwill;
7. any indirect or consequential loss;
8. any loss which was not or could not have been reasonably foreseen even if we, our employees, subcontractors or agents did not follow this Contract;
9. any loss caused by an Event Outside Our Control (see clause 19);
10. any loss caused by the interruption, disruption or failure of any EVCP, Card, Platform or App availability or operability; and
11. any loss arising from the failure of Home-Charge Refund services due to circumstances beyond our control.

Maximum liability. Subject to clause 16.2, our total liability to you arising under or in connection with the Contract, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, will be limited to £5,000 in any 12-month period.

Notice of claims. Unless you notify us that you intend to make a claim in respect of an event within the notice period, we shall have no liability for that event. The notice period for an event shall start on the day on which you became, or ought reasonably to have become, aware of the event having occurred and shall expire 1 month from that date. The notice must be in writing and must identify the event and the grounds for the claim in reasonable detail.

Survival. This clause 16 will survive termination of the Contract.

We each undertake that we will not at any time during the Contract, and for a period of two years after termination of the Contract, disclose to any person any confidential information concerning one another's business, affairs, customers, clients or suppliers, except as permitted by clause 17.2.

We each may disclose the other's confidential information:

1. to such of our respective employees, officers, representatives, partners contracted in connection with provision of the Services or professional advisers who need to know such information for the purposes of exercising our respective rights or carrying out our respective obligations under the Contract. We will each ensure that such employees, officers, representatives, subcontractors or advisers comply with this clause 17; and
2. as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

Each of us may only use the other's confidential information for the purpose of fulfilling our respective obligations under the Contract.

Termination for breach. Without limiting any of our other rights, we may suspend the performance of the Services, or terminate the Contract with immediate effect by giving written notice to you if:

1. you or any of your Drivers commit a material breach of any term of the Contract and (if such a breach is remediable) fail to remedy that breach within 5 days of you being notified in writing to do so;
2. you fail to pay any amount due under the Contract on the due date for payment;
3. we have reason to believe any of your Drivers has tampered with or damaged an EVCP;
4. we have reason to believe you or any of your Drivers has acted fraudulently;
5. we are required to do so by any law, regulations or authority; or
6. your financial position deteriorates to such an extent that in our reasonable opinion your capability to adequately fulfil your obligations under the Contract has been placed in jeopardy.

Termination for convenience. Either party may terminate this Contract by giving the other party not less than 30 days' written notice. All outstanding payments must be settled and Cards must be returned upon termination.

Consequences of termination. On suspension or termination of the Contract you must pay us any outstanding amounts due. Termination of the Contract will not affect your or our rights and remedies that have accrued as at termination.

Survival. Any provision of the Contract that expressly or by implication is intended to come into or continue in force on or after termination will remain in full force and effect.

We will not be liable or responsible for any failure to perform, or delay in performance of, any of our obligations under the Contract that is caused by any act or event beyond our reasonable control (Event Outside Our Control).

Some examples of Events Outside Our Control include, but are not limited to:

1. any EVCP not being properly maintained or functioning. The EVCPs are the property and responsibility of the relevant CPO;
2. insufficient or incorrect information being available on how to operate the relevant EVCP. You and your Drivers must contact the relevant CPO for this information;
3. an electricity supplier, CPO, Driver, home charging installer or any other third party outside of our control prevents us from performing the Services for any reason; and
4. failure of third party systems, including but not limited to home charging infrastructure or domestic electricity supplier systems preventing Home-Charge Refund services and delays or failures by domestic electricity suppliers in applying funds to the correct domestic energy account.

If an Event Outside Our Control takes place that affects the performance of our obligations under the Contract:

1. we will contact you as soon as reasonably possible to notify you; and
2. our obligations under the Contract will be suspended and the time for performance of our obligations will be extended for the duration of the Event Outside Our Control. We will arrange a new date for performance of the Services with you after the Event Outside Our Control is over.

You may cancel the Contract affected by an Event Outside Our Control which has continued for more than 30 days. To cancel please contact us. If you opt to cancel we will refund the price you have paid, less the charges reasonably and actually incurred by us in performing the Services up to the date of the occurrence of the Event Outside Our Control.

Notices to you under this Contract will be sent to the email address that you provided in your Application.

Notices to us under this Contract must be sent by post to 3rd Floor, Martin House, 5 Martin Lane, London, EC4R 0DP or by email to companysecretary@ospreycharging.co.uk.

The provisions of this clause will not apply to the service of any proceedings or other documents in any legal action.

Assignment and transfer:

1. We may assign or transfer our rights and obligations under the Contract to another entity without your consent, but this will not affect your rights under the Contract.
2. You may only assign or transfer your rights or your obligations under the Contract to another person if we agree in writing.

Variation. Any variation of the Contract only has effect if it is in writing and signed by you and us (or our respective authorised representatives).

Waiver. If we do not insist that you perform any of your obligations under the Contract, or if we do not enforce our rights against you, or if we delay in doing so, that will not mean that we have waived our rights against you or that you do not have to comply with those obligations. If we do waive any rights, we will only do so in writing, and that will not mean that we will automatically waive any right related to any later default by you.

Severance. Each paragraph of these Terms operates separately. If any court or relevant authority decides that any of them is unlawful or unenforceable, the remaining paragraphs will remain in full force and effect.

Third party rights. The Contract is between you and us. No other person has any rights to enforce any of its terms.

Governing law and jurisdiction. The Contract is governed by English law and the courts of England and Wales shall have exclusive jurisdiction for all disputes arising out of or in connection with the Contract.

In this Data Processing Annex, the following definitions apply in addition to those set out in the main Terms:

1. “Charging Data” means personal data relating to EV charging sessions conducted by Drivers using the Card or App, including (without limitation) the time, location, duration, kWh consumed, and cost of each charging session;
2. “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process” (and “Processing”), “Processor”, and “Special Categories of Personal Data” have the meanings given to them in the Data Protection Legislation;
3. “Data Protection Legislation” means the UK General Data Protection Regulation (as defined by the Data Protection Act 2018 in conjunction with the European Union (Withdrawal) Act 2018) (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and any other applicable UK data protection legislation as amended or replaced from time to time;
4. “Driver Personal Data” means personal data relating to Drivers as further described in Schedule 1 (Processing Activities and Data Inventory);
5. “Fleet Personal Data” means personal data relating to the Fleet Customer's authorised contacts and Fleet Account as further described in Schedule 1;
6. “Home-Charge Data” has the meaning given in clause 9.3(a) of the Terms;
7. “Restricted Transfer” means any transfer of personal data to a country outside the United Kingdom; and
8. “Sub-processor” means any third party appointed by Osprey to process personal data in connection with the Services.

References to clauses in this Data Processing Annex are to clauses of this Data Processing Annex unless otherwise stated. References to clauses in the “Terms” are to clauses in the main Terms & Conditions above.

Both you and we shall comply with our respective obligations under the Data Protection Legislation in connection with any processing of personal data under or in connection with the Contract. Neither you or we shall take any action that would cause the other to breach its obligations under the Data Protection Legislation.

This Data Processing Annex shall survive termination or expiry of the Contract.

Us as Controller: We are a Controller in respect of:

1. Fleet Personal Data processed for the purposes of entering into and administering the Contract, managing the Fleet Account, billing, fraud prevention, credit assessment, the flexible demand service and improving the Services; and
2. Driver Personal Data processed for the purposes of providing the Services (including the Platform, Card, App, and Home-Charge Refund services), fraud prevention, information security and marketing of similar services.

You as Controller: You are a Controller in respect of Driver Personal Data in respect of which you have independently determined the purpose of adding Drivers to the Platform.

Independent Controllers: You and us are each independent Controllers in respect of Charging Data that is accessible via the Platform (as contemplated by clause 4.2(j) of the Terms). We process Charging Data for the purposes described in clause DPA 3.1(b). You process Charging Data for your own fleet management purposes. Each party independently determines the purposes and means of its own processing of Charging Data. We shall make the essence of clause DPA 9 available to Drivers through our Privacy Policy in accordance with Articles 13 and 14 UK GDPR.

No Processor Relationship: Nothing in this Data Processing Annex or the Contract shall be construed as making us a Processor acting on behalf of you. We process Driver Personal Data as a Controller or Joint Controller for our own purposes.

You shall:

1. ensure you have identified and documented a valid legal basis under Article 6 UK GDPR (and, where applicable, Article 9 UK GDPR) for sharing Driver Personal Data with us;
2. prior to sharing any Driver Personal Data with us, provide Drivers with all information required by Articles 13 and 14 UK GDPR, including information about our role as Controller, the categories of personal data to be processed, and the purposes and legal bases for processing, as described in Schedule 1 below and our Privacy Policy;
3. not share with us any Special Categories of Personal Data unless we give prior written consent and an appropriate condition under Article 9 UK GDPR has been identified;
4. in relation to clause 4.2(j) of the Terms, ensure that any consent obtained from Drivers to share their personal data with us, and for us to share Charging Data back with you for your fleet management purposes, is: (A) freely given, taking particular account of any imbalance of power in the employment or engagement relationship; (B) specific and informed; (C) given by a clear affirmative act; and (D) as easy to withdraw as to give, in accordance with Article 7 UK GDPR, and you shall maintain records of all such consents;
5. in relation to clause 9.2(e) of the Terms, ensure that Driver consent to the processing of Home-Charge Data meets the requirements of Article 7 UK GDPR and is granular enough to cover each category of processing described in clause 9.2(e)(i)–(v) of the Terms; and
6. promptly notify us (and in any event within two (2) Business Days) of: (A) any withdrawal of consent by a Driver; (B) any request from a Driver to exercise their rights under Articles 15–22 UK GDPR; or (C) any actual or suspected Personal Data Breach relating to Driver Personal Data held by you.

We shall:

1. process Driver Personal Data and Fleet Personal Data only for the purposes described in Schedule 1 below and only in accordance with the Data Protection Legislation;
2. publish and maintain an accurate and up-to-date Privacy Policy describing our data processing activities in connection with the Services, including the controller-to-controller data sharing arrangement under clause DPA 9, and make this freely available to Drivers and you at all times;
3. implement and maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage in accordance with Article 32 UK GDPR and clause DPA 7;
4. maintain records of processing activities as required by Article 30 UK GDPR;
5. not appoint any Sub-processor without complying with clause DPA 6;
6. assist you, at your reasonable cost, in complying with your obligations under the Data Protection Legislation to the extent that our assistance is reasonably necessary, including in relation to data subject rights requests, security measures, Personal Data Breach notifications, and Data Protection Impact Assessments; and
7. respond to any request, inquiry, or enforcement notice from the Information Commissioner's Office (“ICO”) relating to the processing of Driver Personal Data without undue delay and keep you informed of any such contact that materially concerns Charging Data shared with you under clause DPA 9.

Approved Sub-processors: You acknowledge and consent to us appointing the sub-processors listed in Schedule 2 below (“Approved Sub-processors”). We shall notify you in writing of any proposed addition or replacement of an Approved Sub-processor at least thirty (30) days prior to such change taking effect.

Sub-processor obligations: Osprey shall ensure that any Sub-processor is subject to written data protection obligations that are no less protective than those required by Article 28 UK GDPR, including all the requirements set out in Article 28(3) UK GDPR.

Third-party data sharing: You acknowledge and will notify your Drivers in advance that the provision of the Services requires us to share Driver Personal Data with the following categories of third party:

1. the providers facilitating the Home-Charge Refund service, as an Approved Sub-processor under clause DPA 6.1;
2. domestic electricity suppliers, for the purpose of the Home-Charge Refund service under clause 9 of the Terms;
3. credit reference agencies for the purpose of credit checks under clause 4.4 of the Terms, which act as independent Controllers; and
4. payment processors for the purpose of processing Variable Direct Debit payments.

We shall ensure that appropriate data sharing agreements or controller-to-controller terms are in place with each third party referred to in clause DPA 6.3 where required by the Data Protection Legislation.

We shall both implement and maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, appropriate to the risks presented by the nature, scope, context, and purposes of processing, in compliance with Article 32 UK GDPR. Such measures shall include, as a minimum:

1. pseudonymisation and/or encryption of personal data in transit and at rest where appropriate to the level of risk;
2. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
3. the ability to restore access to personal data in a timely manner in the event of a physical or technical incident; and
4. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational security measures.

You shall implement and maintain prudent and reasonable security standards in relation to your access to and use of the Platform and App, including protecting your Fleet Account credentials from unauthorised access.

We shall notify you without undue delay, and in any event within forty-eight (48) hours, of becoming aware of a Personal Data Breach affecting Driver Personal Data or Fleet Personal Data for which we are a Controller or Joint Controller. Such notification shall include, to the extent then available:

1. a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and personal data records affected;
2. the name and contact details of our data protection officer;
3. the likely consequences of the Personal Data Breach; and
4. the measures taken or proposed to be taken to address the breach and mitigate its effects.

You shall notify us without undue delay, and in any event within forty-eight (48) hours, of becoming aware of any Personal Data Breach relating to Driver Personal Data held or processed by you.

Where required by Article 33 UK GDPR, we shall notify the ICO of a Personal Data Breach within seventy-two (72) hours of becoming aware of it. You shall provide us with all reasonable cooperation and assistance required in connection with any ICO investigation of a Personal Data Breach that concerns jointly processed personal data.

Where required by Article 34 UK GDPR, we shall communicate a Personal Data Breach to the affected Data Subjects without undue delay.

Scope: This clause DPA 9 sets out the terms on which we share Charging Data with you on a controller-to-controller basis, as contemplated by clause 4.2(j) of the Terms. You and we are each independent Controllers in respect of Charging Data and each party determines the purposes and means of its own processing.

Transparency to Drivers: We shall describe our own processing of Charging Data, and the fact that Charging Data is shared with you, in our Privacy Policy. You shall provide Drivers with appropriate privacy information in respect of your own processing of Charging Data when onboarding them to the Platform under clause 4.2(j) of the Terms.

Data subject rights: Each of us shall handle data subject rights requests relating to its own processing of Charging Data in accordance with Articles 12–22 UK GDPR. Where a request is received that relates to the other party's processing, the receiving party shall promptly inform the requester to direct their request to the other party or, with the data subject's agreement, forward the request to the other party.

Security responsibilities: We shall be responsible for implementing appropriate technical and organisational security measures in respect of Charging Data while it is held within the Platform. You shall be responsible for the security of your Fleet Account credentials, Driver Personal Data, the systems through which you access the Platform, and any Charging Data that you have exported or downloaded from the Platform.

Personal Data Breach: Each party shall notify the other without undue delay (and in any event within forty-eight (48) hours) of becoming aware of a Personal Data Breach affecting Charging Data or Driver Personal Data which is likely to affect the other party's data subjects or compliance obligations under the Data Protection Legislation.

ICO accountability: Each of us is individually responsible for, and accountable to, the ICO and to Drivers for its own compliance with the Data Protection Legislation in respect of its processing of Charging Data.

Review: We shall review this arrangement whenever there is a material change to the processing of Charging Data or to the Services, and shall consult with you in good faith on any consequential amendments to this clause DPA 9.

You and we shall, in respect of personal data for which you or we are a Controller, handle data subject rights requests (including rights of access, rectification, erasure, restriction of processing, data portability, and objection) in accordance with Articles 12–22 UK GDPR and within the statutory time limits prescribed therein.

Given your direct employment or engagement relationship with Drivers, you shall be the primary point of first contact for rights requests received from Drivers. You shall notify us of any such request within two (2) Business Days of receipt where our assistance is required to fulfil the request.

We shall provide you with such reasonable assistance as is required to enable you to fulfil data subject rights requests within the applicable statutory time limits, taking into account the nature of the processing and the information available to us.

Where a Driver exercises the right to erasure under Article 17 UK GDPR, you and we shall cooperate to determine whether erasure is required or whether a lawful ground for retention applies (including legal obligation or the establishment, exercise, or defence of legal claims). You and we shall each be responsible for implementing any agreed erasure within our own systems.

Nothing in this clause DPA 10 limits any Driver's statutory right to exercise their data subject rights directly against us as Controller, or to complain to the ICO.

You and we acknowledge the following primary legal bases for the processing of Driver Personal Data in connection with the Services:

1. Article 6(1)(b) UK GDPR (performance of a contract): processing of Driver Personal Data that is strictly necessary for the performance of the Services;
2. Article 6(1)(f) UK GDPR (legitimate interests): processing for fraud prevention, security monitoring, Card management, Fleet Account administration, the flexible demand service, improvement of the Services, where our legitimate interests in operating a safe and commercially viable service are not overridden by the fundamental rights and freedoms of Drivers;
3. Article 6(1)(a) UK GDPR (consent): processing of Driver Personal Data relating to the Home-Charge Refund service (including Home-Charge Data, domestic electricity supplier account data, and telematics data) as contemplated by clause 9.2(e) of the Terms;
4. Article 6(1)(c) UK GDPR (legal obligation): processing required to comply with our legal obligations, including credit checks under clause 4.4 of the Terms to the extent required by applicable financial regulation, and any retention obligations imposed by law; and
5. Article 6(1)(f) UK GDPR (legitimate interests — marketing): marketing of similar products and services, subject to an opt-out being provided at the time of collection and in every marketing communication in accordance with PECR.

Neither you nor we shall retain personal data for longer than is necessary for the purposes for which it was collected, in accordance with Article 5(1)(e) UK GDPR. The applicable retention periods for each category of personal data are set out in Schedule 3 below (Retention Periods).

Upon termination or expiry of the Contract for any reason, we shall either:

1. return to you all Driver Personal Data processed by us in connection with the Services in a commonly used and machine-readable format; or
2. securely delete or destroy all Driver Personal Data, other than any personal data that we are required to retain pursuant to applicable law or regulation or that has been anonymised in accordance with industry-standard techniques.

Notwithstanding clause DPA 12.2, we may retain personal data to the extent strictly required by applicable law or regulation, provided that it continues to protect such retained data in accordance with this Data Processing Annex.

We shall not make any Restricted Transfer of personal data unless:

1. the transfer is to a country, territory, or international organisation that is the subject of UK adequacy regulations made under Article 45 UK GDPR;
2. appropriate safeguards are in place as required by Article 46 UK GDPR, including (where applicable) the UK International Data Transfer Agreement (“IDTA”) as approved by the Secretary of State, or the UK Addendum to EU Standard Contractual Clauses; or
3. an exception under Article 49 UK GDPR applies.

We shall notify you of any Restricted Transfer and the safeguards in place prior to such transfer taking effect.

Each of you and we shall, upon reasonable prior written notice of no fewer than fourteen (14) days, make available to the other all information reasonably necessary to demonstrate compliance with the relevant obligations as Controller and Joint Controller under this Data Processing Annex and the Data Protection Legislation.