Privacy Policy

1. Who we are and what this policy covers

Rocketwave ("Rocketwave", "we", "us", "our") builds and operates battery-swapping infrastructure and hyperlocal digital distribution channels in India. Our stations are currently in Bengaluru and Hyderabad.

This policy applies to personal data we process when you:

• visit our website or send us an enquiry (the "Website");
• register for or use our battery-swapping stations and related services (the "Swap Services");
• download or use Rocket App, our digital platform for offers, campaigns and onboarding journeys ("Rocket App");
• visit one of our locations, including areas covered by CCTV;
• deal with us as a property owner, EV or fleet operator, advertiser, financial-services provider, distribution partner, vendor or investor, or as a representative of one ("Partners").

Together these are our "Services". Some Services, including parts of Rocket App, are being introduced in phases. This policy applies to each Service from the time it is made available to you. Where a Service needs additional or more specific information, we will give you a separate notice when you sign up or at the point of collection.

For the personal data covered by this policy, Rocketwave is the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). This means we decide why and how your data is processed.

2. Laws we follow

We process personal data in line with Indian law, including:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as their provisions come into force;
• the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, where applicable;
• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, where applicable;
• the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and related regulations, if Aadhaar is used for verification;
• directions of the Reserve Bank of India, the Insurance Regulatory and Development Authority of India and other regulators that apply to our regulated Partners when we work with them.

3. Personal data we collect

What we collect depends on how you interact with us. We collect only what we need for the purposes described in section 4.

3.1 Riders and users of the Swap Services

• Identity and contact details: name, mobile number, email address, date of birth, photograph and address.
• Verification (KYC) details: details from a government-issued ID you provide, such as a driving licence, PAN or masked Aadhaar. We use these to confirm your identity before handing over batteries, which are valuable assets. We do not store full Aadhaar numbers except as the law permits. Where we use Aadhaar, we do so only with your consent and through permitted methods such as offline verification or masked copies.
• Vehicle details: vehicle type, make and model, and registration number.
• Work details (optional): the delivery, ride-hailing or fleet platform you work with, if you choose to tell us, for example to access a partner programme.
• Swap and transaction data: the stations you use, swap dates and times, batteries issued and returned, subscriptions or plans, charges, deposits, payments, refunds and invoices.
• Battery and equipment data: battery ID, state of charge, temperature, health, cycle count and fault codes recorded by our batteries and swap cabinets. If a battery has location tracking, its location while it is in use. This helps us keep batteries safe, bill correctly and recover lost or stolen batteries.
• Payment data: payment method type, UPI ID or masked card details, and transaction references. Card numbers and banking credentials are handled by licensed payment providers. We do not store them.
• Support and safety records: messages, calls, complaints, incident and damage reports, and feedback.

3.2 Rocket App users

• Account details: name, mobile number, email address, language preference and profile information you add.
• Location: precise or approximate device location, only if you allow it in your device settings. We use it to show nearby stations and relevant local offers. You can turn it off at any time.
• App activity: the offers, campaigns and journeys you view, save, tap on or complete; your responses to forms; and your notification preferences.
• Details for partner offers you request: if you ask for a partner's product, such as a loan, insurance, a job or a fleet vehicle, the information that partner needs to process your request. This may include income, employment or platform details, and documents. We collect this only with your consent and tell you on screen which partner it will go to (see section 6.2).
• Device and technical data: device model, operating system, app version, IP address, device identifiers, crash logs and diagnostics.
• Rewards and referrals: referral codes, reward points and redemption history, if these features are offered.

3.3 Website visitors and people who send enquiries

• Enquiry details: your name, company, work email, mobile number, partnership type, city or location, message and website. The enquiry form on our Website does not send data to our servers. It opens your own email app with your enquiry ready to send, and we receive it only if you send it.
• Technical data: the service that hosts our Website may log IP addresses, browser and device type, pages requested and visit times, for security and operations. The Website loads fonts from Google Fonts, so Google receives your IP address and browser details (see the Google Privacy Policy).
• Cookies: the Website does not currently set cookies or use analytics or advertising trackers (see section 10).

3.4 Visitors to our locations

• CCTV footage: our stations may be covered by CCTV cameras, with signs displayed. Footage may show you, your vehicle and its registration number.
• Visitor records: where a site requires it, visitor logs or access records.

3.5 Partners and their representatives

• Business contact details: name, designation, company, work email and phone number.
• Contracting and compliance details: company registration details, GST number and PAN. Where the Partner is an individual, such as an individual landowner, also identity and address proof, and property ownership or lease documents.
• Payment details: bank account details for rent, revenue-share or other payments, and billing records.
• Campaign and creative materials: for advertisers, campaign briefs, creatives and approvals. These may contain personal data, such as the names of people featured.
• Communications: emails, meeting notes and correspondence about our business relationship.

3.6 Data we receive from others

• Partners who refer you: fleet operators, EV makers or platforms may refer you to us to use our Swap Services, sharing your name, contact details and vehicle details with your agreement.
• Regulated partners: after you apply for a partner's product through Rocket App, the partner may tell us the outcome, such as approved, declined or pending, so that we can show your application status, follow up or settle referral fees. Partners do not share their underlying decision data with us unless the law allows it and you have agreed.
• Payment providers: payment confirmations and transaction references.
• Verification services: results of identity or document checks you have authorised.
• Public sources: publicly available business information about Partners, such as company records.

4. How we use personal data

We use personal data for the following purposes:

We do not use your personal data to make automated decisions that produce legal or similarly significant effects on you. We do not make lending or insurance decisions. Those are made by the relevant regulated partner under its own policies.

5. Our grounds for processing

We process personal data on one of the following grounds under the DPDP Act:

• Consent. For most processing, we ask for your consent through a clear notice when you sign up, use a feature or submit a request. Examples are opening a Swap Services account, using Rocket App, sharing your details with a partner, receiving promotional messages and using precise location. Your consent is specific to the purposes stated, and you can withdraw it at any time.
• Legitimate uses permitted by law. These include where you voluntarily give us personal data for a specific purpose and do not object to its use, such as an enquiry email; where we must process data to comply with a law, judgment or order; and where processing is needed to respond to a medical emergency, threat to life or safety, or disaster.

If you withdraw consent: we will stop the processing that relied on it within a reasonable time. Some Services cannot be provided without certain data. For example, we cannot hand over batteries without verifying who you are, or process swaps without an account. In those cases withdrawing consent may mean we have to close your account. We will first settle any outstanding batteries, deposits, dues or refunds. Withdrawing consent does not affect processing that took place before.

6. When we share personal data

We do not sell personal data. We share it only as described below.

6.1 Service providers who work for us

We use trusted providers to help run our Services. They include cloud hosting, email and communications (including Google), SMS and notification services, payment gateways, identity verification, battery telematics and IoT platforms, CCTV and security services, customer support tools, and professional advisers. They act as our "Data Processors": they may process personal data only on our instructions and under contracts that require them to protect it.

6.2 Partners whose offers you choose

Through Rocket App, you may choose to apply for or show interest in products and opportunities offered by our Partners. These include loans, insurance, savings and payment products from banks, NBFCs, insurers and other regulated entities; jobs and delivery-partner programmes from fleet operators, platforms and recruiters; and products and services from brands and local businesses.

• We share your details with a Partner only after you take an action to request its offer and give your consent. We show you the Partner's name and the data to be shared before you confirm.
• Once a Partner receives your data, it becomes an independent Data Fiduciary for that data. It is responsible for handling it under its own privacy policy and the law, including any credit checks, eligibility decisions, KYC or background verification it performs.
• Rocketwave does not lend money, sell insurance or make hiring decisions. Where the law requires a regulated entity's offer to be presented in a particular way, such as RBI requirements on digital lending or IRDAI requirements on insurance distribution, we follow the arrangements agreed with that entity and the applicable rules.

6.3 Advertisers and campaign Partners

Advertisers receive campaign performance information in aggregated and anonymised form. Examples are the number of times an offer was shown or tapped, or the number of sign-ups by city or location. This information does not identify you. We do not give advertisers your name, contact details or location history unless you choose to respond to their offer and consent to sharing, as described in section 6.2.

6.4 Battery, vehicle and fleet partners

Where batteries or swap equipment are owned or operated with an EV manufacturer, battery maker or swap operator, we may share battery and equipment data with them for maintenance, warranty, safety and recall purposes. We also share your identity details with them where needed to recover a battery.

If you joined our Swap Services through a fleet operator, and your vehicle or batteries are provided or paid for by it, we may share your swap and usage records with that fleet operator as agreed when you signed up.

6.5 Property and site partners

We may share limited information with the owner or manager of a site where a station is located, where needed for site security, incident investigation or access. For example, we may share CCTV footage of an incident, with other people blurred where practical.

6.6 Legal, safety and business transfers

• With police, courts, regulators or other authorities when the law requires it, or to protect the rights, property or safety of Rocketwave, our users, Partners or the public, for example in a battery theft or fire incident.
• With a buyer, investor or successor if Rocketwave is involved in a merger, acquisition, financing, restructuring or sale of assets. They must protect your data in line with this policy.

7. Where we store data and international transfers

We store personal data on secure servers operated by us or our service providers. Some providers, such as cloud, email and analytics services, may store or process data outside India. We transfer personal data outside India only as permitted by the DPDP Act and any restrictions notified by the Government of India. We also require recipients to protect it to standards consistent with this policy.

8. How long we keep personal data

We keep personal data only for as long as needed for the purpose for which it was collected, or as long as the law requires. Typical periods are:

Where the DPDP Rules require it, we will notify you at least 48 hours before erasing your data because the purpose has been fulfilled, so that you can log in or contact us if you want to keep using our Services.

9. How we protect personal data

We use reasonable security safeguards, appropriate to the nature of the data, to protect personal data against unauthorised access, use, disclosure, loss or alteration. These include:

• encryption of data in transit, and of sensitive data at rest where practicable;
• access controls that limit personal data to staff and processors who need it;
• masking of identity numbers, and secure handling of KYC documents;
• monitoring and logging of access to our systems;
• contractual security obligations on our service providers;
• physical security at our stations.

No system is completely secure. If a personal data breach occurs, we will act quickly to contain it, and will notify affected people and the Data Protection Board of India as the law requires. Please help protect your account by keeping your login codes and devices secure and not sharing one-time passwords (OTPs) with anyone. Rocketwave staff will never ask you for your OTP or banking passwords.

10. Cookies, SDKs and similar technologies

• Website: our Website does not currently set cookies or use analytics or advertising trackers. If we introduce them, we will update this policy and ask for consent where the law requires it.
• Rocket App: Rocket App may use software development kits (SDKs) from service providers for functions such as crash reporting, performance monitoring, push notifications, maps and, with your consent, analytics. These may collect device identifiers and usage data. We list the main SDKs in the app's settings or help section, and we do not allow them to use your data for their own advertising.

11. Your rights and choices

Under the DPDP Act, you have the right to:

• Access information: get a summary of the personal data we process about you, how we process it, and the identities of other Data Fiduciaries and Data Processors we have shared it with, along with a description of what was shared.
• Correct and update: have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated.
• Erase: have personal data erased once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it.
• Withdraw consent: withdraw any consent you have given, as easily as you gave it.
• Grievance redressal: raise a complaint with us and have it resolved.
• Nominate: nominate another person to exercise your rights if you die or become incapable.

Other choices: you can turn off location access and push notifications in your device settings, opt out of promotional messages using the unsubscribe option in each message or in the app, and update your profile in Rocket App.

How to make a request: email rocketwave.ventures@gmail.com with the subject "Privacy request", or call +91 79757 19022. Once Rocket App offers in-app privacy controls, you can also use those. We may need to verify your identity before acting on a request. We will respond within 30 days. If we cannot meet a request, for example because the law requires us to keep data, we will explain why.

Your duties: the DPDP Act also asks you to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.

12. Children's data

Our Services are meant for people aged 18 and over. We do not knowingly collect personal data from children, and we do not offer Swap Services or Rocket App accounts to anyone under 18. If we learn that we have collected a child's personal data without verifiable consent from a parent or lawful guardian, we will delete it.

13. Third-party sites and services

Our Services may link to, or let you open, websites and apps run by Partners and other third parties, such as a lender's application page or a brand's store. Their own privacy policies apply when you use them. Please read them before sharing information.

14. Changes to this policy

We may update this policy as our Services grow or the law changes. We will post the updated version on this page with a new "Last updated" date. If changes materially affect how we use personal data you have already given us, we will notify you through Rocket App, SMS or email. Where required, we will ask for your consent again.

15. Contact us and Grievance Officer

If you have any question, request or complaint about this policy or how we handle personal data, please contact our Grievance Officer:

We will acknowledge your grievance within 48 hours and aim to resolve it within 15 days. Data rights requests are answered within 30 days, as set out in section 11.

If you are not satisfied with how we resolved your grievance, you may complain to the Data Protection Board of India under the DPDP Act.