Privacy Policy

Voltbridge Technologies Private Limited ("Voltbridge", "we", "us", "our") operates the Voltbridge platform at thevoltbridge.com (the "Platform"), a B2B directory connecting buyers and suppliers in the electric vehicle (EV) industry. We are the Data Fiduciary in respect of personal data processed through the Platform. Most personal data we hold is provided by users directly when they register or create a profile; we also compile a limited amount of business information from public sources to help build the directory.

This Privacy Policy explains what personal data we collect, why and how we use it, how long we keep it, the choices and rights available to you, and how to contact our Grievance Officers. It is published in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and rules made thereunder, and other applicable law. Where the EU or UK GDPR applies, the additional terms in Section 13 also apply.

By using the Platform you acknowledge this Policy. Where the law requires your consent, we ask for it separately and you may withdraw it at any time.

1. Key terms

Personal data means any data about an individual who is identifiable by or in relation to such data. Data Principal means the individual to whom personal data relates (you). Data Fiduciary means the entity that determines the purpose and means of processing (Voltbridge). Processing means any operation performed on personal data.

Most information in our directory is business or company information (company names, business addresses, corporate emails, product listings). Some of this — for example, the name and work email of a contact person at a company — may also be personal data. This Policy applies to that personal data.

2. Personal data we collect

Information you give us. Most personal data on the Platform is provided by users directly. Suppliers create or claim their company profile, and buyers register an account — providing details such as name, business email, password, company name, role or designation, and phone (if provided). We also collect the content you submit to create, claim, or update a profile, and communications such as support requests.

Billing information. When you subscribe to a paid plan, payment is processed by our payment gateway, Razorpay. We do not store full card numbers; we receive limited transaction data such as a payment ID, status, and the plan purchased.

Information collected from public sources. We compile business profiles using publicly available information (company websites, public registries, and industry databases), using automated and AI-based tools. We used this for a subset of companies to help seed the directory, and its share reduces as suppliers create and maintain their own profiles. We limit this to business-context information (such as a company name, business address, corporate email or phone, and the role of a business contact) and do not seek out sensitive or private personal information. Where a profile includes personal data, you may object to its inclusion, or ask us to correct or remove it, at any time by emailing info@thevoltbridge.com or using the takedown process in our Terms of Service, and we will act on valid requests promptly.

Information collected automatically. Usage and device data via cookies and analytics. We use PostHog for product analytics; non-essential analytics cookies are set only with your consent via our cookie banner (see our Cookie Policy). We also keep server logs (such as IP address, timestamps, and pages requested) for security and operation.

We do not knowingly collect sensitive personal data through the Platform, and we do not require it.

3. Why we use personal data, and our lawful basis

Under the DPDP Act, personal data is processed on the basis of your consent or for certain legitimate uses specified in the Act. We use personal data to create and manage your account and provide the directory; to process subscriptions, billing, and renewals and send transaction and pre-debit notices; to compile and maintain company profiles from public sources; for product analytics to improve the Platform (with your consent); for marketing communications (with your consent, which you can withdraw at any time); and for security, fraud prevention, and to comply with law.

We use AI tools only to compile and standardise business-level data. We do not make solely automated decisions producing legal or similarly significant effects on individuals. You can object to or seek human review of any processing you believe significantly affects you.

Your choices for public-source data. If you are an individual whose personal data appears in a company profile compiled from public sources, you may opt out at any time. On a valid request we will remove your personal data from the profile unless we are required to retain it by law. We keep such data only to operate the directory, and we do not use it for advertising or sell it.

4. Notice and consent

Where we rely on consent, we present a clear notice describing the personal data sought and the purpose, and we obtain consent that is free, specific, informed, unconditional, and unambiguous. You may withdraw consent at any time as easily as it was given, by emailing our Grievance Officers or using in-product controls; withdrawal does not affect processing already carried out.

5. Children's data

The Platform is intended for business users aged 18 and over. We do not knowingly process the personal data of children (individuals under 18). Consistent with the DPDP Act, we do not process children's data in a manner likely to cause detriment, nor undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child has provided personal data, contact our Grievance Officers and we will delete it.

6. How we share personal data

We do not sell personal data. We share it only with service providers who act on our instructions under contract (such as cloud hosting, our payment gateway Razorpay, our analytics provider PostHog, and email tools); to comply with law, a court order, or a lawful request from an authority; in connection with a business transfer such as a merger or acquisition, subject to this Policy; and with your consent or at your direction.

7. Payments

Paid subscriptions are processed by Razorpay, our payment gateway. Card and bank details are entered on Razorpay's secured environment and are subject to Razorpay's own privacy terms. We receive only limited transaction information needed to fulfil and account for your subscription.

8. Cross-border transfer

We may process and store data on servers located in or outside India, including with cloud providers. Where we transfer personal data outside India, we do so in accordance with the DPDP Act and DPDP Rules and any restrictions notified by the Central Government, and we require recipients to protect the data to a standard consistent with this Policy.

9. Data retention

We keep personal data only as long as necessary for the purposes above or as required by law, then delete or irreversibly anonymise it. Account data is kept for up to 3 years after account closure or last activity; company profile data while the profile is active and typically up to 6 years after the last update or verification; billing, financial, and tax records as required by law (commonly 6–8 years); support communications for up to 2 years after the last interaction; and server logs are typically anonymised or deleted within 12 months unless needed for a security investigation.

10. Security

We maintain reasonable security safeguards appropriate to the risk, including access controls, encryption in transit, and provider due diligence, to protect personal data against unauthorised access, loss, or disclosure. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Rules. Where the EU or UK GDPR applies, we will also notify the competent EEA or UK supervisory authority within 72 hours of becoming aware of a personal data breach where required, and affected individuals without undue delay.

11. Your rights as a Data Principal

Subject to the DPDP Act, you have the right to access a summary of the personal data we process about you and our processing activities; to correction, completion, and updating of your personal data; to erasure of your personal data where it is no longer needed and retention is not legally required; to grievance redressal; and to nominate another individual to exercise your rights in the event of death or incapacity.

You may also withdraw consent at any time and lodge a complaint with the Data Protection Board of India if your grievance is not resolved. To exercise any right, email our Grievance Officers. We will verify your identity and respond within the timelines required by law.

12. Grievance Officers

In accordance with the DPDP Act and the IT Rules, you may contact our Grievance Officers with any question, request, or complaint about your personal data:

Nanda Sumatilal Firodiya (Director) and Ujwala Chandrashekhar Patil (Director) · Email: info@thevoltbridge.com · Address: Voltbridge Technologies Private Limited, SH No 7, Ganalaxmi, Heritage 262, Nana Peth, Swargate, Pune City, Pune – 411042, Maharashtra, India

We aim to acknowledge complaints promptly and resolve them within the period prescribed under the DPDP Rules.

13. International users — EU/EEA and UK (GDPR)

The Platform is accessible worldwide and may be used by individuals in the European Economic Area (EEA) and the United Kingdom. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data — for example, where you access the Platform from the EEA or UK, or where we process the personal data of individuals located there — the following additional terms apply and, to the extent of any conflict, govern our processing of that personal data.

Controller and representative. For such personal data, Voltbridge Technologies Private Limited is the data controller. Voltbridge has not yet appointed a representative in the EU or UK under Article 27 of the GDPR or UK GDPR; until one is appointed, you may contact us at info@thevoltbridge.com regarding your personal data.

Legal bases. We rely on the following legal bases under Article 6 GDPR: legitimate interests, to compile and maintain our B2B directory from publicly available business information and to operate, secure, and improve the Platform, balanced against your rights and subject to your right to object; performance of a contract, to create and manage your account and provide the services you request; consent, for analytics cookies and marketing communications, which you may withdraw at any time; and compliance with a legal obligation.

Personal data obtained from public sources. Where we obtain your personal data from public sources rather than from you directly, we rely on our legitimate interests and provide this Policy as the information required under Article 14 GDPR. You have the right to object at any time to our processing of your personal data for the directory, and we will stop unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise, or defend legal claims. You may object or request removal at info@thevoltbridge.com or through the takedown process in our Terms of Service.

Your rights. If the GDPR or UK GDPR applies to you, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise these rights, contact info@thevoltbridge.com. You also have the right to lodge a complaint with your local supervisory authority in the EEA, or with the UK Information Commissioner's Office (ICO).

International data transfers. When you use the Platform, your personal data may be transferred to and processed in India and other countries that have not been recognised by the European Commission or the UK authorities as providing an adequate level of data protection. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards — in particular the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum — together with additional measures where required. You may request a copy of the relevant safeguards by contacting info@thevoltbridge.com.

Other protections. The retention periods, security measures, children's-data protections, and other safeguards described elsewhere in this Policy apply equally to personal data processed under the GDPR and UK GDPR. We do not carry out automated decision-making that produces legal or similarly significant effects on you.

14. Changes to this Policy

We may update this Policy from time to time. We will post the revised version with a new "Last updated" date and, where required, notify you or seek fresh consent.

15. Contact

Voltbridge Technologies Private Limited · CIN: U62099PN2024PTC230786 · SH No 7, Ganalaxmi, Heritage 262, Nana Peth, Swargate, Pune City, Pune – 411042, Maharashtra, India · Email: info@thevoltbridge.com