1. Who is the data controller
EVWise UK is the controller of the personal data described in this notice. You can reach our data protection contact at privacy@evwise.ai.
2. What data we collect
- Questionnaire inputs: postcode (area part is enough), household size, mileage, employment type, salary band, charging access, current vehicle details, budget and preferences. These power your recommendation.
- Recommendation outputs: the recommendation, scenarios, scores and the plain-English explanation we generated for you.
- Report email: to view your full recommendation you provide an email address. We store it together with which recommendation it unlocked and the outcome, so you can return to your report and so we can send it to you. Ticking the optional box also lets us email you EV updates and relevant UK policy changes; that box is off by default and you can unsubscribe at any time.
- Account data (optional): if you save a recommendation, we store the email address you provide and a magic-link token.
- Technical data: IP address (which we truncate for functional measurement), browser type, referrer and basic usage data. Where this can identify you we treat it as personal data.
- Staff data: for admin and policy-analyst accounts, we store email, a salted password hash and audit logs of consequential actions.
We collect only what we need for the purposes below (data minimisation).
3. Why we use it (lawful basis)
- Contract (Article 6(1)(b) UK GDPR): generating and returning your recommendation is performance of a service you requested.
- Legitimate interests (Article 6(1)(f)): minimal functional measurement, security monitoring, debugging, keeping an audit trail, and establishing, exercising or defending legal claims. We balance these against your rights.
- Consent (Article 6(1)(a)): optional analytics cookies and marketing emails. You can withdraw consent at any time.
- Legal obligation (Article 6(1)(c)): keeping records for tax or accounting and complying with lawful requirements.
4. Consent and how to withdraw it
Where we rely on consent, we ask for it separately and in plain terms, for example through the cookie banner for optional analytics or a tick box for marketing. Consent is optional and specific, and you can withdraw it at any time using the "Cookie settings" link in the footer, an unsubscribe link, or by emailing us. Withdrawing consent does not affect processing carried out before you withdrew it, or processing under a different lawful basis.
5. Automated recommendations
Recommendations are generated automatically from the information you provide. This is informational guidance that you choose whether to act on, and it does not produce a legal or similarly significant effect on you within the meaning of Article 22 UK GDPR. You can contact us to ask about, or discuss, any recommendation.
6. Who we share data with
- Anthropic (Claude API): when the explanation layer is enabled, we send the structured recommendation (which does not include your email) to Anthropic for the sole purpose of writing the plain-English explanation. Anthropic does not train on this data.
- Hosting and infrastructure providers acting as processors under written contract on our instructions.
- Affiliate partners: only if you click an affiliate link. We pass no directly identifying personal data to partners; after the redirect they operate under their own policies.
We do not sell your personal data.
7. Legal disclosures and lawful requests
We may disclose personal data where we are legally required or permitted to do so, for example to comply with a valid court order, a statutory obligation, or a lawful request from a regulator, law-enforcement or other public authority, or where necessary to establish, exercise or defend legal claims, or to protect the rights, safety or property of users or others. We disclose only what is necessary and, where the law allows and it is appropriate, we will let you know.
8. International transfers
Some processors (including Anthropic) are located outside the UK. Where we transfer personal data internationally we rely on UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, and we apply appropriate safeguards.
9. Retention
- Recommendations linked to an email: up to 24 months from your last activity.
- Anonymous recommendations: aggregated metrics only after 30 days; raw inputs deleted.
- Audit logs: 7 years (rule-change replay and dispute resolution).
- Staff accounts and sessions: deleted within 30 days of role removal.
10. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Request erasure (the 'right to be forgotten').
- Object to processing or request restriction.
- Withdraw consent at any time.
- Data portability for data we hold under contract or consent.
- Complain to the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, email privacy@evwise.ai. We aim to respond within one month and will not charge a fee except where the law allows.
11. Security
We use encryption in transit (HTTPS), salted password hashing (PBKDF2-SHA256, 600,000 iterations), and least-privilege server-side sessions for staff, and we keep an audit log of consequential actions. No system is perfectly secure, but we take reasonable and appropriate measures to protect your data.
12. Children
EVWise is intended for adults. We do not knowingly collect data from children under 16. If you believe we have, please contact us and we will delete it.
13. Cookies
We ask for your choice on optional cookies through our consent banner, and strictly necessary cookies run so the site works. See our separate cookie notice for the full list and how to manage them.
14. Changes to this notice
We may update this notice from time to time. We will post the updated version here and change the date at the top, and we will flag material changes prominently.