Privacy and Data Addendum

This Privacy and Data Addendum (“Addendum”) forms part of and is incorporated into the ChargeUp Canada Order Form (the “Order Form”) between ChargeUp Canada Inc. (“ChargeUp”) and the customer identified in the Order Form (“Customer”). This Addendum supplements the ChargeUp Canada Site Host Agreement or other underlying agreement incorporated into the Order Form (the “Agreement”).

In the event of a conflict between this Addendum and the Agreement, this Addendum governs solely with respect to privacy, security, and data handling matters expressly addressed in this Addendum.

1. Definitions

For purposes of this Addendum:

(i) “Applicable Privacy Law” means all privacy, data protection, data breach notification, and electronic communications laws applicable to the collection, use, disclosure, retention, safeguarding, and processing of Personal Information under the Agreement, including, where applicable, PIPEDA, substantially similar provincial private-sector privacy laws, and any other applicable Canadian privacy laws.

(ii) “Authorized User Data” means Personal Information relating to Customer’s employees, contractors, property managers, agents, and other users authorized by Customer to access the Services.

(iii) “Customer Data” means all data, content, records, and information submitted to, made available to, transmitted through, or otherwise processed through the Services by or on behalf of Customer or its Authorized Users, including Site information, account information, pricing settings, support records, and operational data, but excluding ChargeUp Data.

(iv) “ChargeUp Data” means data, records, and information owned or controlled by ChargeUp, including platform usage data, system logs, service analytics, aggregated or de-identified information, operational know-how, benchmarking information, service performance data, and any data derived from Customer Data that does not identify Customer, any individual, or any specific Site.

(v) “End User Data” means Personal Information relating to drivers, tenants, invitees, employees, customers, or other end users who access or use the EVCS or related Services.

(vi) “Personal Information” means information about an identifiable individual, or information that otherwise falls within the definition of personal information, personal data, or a similar term under Applicable Privacy Law.

(vii) “Process”, “Processing”, or “Processed” means any collection, access, use, storage, organization, disclosure, transfer, analysis, deletion, or other handling of data.

(viii) “Security Incident” means unauthorized access to, unauthorized acquisition of, unauthorized disclosure of, loss of, or alteration of Personal Information in ChargeUp’s custody or control, excluding unsuccessful attempts, scans, pings, or other activity that does not compromise the confidentiality, integrity, or availability of Personal Information.

(ix) “Subprocessor” means any third party engaged by ChargeUp to Process Personal Information in connection with the Services, including cloud providers, software providers, payment processors, customer support providers, analytics providers, telecommunications providers, and other underlying service providers.

2. Scope and Roles

2.1 Scope

This Addendum applies to Personal Information Processed by ChargeUp in connection with the Services provided under the Order Form.

2.2 Independent Business Roles

The parties acknowledge that the nature of the Services may involve the parties handling Personal Information for overlapping but distinct business purposes.

Unless otherwise expressly stated in the Order Form or a separate written addendum:

• Customer is responsible for Personal Information it collects, controls, or makes available through its Sites, EVCS operations, End User relationships, and internal business operations;
• ChargeUp is responsible for Personal Information it collects, uses, or discloses for purposes of operating, securing, maintaining, supporting, billing, administering, and improving the Services, fulfilling legal obligations, preventing fraud, and managing its commercial relationship with Customer; and
• where ChargeUp Processes Personal Information on Customer’s behalf for a specific, documented purpose, ChargeUp will do so in accordance with Section 3.

2.3 No Sale of Personal Information

ChargeUp will not sell Personal Information in a manner prohibited by Applicable Privacy Law.

3. Processing Instructions and Permitted Uses

3.1 Customer-Directed Processing

To the extent ChargeUp Processes Personal Information on behalf of Customer, ChargeUp will Process such Personal Information:

• to provide the Services and perform its obligations under the Agreement and the Order Form;
• on Customer’s documented instructions as set out in the Agreement, Order Form, product configuration, support requests, or other written directions accepted by ChargeUp;
• to maintain, support, secure, troubleshoot, monitor, and improve the Services;
• to prevent fraud, abuse, misuse, and security threats;
• to comply with law, regulation, court order, payment network requirements, or requests from governmental authorities; and
• as otherwise permitted under the Agreement and Applicable Privacy Law.

3.2 ChargeUp Business Purposes

Customer acknowledges that ChargeUp may Process Personal Information as necessary for its own legitimate business and operational purposes related to the Services, including:

• account administration;
• authentication and access control;
• payment processing and settlement administration;
• support and service communications;
• product maintenance and reliability;
• usage analytics and service improvement;
• audit logging and fraud prevention;
• regulatory compliance; and
• the creation and use of aggregated and de-identified information.

3.3 Prohibited Instructions

ChargeUp is not required to follow any instruction that would, in ChargeUp’s reasonable opinion, violate Applicable Privacy Law, compromise security, conflict with the Agreement, or materially degrade the integrity or reliability of the Services.

4. Categories of Personal Information

Depending on the Services ordered and Customer’s deployment model, Personal Information Processed under the Agreement may include:

• name, email address, phone number, mailing address, and account identifiers;
• Authorized User credentials and account access details;
• End User identifiers and contact details;
• vehicle charging session information, including date, time, duration, station or port identifier, usage metrics, and pricing information;
• transaction, billing, payout, refund, and chargeback information;
• support communications and service tickets;
• site access, parking, and operational preferences;
• device, network, telemetry, log, and diagnostic information;
• IP address, browser, app, and authentication data;
• tax, banking, and remittance information; and
• any other Personal Information submitted through or reasonably required for the Services.

ChargeUp will not knowingly require Customer to provide more Personal Information than is reasonably necessary for the applicable Services.

5. Customer Responsibilities

Customer will:

• obtain all rights, authorizations, notices, and consents required under Applicable Privacy Law for ChargeUp to Process Personal Information as contemplated by the Agreement;
• ensure that its collection, use, disclosure, and configuration of Personal Information through the Services comply with Applicable Privacy Law;
• maintain and make available any privacy notices required for End Users, Authorized Users, tenants, employees, or other individuals interacting with the EVCS or Services through Customer’s Sites;
• configure the Services in a lawful and appropriate manner, including pricing, access controls, communications, and user permissions;
• respond to requests, complaints, and inquiries from individuals or regulators to the extent they relate primarily to Customer’s own privacy practices, Sites, EVCS operations, or Customer-controlled data;
• avoid uploading or disclosing sensitive Personal Information unless reasonably necessary for the Services and expressly permitted by the Agreement; and
• promptly notify ChargeUp if Customer becomes aware that any instruction previously given to ChargeUp is inaccurate, unlawful, or no longer authorized.

6. ChargeUp Responsibilities

ChargeUp will:

• implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction;
• limit access to Personal Information to personnel, contractors, and Subprocessors who require access for authorized purposes and who are subject to appropriate confidentiality obligations;
• use Personal Information only as permitted by the Agreement, this Addendum, and Applicable Privacy Law;
• maintain policies and procedures reasonably designed to support secure operation of the Services;
• provide commercially reasonable cooperation to Customer in connection with Customer’s compliance obligations, to the extent reasonably necessary and proportionate to the Services provided; and
• ensure that persons authorized by ChargeUp to Process Personal Information are bound by obligations of confidentiality.

7. Security Measures

ChargeUp will maintain a security program appropriate to the nature of the Services and the sensitivity of the Personal Information Processed, which may include, as appropriate:

• role-based access controls;
• authentication controls;
• encryption in transit and, where appropriate, at rest;
• network and endpoint protection measures;
• logging and monitoring;
• vulnerability management;
• backup and recovery procedures;
• personnel confidentiality obligations;
• incident response procedures; and
• vendor risk management measures.

ChargeUp may update its security measures from time to time, provided such updates do not materially diminish the overall level of protection for Personal Information during the applicable Term.

8. Security Incidents

8.1 Notice

If ChargeUp becomes aware of a Security Incident affecting Personal Information in ChargeUp’s custody or control, ChargeUp will notify Customer without undue delay after confirming the Security Incident, where notification is required by Applicable Privacy Law or where the incident is reasonably likely to materially affect Customer’s use of the Services or Customer’s legal obligations.

8.2 Contents of Notice

To the extent available at the time, the notice will include reasonably relevant information regarding:

• the nature of the Security Incident;
• the categories of affected Personal Information;
• the known or reasonably suspected impact;
• the measures taken or proposed to address the Security Incident; and
• information reasonably requested by Customer to support legally required notifications.

8.3 Investigation and Cooperation

ChargeUp will use commercially reasonable efforts to contain, investigate, mitigate, and remediate a Security Incident affecting Personal Information in ChargeUp’s custody or control, and will provide reasonable cooperation to Customer in relation to Customer’s legally required response obligations.

8.4 No Admission

Notification of a Security Incident does not constitute an admission of fault or liability by ChargeUp.

9. Individual Requests and Regulatory Inquiries

9.1 Individual Requests

If ChargeUp receives a request from an individual seeking access to, correction of, deletion of, or information about Personal Information for which Customer is primarily responsible, ChargeUp may direct the individual to Customer and, where appropriate, notify Customer.

9.2 Assistance

Where reasonably necessary and taking into account the nature of the Services, ChargeUp will provide commercially reasonable assistance to Customer in responding to legally valid requests from individuals or regulators relating to Personal Information Processed through the Services, provided that Customer will reimburse ChargeUp for any material out-of-scope effort at ChargeUp’s then-current professional services rates unless the request arises from ChargeUp’s breach of this Addendum.

9.3 Regulatory Communications

Each party will promptly inform the other, to the extent legally permitted, of any regulatory inquiry, investigation, or complaint relating to Personal Information or privacy practices under the Agreement that could reasonably affect the other party.

10. Subprocessors and Third Parties

10.1 Use of Subprocessors

Customer acknowledges and agrees that ChargeUp may engage Subprocessors to provide all or part of the Services.

10.2 Subprocessor Obligations

ChargeUp will require Subprocessors that Process Personal Information on ChargeUp’s behalf to be bound by contractual obligations regarding privacy, confidentiality, and security that are materially protective of Personal Information in a manner appropriate to the nature of the services provided.

10.3 Payment Processors and Third-Party Platforms

Where payment processing, telecommunications, OEM software, cloud hosting, hardware integrations, analytics, support tools, or other third-party services are used in connection with the Services, Customer acknowledges that Personal Information may be Processed by those third parties in accordance with their applicable terms, privacy policies, and legal obligations, as contemplated by the Agreement.

11. Cross-Border Processing

Customer acknowledges that ChargeUp and its Subprocessors may Process Personal Information in Canada, the United States, and other jurisdictions where ChargeUp or its Subprocessors operate.

ChargeUp will take commercially reasonable steps to ensure that cross-border Processing undertaken on its behalf is subject to contractual or other measures appropriate under Applicable Privacy Law.

Customer is responsible for ensuring that any notices or consents required in connection with cross-border transfers or foreign Processing are properly provided or obtained to the extent required by Applicable Privacy Law and applicable to Customer’s role.

12. Data Retention and Deletion

ChargeUp may retain Personal Information for the duration of the Term and for such additional period as reasonably necessary to:

• perform post-termination obligations;
• process settlements, refunds, chargebacks, audits, disputes, and tax matters;
• maintain backups and business records;
• comply with legal, regulatory, contractual, security, and accounting obligations;
• enforce the Agreement; and
• prevent fraud or misuse.

Upon Customer’s written request made within 30 days after termination or expiration of the applicable Services, ChargeUp will use commercially reasonable efforts to provide Customer with access to or export of Customer Data then available through the Services in ChargeUp’s standard format, subject to technical feasibility, security requirements, legal restrictions, and payment of any applicable fees for transition or professional services.

Thereafter, ChargeUp may delete or render inaccessible Customer Data in accordance with its retention practices, subject to any legal or operational retention requirements.

Nothing in this Addendum requires ChargeUp to delete or alter:

• backups retained in the ordinary course;
• data required for legal compliance;
• data necessary to defend claims, resolve disputes, or enforce rights;
• de-identified or aggregated data; or
• ChargeUp Data.

13. Data Ownership and Use Rights

As between the parties:

• Customer retains its rights in Customer Data, subject to the rights granted to ChargeUp under the Agreement and this Addendum;
• ChargeUp retains all rights in the Services, ChargeUp Data, service analytics, system logs, operational know-how, and all aggregated or de-identified information; and
• ChargeUp may generate, compile, use, and disclose aggregated and de-identified information for lawful business purposes, including analytics, benchmarking, service development, fraud prevention, and reporting, provided such information does not identify Customer or any individual.

14. Confidentiality

Personal Information disclosed or made available under the Agreement will be treated as Confidential Information, subject to the confidentiality provisions of the Agreement.

If there is any conflict between this Addendum and the confidentiality provisions of the Agreement in relation to Personal Information, the more protective provision will govern to the extent of the conflict.

15. Audit and Information Rights

Except where otherwise expressly required by law or agreed in writing, ChargeUp is not required to permit on-site audits of its systems or facilities.

Upon reasonable written request, and no more than once annually unless required by law or triggered by a Security Incident, ChargeUp will provide Customer with commercially reasonable information regarding its privacy and security practices relevant to the Services, which may include summaries of policies, certifications, or questionnaire responses, subject to confidentiality, security, and third-party restrictions.

Any additional audit, assessment, or review requested by Customer will be subject to ChargeUp’s reasonable approval, security requirements, resource availability, and reimbursement of ChargeUp’s reasonable costs, unless the request arises from a material breach of this Addendum by ChargeUp.

16. Limitation

ChargeUp’s obligations under this Addendum are subject to the limitations, exclusions, disclaimers, and allocation of risk set out in the Agreement, unless expressly prohibited by Applicable Privacy Law.

17. Order of Precedence

If there is a conflict between this Addendum and any other schedule relating specifically to privacy, security, or Personal Information signed by both parties, the more specific signed privacy schedule governs with respect to that subject matter.

18. Survival

The following sections survive termination or expiration of the Agreement to the extent applicable: Sections 8 through 18, and any other provision that by its nature is intended to survive.

19. Optional Commercial Privacy Selections

If the parties wish, this section can be completed for deal-specific privacy terms:

Item	Selection
Primary data residency preference	[Canada only / Canada and U.S. / As required by service providers]
Custom incident notice period	[e.g., without undue delay / 72 hours / 5 business days]
Custom retention period after termination	[Insert]
Customer-approved Subprocessor list required	[Yes / No]
Annual privacy/security questionnaire right	[Yes / No]
Custom encryption requirement	[Insert]
Special category data permitted	[Yes / No, and if yes describe]

If no selections are completed above, the default terms of this Addendum apply.