Privacy Policy.

1. Who is responsible for your information

The data controller is DR Incorporated Ltd, company number 17525862, registered in England and Wales, trading as DR Power. “DR Power”, “we”, “us” and “our” mean DR Incorporated Ltd.

As data controller, we decide why and how personal information is used for the DR Power website, venue enquiries, customer rentals, payment administration and customer support. Where a payment provider or other supplier uses information for its own legal, security or regulatory purposes, that provider may also act as an independent controller for those activities.

You can view the company’s public registration record here: DR Incorporated Ltd at Companies House.

2. What this notice covers

This notice applies to information collected when you:

• visit or browse the DR Power website;
• submit the venue-partnership enquiry form;
• contact us about DR Power, a station, a payment or a rental;
• rent, use or return a DR Power power bank at a station where customer rentals are enabled; or
• raise a question, complaint, refund request or payment dispute relating to the service.

It does not replace the privacy notice of your bank, card issuer, payment wallet, mobile network, venue or any other third-party service you choose to use. Those organisations explain their own processing separately.

3. What information we collect

A. Website and technical information

When you request a page, our website and infrastructure providers may process technical information needed to deliver, secure and troubleshoot the site. This can include your IP address, browser and device type, operating system, requested page, request time, referring page and technical or security events. We do not currently use the landing page to build advertising profiles or to track your phone's GPS location.

B. Venue enquiries

If you use the venue-partnership form, we collect the details you submit:

• your name and work email address;
• your phone number, if you choose to provide it;
• your venue or business name and venue type;
• the town or postcode of the venue; and
• any additional message you include.

The form also uses a hidden anti-spam field. We use the information to review the enquiry, contact you about a possible partnership, record the enquiry's status and protect the form against abuse. Enquiries are stored in the DR Power database and made available to authorised DR Power personnel in the management dashboard.

C. Rental and station information

When customer rentals are enabled, we expect to process information needed to create, operate, price and close a rental, including:

• a rental reference and the station, venue, slot or power-bank identifier;
• the date and time the power bank is confirmed as dispensed and returned;
• the rental duration, applicable tariff version, billing blocks and calculated amount;
• the status of the rental, return, payment authorisation, capture, refund or reconciliation;
• payment references and limited payment information returned to us by the payment provider; and
• information you give customer support when reporting a failed dispense, return problem, lost power bank, damaged unit, refund request or complaint.

The rental system is designed to use rental and station references rather than require you to create a DR Power customer account. We do not need your phone's GPS location to calculate rental duration; the rental timer is based on the confirmed station dispense and return events.

D. Payment information

Card details are entered or presented through the payment terminal and processed by the payment provider. DR Power's rental system receives the transaction status and payment references needed to manage the authorisation, capture, refund and reconciliation. We do not store your full payment card number or card security code in the DR Power rental database.

E. Where information comes from

Most information is provided directly by you when you use the enquiry form, contact us or ask to rent a power bank. Technical information is generated when your browser requests a page. When rentals are enabled, payment status and transaction references are supplied by Stripe and the relevant card-payment systems; dispense, return and equipment events are supplied by the station and integration platform. A venue may also provide information needed to help investigate an incident at its premises. We do not buy marketing lists or obtain customer location histories for DR Power rentals.

4. How we use personal information

We do not sell personal information. We do not use rental information to build advertising profiles. We only use information for the purposes described here or for another compatible purpose that the law allows, and we will explain any material new use before introducing it where required.

5. Our legal reasons for using information

UK data protection law requires us to have a lawful basis for each purpose. Depending on the activity, we rely on one or more of the following:

• Contract or steps you ask us to take before a contract: to respond to a rental request, create and manage a rental, calculate the price, take payment, process a return or refund and provide customer support.
• Legitimate interests: to operate and secure the website, manage venue enquiries, prevent abuse and fraud, protect equipment, maintain reliable records and handle customer queries. We consider the impact on individuals and use this basis only where our interests are not overridden by your rights and freedoms.
• Legal obligation: to keep records, meet tax and accounting requirements, respond to lawful requests and comply with applicable legal duties.
• Consent: where we ask for permission for an optional activity, such as certain types of electronic marketing or non-essential cookies if these are introduced. You can withdraw consent at any time.

We do not rely on consent to provide the core rental service where processing is necessary to perform the rental contract. If information is required to create or complete a rental and you choose not to provide it, we may be unable to provide that part of the service.

6. Card payments, authorisations and Stripe

DR Power uses Stripe payment technology for card-present payment processing. When a customer rental is enabled, Stripe processes the card transaction, including the authorisation, capture and any refund requested by DR Power. Stripe may receive transaction details directly from the terminal, from DR Power or from another service involved in the payment.

For the rental, DR Power needs to know whether the authorisation was approved, the authorised amount that remains available, the transaction reference, and whether a capture or refund succeeded. We use those details to match the payment to the correct rental and avoid treating a pending card hold as completed revenue.

Stripe may process information for its own purposes, including fraud prevention, security, legal compliance and the operation of Stripe's payment services. For those activities Stripe may act as an independent controller. Stripe's own privacy information explains its processing of end customers: Stripe Privacy Centre.

Your bank or card issuer may also process transaction information and make its own authorisation, fraud-prevention and statement-display decisions. Those activities are governed by the bank's or issuer's terms and privacy information.

7. Station technology and equipment suppliers

DR Power uses station technology to record whether a power bank has been dispensed or returned and to monitor equipment status. Our station platform supplier may process technical event information such as station identifiers, slot or power-bank identifiers, event timestamps, device status and a rental reference needed to operate the equipment and investigate faults.

We are currently evaluating station hardware and integration suppliers, and public customer rentals are not yet enabled. Before rentals go live, we will identify the selected supplier here and provide a link to its privacy information where available. We will share only the information required for the equipment and integration functions being used. Card numbers and card security codes are handled by the payment provider, not by the station telemetry service.

Station telemetry identifies the station, power bank and operational event. It is not a request for continuous GPS tracking of your mobile phone. The venue location may be associated with the station so that we can identify where a rental took place.

8. Who we share information with

We share personal information only where there is a business, operational or legal reason to do so. The recipients may include:

• Cloudflare: delivery and security for the public website and related technical infrastructure.
• Render: hosting and running the DR Power application and its APIs.
• Aiven: managed database infrastructure used to store DR Power operational records.
• Stripe: payment authorisation, capture, refund, fraud prevention and payment administration when rentals are enabled.
• Station hardware/integration supplier: the supplier selected for live stations may process equipment events and technical diagnostics needed to operate the hardware.
• Participating venues: limited information needed to operate a station, assist with a return or investigate a service issue. We do not give a venue your full payment card details.
• Professional advisers, insurers, banks and authorities: where necessary to obtain advice, manage a claim, comply with law or protect legal rights.

Some providers act as our data processors and may use information only under our instructions and contractual safeguards. Other providers, including payment providers, may also act as independent controllers for their own regulatory, security or service purposes. We do not authorise suppliers to use DR Power customer information for their own advertising.

9. Where information is processed

Our technology providers operate infrastructure in different locations. Depending on the service and configuration, information may be processed or accessed in the United Kingdom, the European Economic Area or another country where a supplier or its support team operates.

Where a transfer of personal information outside the UK is restricted by data protection law, we will use a lawful transfer mechanism, such as UK adequacy regulations or appropriate safeguards (for example, the UK International Data Transfer Agreement or the UK Addendum to the relevant standard contractual clauses), and complete any required assessment. We will not make a restricted transfer unless a lawful mechanism or exception applies.

You can ask us for further information about relevant transfer safeguards using the privacy contact route described below.

10. Cookies and similar technologies

The public landing page currently does not include third-party advertising tags or analytics tools, and does not deliberately set advertising or analytics cookies. It uses ordinary page scripts for the venue enquiry form and FAQ interactions.

Our website delivery and security provider may use strictly necessary technical technologies to transmit pages, protect the site or detect abusive traffic. Those technologies are different from optional analytics or advertising cookies. Where a provider sets a cookie or similar technology, we will provide appropriate information about its purpose.

If we add analytics, advertising, personalisation or other non-essential cookies in the future, we will update this notice and request consent before setting them where the law requires it. You will be able to change or withdraw that choice.

11. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, including to provide the service, resolve questions, protect against fraud, meet legal requirements and deal with claims. The exact period depends on the type of information and the reason we need it.

• Venue enquiries: kept while the enquiry is being reviewed and followed up, and for a proportionate period afterwards where needed to maintain the business record, respond to a later question or deal with a complaint.
• Rental and payment records: kept for as long as needed to operate and reconcile the rental, handle refunds or disputes, prevent fraud and meet applicable financial, tax and accounting record requirements.
• Customer-support records: kept for as long as needed to investigate and resolve the issue and retain a proportionate record of the outcome.
• Technical and security records: kept for a proportionate period to maintain service security, investigate incidents and diagnose reliability issues.

We periodically review whether we still need information. When it is no longer required, we securely delete it or anonymise it so it no longer identifies you, unless the law requires or permits us to keep it for longer. A request to delete information does not require us to erase records that we must retain by law or need to establish, exercise or defend legal claims.

12. How we protect information

We use access controls, account permissions, secure connections, restricted administrative access and appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, alteration or disclosure.

Payment card details are handled through the payment provider's terminal and payment systems. Staff and venue users are given access only to the DR Power information required for their assigned role. Access to operational records is restricted and administrative actions may be logged for security and accountability.

No website, database or transmission method can be guaranteed to be completely secure. You should not send passwords, PINs, full card numbers or card security codes in a customer-support message. Please tell us promptly if you believe your information or a rental reference has been misused.

13. Your data protection rights

Depending on the lawful basis and circumstances, you may have the right to:

• Access a copy of personal information we hold about you.
• Rectify information that is inaccurate or incomplete.
• Erase information where there is no lawful reason for us to continue holding it.
• Restrict the way we use information in certain circumstances.
• Object to processing based on our legitimate interests, including direct marketing.
• Data portability for certain information processed by automated means on the basis of consent or contract.
• Withdraw consent where we rely on consent. Withdrawal does not affect processing that took place before you withdrew it.

These rights are not absolute and some exceptions apply. For example, we may need to keep a transaction record to meet a legal obligation or defend a claim. We will explain if a requested action cannot be completed and why.

To protect your information, we may ask for details needed to verify your identity and locate the relevant record. We aim to respond within the legal time limit. A request can be made without charge in the usual case, although the law permits a reasonable fee or refusal for manifestly unfounded or excessive requests.

14. Marketing and your choices

We do not sell your personal information or use rental data to build advertising profiles. We may publish general information about DR Power, but we will only send direct electronic marketing where we have a lawful basis and any consent required by privacy and electronic marketing rules.

If you receive marketing from us, you can opt out using the unsubscribe method in the message or by contacting us. Opting out of marketing will not stop essential service messages, such as a rental receipt, return reminder, payment update, security notice or response to a support request.

15. Children and young people

DR Power stations are unattended and do not have staff checking identification or verifying a customer's age. We do not currently operate an age-verification step or routinely collect dates of birth, identity documents or age-check records as part of a standard station rental. The rental information we process is described in section 3 and is based on the station, rental, payment and support records needed to operate the service.

If a parent or legal guardian personally starts a rental for a young person, the adult's rental and payment information may be processed to administer that rental. We do not currently ask the adult to upload proof of the young person's age or their relationship at the station. If a child contacts us or provides information through a support channel, we will use only what is reasonably needed to respond and will consider the child's rights and the applicable data-protection rules.

UK rules about a child's capacity to enter into a contract and the lawful basis for processing a child's information can be complex. We will review the legal basis and safeguards before enabling any feature that is specifically intended to create rental contracts directly with children. For more information, see the ICO guidance on children's information and contracts.

16. Automated processing and rental timers

DR Power uses automated systems to record station events, calculate elapsed rental time, apply the tariff and reconcile payment status. For example, a rental is timed from its confirmed dispense event; an overdue review may be triggered after 24 hours and a power bank may be marked lost after 36 hours without a confirmed return. Payment settlement also depends on the payment provider reporting whether the original card authorisation is still valid and available to capture.

These are operational rules applied to a rental record, not an assessment of your personality or behaviour. DR Power does not currently use customer profiling to make solely automated decisions that have a legal or similarly significant effect on you. Stripe and your card issuer may use their own automated fraud and payment-authorisation systems, which are described in their privacy information.

17. Updates to this Privacy Policy

We may update this notice when the service, technology providers, data collected or legal requirements change. The latest version will be published on this page with a revised date. If we introduce a materially different use of personal information, we will provide additional information before that new processing begins where required.

18. Contact us or complain to the ICO

For a question about this notice or to exercise your data protection rights, email DR Power at support@drpower.uk. Include your rental reference or enquiry details if they help us locate the information, but do not send full payment card details.

If you are unhappy with the way we have handled your personal information, please contact us first so we can try to resolve your concern. You also have the right to complain to the UK's Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

You can also find general information about your data rights on the ICO website.