Privacy Policy

Last updated: 29 September 2026

Singer Automation Limited (NZBN 9429033182155, company number 1977114) ("Singer Automation", "we", "us") owns and operates the Apollo EMS platform and its associated portals and apps, charging services, and Demand Response and Flexibility programmes (together, the “Services”), and is part of the Singer Group. Our registered office is 16 Edinburgh Street, Auckland Central, Auckland 1010, New Zealand. We are the agency responsible for the personal information described in this policy.

This policy explains how we collect, use, store, share and disclose personal information through the Services, and your rights in relation to it. We handle personal information in accordance with the Privacy Act 2020 and the Information Privacy Principles (IPPs).

This is our master privacy policy. It applies to all of the Services, and to any other Singer Automation service that links to it.

1. Who This Policy Covers

This policy applies to:

• Customer users — people at our customer organisations who hold accounts on the Apollo EMS platform or our portals, and Singer Group staff and contractors;
• App and charging users — people who create an account in one of our apps, start a charging session through one of our portals, use a charging card we issue, or charge on our network through a roaming partner, at a public or private charger;
• Site users — people who charge a vehicle at, or use energy assets at, a site Singer Automation manages, whether or not they hold an account with us, where information about that activity can identify them;
• Contacts — people who contact us for support, or whose details are provided to us as a site or account contact.

Where Singer Automation manages sites for a customer organisation, that organisation will usually have its own privacy obligations to its staff, tenants or visitors. This policy covers what we do.

2. What We Collect

Account and contact information
Name, work email address, phone number, employer or organisation, job role, portal role and permissions, and support and ticket correspondence.

App and charging account information
Name, email address, phone number and, where we ask for them, postal address, vehicle registration number and other identification details. Your account status, account balance, subscription and top-up details, vouchers, charging cards linked to your account, and your marketing preferences.

Payment information
Payment method type, the last digits and expiry date of a card, transaction amounts, receipts and invoices. Full card details are collected and held by our payment processor, not by us.

Site and connection information
Site address and location, ICP (installation control point) identifier, electricity retailer and tariff or plan type, distributor and network region, connection capacity, meter serial number and certification details, and asset make, model and serial number for chargers, inverters, batteries, gateways and meters.

Charging activity
Charging session records including plug-in and unplug times, session start and stop time, duration, energy delivered (kWh), charging schedule and power profile, charge point and connector identity, the tariff applied and the session cost, idle time, session stop reason, and any fault or alarm raised. Where sessions are authorised by an identifier — an RFID card or tag, a vehicle identifier, a mobile app account or a registration plate — that identifier is collected and linked to the session.

Where a charging identifier is assigned to a named individual, session records are personal information about that individual.

Energy, generation and storage data
Meter readings and interval data at settlement-grade intervals, site load and demand data, periodic readings of current, voltage, power factor and frequency, solar generation output, battery state of charge, charge and discharge activity, inverter telemetry and status, export and import volumes, and any control setpoints applied to an asset.

Most of this is information about a site rather than a person. It becomes personal information where the site is a residence, a single-occupant premises, or otherwise identifies an individual — for example an employee's home charger or home battery enrolled through a workplace programme. How we handle that situation is set out in section 6.

Flexibility and Demand Response data
Asset registration and availability data, dispatch instructions issued and the asset's response, opt-outs and overrides, baseline and performance calculations, and settlement data relating to programme participation.

Technical information
IP address, device and browser type, device identifier, device make and model, operating system and app version, authentication events, pages and screens accessed, and system and audit logs generated when you use our portals or apps.

Location
If you allow it in your device settings, our apps use your device’s location to show chargers near you. You can turn this off at any time in your device settings.

Cookies and app analytics
See section 12.

3. How We Collect It

• Directly from you — when an account is created, when you use our portals or apps, or when you contact us.
• From your employer or the site operator — when they nominate users, issue charging cards or provide site contacts.
• Automatically from your device, when you use our apps.
• From our payment processor, when you pay for charging.
• From charging network roaming partners, when you charge on our network using another provider’s account or card.
• Automatically from equipment — chargers, meters, gateways and DER devices connected to the platform report operational data to us.
• From third-party platforms we use to operate the Services (see sections 7 and 8).

If we collect personal information about you from someone other than you, we rely on IPP 2(2) where the information is collected from your employer or site operator for the purposes set out below.

Where we collect personal information about you from another person or organisation, we will take reasonable steps under IPP 3A to make sure you know that we have it, what it is for and who will receive it, unless an exception in the Privacy Act 2020 applies. This policy, and the notice your employer, fleet operator or site operator gives you when they nominate you or issue you a charging card, are part of how we do that.

You don’t have to give us personal information, but if you don’t, we may not be able to create your account, authorise charging, or provide some of the Services. Some information, such as metering, settlement and dispatch data, is collected because the Electricity Industry Participation Code requires or authorises it.

4. Why We Collect It

We use personal information to:

• create and manage accounts, authenticate users and control access;
• authorise charging sessions and operate, monitor and control connected equipment;
• deliver, maintain, support and troubleshoot the Services, including diagnosing faults and managing maintenance and field service work;
• produce usage, availability and energy reports to the customer organisation that operates the site;
• calculate and support billing, cost recovery and reimbursement;
• process payments, card pre-authorisations, refunds, receipts and invoices, including billing your employer or fleet operator where they pay for some or all of your charging;
• respond to your enquiries and support requests;
• send you service notifications about your charging sessions, payments, account and shared chargers, by email, text or push notification;
• send you marketing messages, but only where you have agreed to receive them;
• manage Demand Response, load management and Flexibility programmes, and tender your electricity supply on your behalf where you ask us to;
• maintain security, investigate misuse, and keep audit records;
• improve the platform and our apps, including by analysing aggregated and de-identified usage patterns;
• meet legal, regulatory and industry code obligations.

5. Disclosure to the Organisation Operating the Site

Please read this section if you charge a vehicle at a site we manage.

Charging session data is made available to the organisation that operates the site or the charging programme — typically your employer, fleet operator, property manager or landlord. Where your charging is authorised by an identifier linked to you, that organisation can see the sessions associated with you, including when, where, how long and how much energy.

They use this for fleet management, billing and cost allocation, and site operations. What they then do with it is governed by their own privacy obligations and policies, not ours.

6. Home and Personal Assets Enrolled Through an Employer

Please read this section if your employer has enrolled a charger, battery or other asset at your home.

Where an employer, fleet operator or other organisation enrols an asset at an individual's home, the data we collect can show when the household is using electricity, and so when someone is at home or away. We treat that as personal information about the individual, not only as site data.

Two different purposes apply to that data, and a different organisation is responsible for each:

• Employment and reimbursement purposes — reporting home charging to your employer, reimbursing you, allocating cost, and any tax or payroll use. For these purposes we hold the information on your employer's behalf. Under section 11 of the Privacy Act 2020 it is treated as held by your employer, and your employer is the agency responsible for it.
• Flexibility and Demand Response purposes — dispatching or curtailing the asset, and offering its capacity under a programme described in section 7. We use the information for our own commercial purposes here, so Singer Automation Limited is the agency responsible and our obligations under the Privacy Act apply directly to you.

What this means in practice:

• For access, correction or a complaint about Flexibility use of your home asset, contact us at privacy@singergroup.co.nz.
• For anything about how your employer uses your home charging data — what they see, how they reimburse you, how long they keep it — contact your employer. We may refer your request to them.
• The organisation that enrols your asset is required to tell you at the time of enrolment that the asset is being enrolled, what data is collected, and that it may be dispatched under a Flexibility programme.
• You can ask for your home asset to be withdrawn from Flexibility dispatch. Speak to whoever enrolled it, or contact us and we will work with them.

7. Aggregation, Flexibility and Grid Partners

Please read this section if your site or asset is enrolled in a Demand Response or Flexibility programme.

Singer Automation Limited is registered with the Electricity Authority as a Load Aggregator and as an Ancillary Service Agent.

To run our Flexibility, Demand Response and Ancillary Services programmes, and to manage your electricity supply, we share site, asset, metering and dispatch data with:

• the Electricity Authority, the system operator and market systems, as required under the Electricity Industry Participation Code;
• electricity distribution businesses, for network support and constraint management, network planning (including a register of enrolled assets), or where a connection requires it;
• electricity retailers and metering equipment providers, to reconcile consumption, apply a tariff or resolve a metering or settlement query, and retailers when we tender your supply on your behalf, without your name or usage data unless you agree;
• flexibility buyers, including distributors, retailers, gentailers and the grid owner, for the events they procure.

We do not sell personal information. Data goes to a buyer only for the services it buys, never for marketing, retail sales targeting or competitor benchmarking, and, wherever that is enough for the purpose, at site, ICP or portfolio level rather than in a form that identifies an individual.

8. Who Else We Share Information With

• Service providers and sub-processors that operate parts of the Services, including our operational support systems (OSS) platform partners, cloud hosting provider, field service management system, communications carriers, payment processor, push notification service provider, app analytics provider, and support and ticketing tools. These providers are bound by contract to use the information only to provide services to us, and are not permitted to use it for their own purposes. Our payment processor may also use payment information to meet its own fraud-prevention and legal obligations.
• Our push notification service provider receives your device identifier and details from your account and charging sessions, such as your name, contact details, account status and balance, vehicle identifier and the location of a session, so we can send you relevant notifications.
• App store and device operating system providers deliver push notifications to your device and process information under their own privacy policies.
• Other Singer Group companies, including Singer Electric, to install, maintain and service equipment and to invoice for services;
• Charging network roaming partners, where a session is initiated on a roaming basis — session and identifier data is exchanged to authorise and settle that session.
• Professional advisers, insurers and auditors, under confidentiality.
• Law enforcement, regulators and courts, where required or authorised by law.
• A purchaser, if we sell or restructure our business, subject to equivalent privacy protections.

We do not sell personal information.

9. Information Sent or Stored Overseas

Some of our providers store or process information outside New Zealand, including in Australia and the United States.

Before disclosing personal information to an overseas provider, we take reasonable steps under IPP 12 to ensure it is subject to safeguards comparable to those in the Privacy Act 2020 — including contractual data protection terms, and reliance on the provider's own regulatory regime where that regime provides comparable protection.

10. Security

We use access controls, role-based permissions, encryption in transit, network segregation, authentication controls and audit logging to protect information. Access by Singer Automation and Singer Group staff is limited to those who need it to do their job.

No system is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

11. How Long We Keep It

We keep personal information only as long as needed for the purposes above, or as required by law or by our agreement with the customer organisation.

Indicatively:

• Account records — for the life of the account, then 12 months after closure.
• Charging session and energy records — 7 years. This includes the driver, vehicle or token identifier linked to a session, where the customer organisation's reporting requires it. A customer organisation may instruct us to hold identifiers for a shorter period.
• Payment and transaction records — 7 years.
• Support tickets and field service records — 7 years.
• Marketing preferences — for the life of the account.
• Security and audit logs — 18 months, held in a tamper-evident store.

Session, payment and energy records are kept for 7 years because they underpin invoices and are business records for the purposes of the Tax Administration Act 1994 and the Companies Act 1993, and because a contract claim can be brought within 6 years under the Limitation Act 2010.

Security and audit logs are held for 18 months to meet the minimum event log retention baseline in the New Zealand Information Security Manual (NZISM), which applies to systems supporting government agencies.

Historic charging history that identifies an individual is visible only to you in your account, to authorised administrators at the customer organisation that operates the site, and to our staff who need it to support the Services.

After these periods we delete the information or de-identify it so it can no longer be linked to an individual. Aggregated and de-identified data may be kept indefinitely.

12. Cookies and App Analytics

Our web portals use cookies that are necessary for them to function — maintaining your login session, security and preferences.

On our web portals, we do not use advertising or cross-site tracking cookies.

You can control cookies through your browser, but disabling necessary cookies will prevent you from logging in.

Our apps use an app analytics provider to understand how they are used, such as which screens are opened and whether errors occur, and a push notification service provider to deliver notifications. We do not use this information for advertising. You can turn off push notifications in our apps or in your device settings.

13. Your Rights

Under IPPs 6 and 7 you have the right to ask us:

• for confirmation of whether we hold personal information about you, and for access to it;
• to correct information that is wrong, or to attach a statement of correction if we do not agree to change it.

You can also ask us:

• to close your account and delete your personal information, subject to the retention periods in section 11;
• to stop sending you marketing messages. You can also use the unsubscribe link in any marketing message or change your preferences in our apps.

Contact privacy@singergroup.co.nz. We will respond within 20 working days. We may need to verify your identity, and there are limited grounds in the Privacy Act on which we can withhold information — for example where releasing it would disclose someone else's personal information.

If your request relates to information held on behalf of a customer organisation, we may need to refer you to that organisation.

14. Complaints

If you are concerned about how we have handled your personal information, contact our Privacy Officer at privacy@singergroup.co.nz. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909.

15. Changes to This Policy

We may update this policy from time to time. The current version is published on our portals and in our apps with its effective date. We will notify account holders of material changes.

16. Contact

Privacy Officer
Singer Automation Limited
16 Edinburgh Street, Auckland Central, Auckland 1010, New Zealand
privacy@singergroup.co.nz