ChargeWise Security Commitment Statement

The Premium Platform for eMobility Growth

Last updated: January 6, 2026

At "ChargeWise", a limited liability company organized under the laws of the Republic of Bulgaria, we are committed to safeguarding the security and privacy of the data entrusted to us through the ChargeWise platform, a User Engagement and Loyalty Programs Management Platform for eMobility Service Providers. This Security Commitment Statement outlines our dedication to protecting the personal data and information of our B2B clients ("Clients") who use the Admin Application and B2C end customers ("End Users") who use the Web Application, as well as any planned mobile applications for Android and iOS.

Our security practices are designed to comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), Bulgarian data protection legislation, and other relevant privacy regulations (e.g., the California Consumer Privacy Act (CCPA), where applicable). This statement reflects best practices inspired by industry standards and comparable services.

Our Commitment to Security

ChargeWise is dedicated to maintaining a robust security framework to protect the confidentiality, integrity, and availability of the data we process. We recognize the trust that Clients and End Users place in us to securely handle personal data, including names, surnames, phone numbers, and email addresses, as well as usage data related to loyalty program participation.

1. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated with processing personal data. These measures include:

1.1 Data Protection

Encryption: All data transmitted to and from the Service, as well as data at rest, is encrypted using industry-standard protocols (e.g., TLS 1.2 or higher for transmission, AES-256 for stored data).
Access Controls: Role-based access controls (RBAC) restrict data access to authorized personnel only, based on the principle of least privilege.
Authentication: Multi-factor authentication (MFA) is enforced for administrative access to the Admin Application and internal systems.

1.2 System Security

Secure Development: The Software is developed following secure coding practices, with regular code reviews and vulnerability assessments.
Infrastructure Security: Our servers, hosted with reputable cloud providers, are configured with firewalls, intrusion detection systems, and regular security patches.
Monitoring and Logging: Continuous monitoring and logging of system activity to detect and respond to suspicious behavior.

1.3 Data Breach Response

In the event of a personal data breach, we will notify affected Clients and, where required, End Users and relevant supervisory authorities (e.g., the Bulgarian Commission for Personal Data Protection) without undue delay, as mandated by GDPR (Article 33).
We maintain an incident response plan to promptly address and mitigate any security incidents.

2. Compliance with Data Protection Laws

ChargeWise operates as a data processor on behalf of our Clients, who act as data controllers under GDPR. We:

Process personal data only on documented instructions from Clients, as outlined in our Data Processing Agreement (DPA).
Implement measures to comply with GDPR, Bulgarian law, and other applicable regulations, including safeguards for international data transfers (e.g., Standard Contractual Clauses for transfers outside the EEA).
Support Clients in fulfilling data subject requests (e.g., access, erasure) and conducting data protection impact assessments, as required by GDPR.

3. Third-Party Security

We engage trusted third-party service providers (e.g., cloud hosting, analytics) as subprocessors, subject to strict data processing agreements that enforce equivalent security and confidentiality standards. These providers are vetted to ensure compliance with GDPR and other applicable laws. A list of authorized subprocessors is available in our DPA.

4. Employee Training and Confidentiality

All ChargeWise personnel are trained on data protection and security best practices. Employees and contractors are bound by confidentiality agreements to protect Client and End User data.

5. Regular Assessments and Improvements

We conduct regular security assessments, including:

Vulnerability scans and penetration testing of the Service;
Audits of our technical and organizational measures to ensure ongoing compliance;
Reviews of third-party provider security practices.

We continuously update our security measures to address emerging threats and align with industry standards, such as ISO 27001 or equivalent frameworks.

6. Client and End User Responsibilities

While ChargeWise maintains robust security practices, Clients and End Users also play a role in ensuring security:

Clients: Must obtain necessary consents from End Users for data processing, secure their own systems, and comply with applicable laws as data controllers.
End Users: Are responsible for safeguarding their account credentials and using the Software in accordance with our End-User License Agreement (EULA).

7. International Operations

As a Bulgarian company serving Clients primarily in Europe and North America, we ensure our security measures meet the requirements of GDPR, Bulgarian law, and relevant North American regulations. Data transfers outside the EEA are protected by appropriate safeguards, such as Standard Contractual Clauses.

8. Updates to This Statement

We may update this Security Commitment Statement to reflect changes in our practices or legal requirements. We will notify Clients and End Users of material changes via the Service or email, as required by law (e.g., GDPR). Continued use of the Service after such changes constitutes acceptance.

9. Contact Us

If you have questions about our security practices or this statement, please contact us at:

ChargeWise
Email: legal@chargewise.global
Address: 22 Madren str., Houston Complex “Slatina”, Blok 22, Entr. G, apt. #119, 1574 Sofia, Bulgaria
Phone: +359 896 99 15 66