Who we are
K2K Power ("K2K", "we", "us") is a brand of IHFL Projects, operating from 340, RR Complex, Covai Main Road, Tirupur, Tamil Nadu, India. GSTIN: 33COBPK4131B1ZQ.
We operate K2K EV charging stations, K2K CSMS (charge station management software) and the K2K app. This policy applies to all of these services.
Data we collect
We collect different categories of data depending on your relationship with us:
| Category | Examples | Who it applies to |
|---|---|---|
| Account data | Name, email, phone, GSTIN, bank details | Partners and registered drivers |
| Session data | Charger ID, session start/stop, energy (kWh), cost, connector type | All charging sessions |
| Payment data | UPI transaction ID, card BIN (last 4 digits only), payment status | Paid sessions |
| Location data | Charger GPS coordinates (not driver location) | All sessions |
| Device data | App version, OS, device model, push token | K2K app users |
| Usage data | Dashboard page views, feature usage, API calls | CSMS portal users |
| RFID data | RFID card UID (hashed), linked account | RFID users |
| Support data | Ticket content, chat logs, diagnostic OCPP payloads | Support ticket submitters |
We do not collect driver location, vehicle GPS, or biometric data. We do not store full card numbers or UPI IDs.
How we use your data
- To provide and operate the charging service — session management, payment processing, receipt generation.
- To manage your account — partner onboarding, CSMS access and settlement under your agreement.
- To maintain and improve the network — diagnosing charger faults, optimising charging schedules, improving CSMS performance.
- To communicate with you — session receipts, service alerts, settlement reports, security notices.
- To comply with legal obligations — GST invoicing, TDS deduction and other statutory reporting.
- To detect and prevent fraud — unusual session patterns, duplicate payments, RFID spoofing.
Legal basis for processing
We process data under the Digital Personal Data Protection Act 2023 (DPDP Act) on the following bases:
- Contract performance — processing necessary to provide the charging service you've signed up for.
- Legitimate interests — network security, fraud prevention, service improvement.
- Legal obligation — GST, TDS and other statutory requirements.
- Consent — marketing communications and optional analytics (you can withdraw at any time).
Data sharing
We share your data only where necessary:
| Recipient | Purpose | Data shared |
|---|---|---|
| Payment gateways | Process payments | Session amount, masked card/UPI reference |
| Connectivity providers | Charger connectivity | SIM IMEI only |
| AWS (Mumbai region) | Cloud infrastructure | All platform data, encrypted |
| Statutory authorities | Legal compliance | As required by law |
| Network partner (if applicable) | Your network partner sees their charger and session data | Site-level session data |
Data retention
- Session and CDR records — 7 years (GST audit requirement).
- Payment records — 7 years (Income Tax Act).
- Account data — retained while your account is active. On deletion it is removed immediately (in-app) or within 30 days (by email), as described above.
- CSMS logs and OCPP diagnostics — 12 months rolling.
- Support tickets — 3 years.
- App analytics — 13 months rolling.
Your rights
Under the DPDP Act 2023, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Grievance — raise a complaint with our Data Protection Officer.
- Nominate — nominate another person to exercise your rights in the event of death or incapacity.
To exercise any of these rights, email support@k2konline.in. We will respond within 30 days.
How to delete your account
You can delete your K2K account at any time, in either of these ways:
- In-app — open K2K Charging → Profile → Legal → Delete My Account, then follow the on-screen steps. Your account is deleted immediately.
- By email — email support@k2konline.in from the address associated with your account, with the subject "Delete my account". We will process the request within 30 days.
What gets deleted: your name, email address, phone number, avatar and account preferences.
What is retained (anonymised): charging session records, top-up transactions and RFID card audit logs. These are required for accounting and legal compliance. All personally identifying links to you are removed.
Cookies and tracking
Our website and CSMS portal use the following cookies:
- Essential cookies — session authentication, CSRF protection. Cannot be disabled.
- Analytics cookies — page view counts, feature usage (no cross-site tracking). Can be disabled.
- Preference cookies — theme, language, dashboard layout. Can be cleared by clearing browser storage.
We do not use advertising cookies, third-party tracking pixels or fingerprinting technologies.
Data Protection Officer
Our Data Protection Officer can be reached at:
support@k2konline.in
+91 96883 06898
IHFL Projects, 340, RR Complex, Covai Main Road, Tirupur, Tamil Nadu
If you are unsatisfied with our response, you may lodge a complaint with the Data Protection Board of India once constituted under the DPDP Act 2023.
Changes to this policy
We will notify registered account holders by email of material changes to this policy at least 14 days before they take effect. Minor clarifications may be updated without notice. The "Last updated" date at the top of this page always reflects the current version.