Who we are
Magma Technologies ("Magma", "we", "us") operates from its registered office at 97, 3rd Main Rd, Varalakshmi Nagar, Maduravoyal, Chennai 600095, Tamil Nadu, India.
We operate the Magma ChargeSpot public charging network, Magma CSMS (charging station management software), and the Magma rider mobile application. This policy applies to all of these services.
Data we collect
We collect different categories of data depending on your relationship with us:
| Category | Examples | Who it applies to |
|---|---|---|
| Account data | Name, email, phone, GSTIN, bank details | Vendors, operators, registered drivers |
| Session data | Charger ID, session start/stop, energy (kWh), cost, connector type | All charging sessions |
| Payment data | UPI transaction ID, card BIN (last 4 digits only), payment status | Paid sessions |
| Location data | Charger GPS coordinates (not driver location) | All sessions |
| Device data | App version, OS, device model, push token | Rider app users |
| Usage data | Dashboard page views, feature usage, API calls | CSMS portal users |
| RFID data | RFID card UID (hashed), linked account | RFID users |
| Support data | Ticket content, chat logs, diagnostic OCPP payloads | Support ticket submitters |
We do not collect driver location, vehicle GPS, or biometric data. We do not store full card numbers or UPI IDs.
How we use your data
- To provide and operate the charging service — session management, payment processing, receipt generation.
- To manage your account — vendor onboarding, operator management, CSMS access, weekly settlements.
- To maintain and improve the network — diagnosing charger faults, optimising charging schedules, improving CSMS performance.
- To communicate with you — session receipts, service alerts, settlement reports, security notices.
- To comply with legal obligations — GST invoicing, TDS deduction, DISCOM reporting, FAME-II compliance.
- To detect and prevent fraud — unusual session patterns, duplicate payments, RFID spoofing.
Legal basis for processing
We process data under the Digital Personal Data Protection Act 2023 (DPDP Act) on the following bases:
- Contract performance — processing necessary to provide the charging service you've signed up for.
- Legitimate interests — network security, fraud prevention, service improvement.
- Legal obligation — GST, TDS, DISCOM, FAME-II and other statutory requirements.
- Consent — marketing communications and optional analytics (you can withdraw at any time).
Data sharing
We share your data only where necessary:
| Recipient | Purpose | Data shared |
|---|---|---|
| Payment gateways (Razorpay, PhonePe) | Process payments | Session amount, masked card/UPI ref |
| 4G network providers (Airtel, Jio) | Charger connectivity | SIM IMEI only |
| Roaming hubs (Hubject, EV Recharge) | OCPI roaming sessions | Session CDR, anonymised token |
| AWS (Mumbai region) | Cloud infrastructure | All platform data, encrypted |
| Statutory authorities | Legal compliance | As required by law |
| Operator (if applicable) | Your vendor's operator sees their charger and session data | Site-level session and revenue data |
Data retention
- Session and CDR records — 7 years (GST audit requirement).
- Payment records — 7 years (Income Tax Act).
- Account data — retained while your account is active, deleted within 90 days of account closure.
- CSMS logs and OCPP diagnostics — 12 months rolling.
- Support tickets — 3 years.
- App analytics — 13 months rolling.
Your rights
Under the DPDP Act 2023, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Grievance — raise a complaint with our Data Protection Officer.
- Nominate — nominate another person to exercise your rights in the event of death or incapacity.
To exercise any of these rights, email support@magmatech.in. We will respond within 30 days.
Cookies and tracking
Our website and CSMS portal use the following cookies:
- Essential cookies — session authentication, CSRF protection. Cannot be disabled.
- Analytics cookies — page view counts, feature usage (no cross-site tracking). Can be disabled.
- Preference cookies — theme, language, dashboard layout. Can be cleared by clearing browser storage.
We do not use advertising cookies, third-party tracking pixels or fingerprinting technologies.
Data Protection Officer
Our Data Protection Officer can be reached at:
support@magmatech.in
+91 97515 97555
97, 3rd Main Rd, Varalakshmi Nagar, Maduravoyal, Chennai 600095, Tamil Nadu
If you are unsatisfied with our response, you may lodge a complaint with the Data Protection Board of India once constituted under the DPDP Act 2023.
Changes to this policy
We will notify registered account holders by email of material changes to this policy at least 14 days before they take effect. Minor clarifications may be updated without notice. The "Last updated" date at the top of this page always reflects the current version.