# BattBox Data, Rewards and Misuse Policy

**Purpose:** Define a privacy-minimised deposit ledger, fair provisional reward and proportionate quality-control model.  
**Status:** Product policy hypothesis requiring legal, privacy, security and consumer review.

## 1. Design commitments

- The kiosk does not need the consumer's name, email, address, order history or raw marketplace account ID.
- The pouch never displays personal details.
- Identity, physical deposit and reviewer views remain separated.
- Accepted weight is not described as recycled weight.
- Rewards remain provisional until the relevant checks pass.
- Automated anomaly scoring does not suspend an account by itself.
- Every adverse decision has a reason, a retention limit and an appeal path.

## 2. Identity and token model

1. Marketplace authenticates the consumer.
2. Marketplace issues a signed, short-lived, single-use deposit token with a random nonce and campaign entitlement.
3. BattBox exchanges the token for a programme subject reference that rotates or is otherwise protected from use outside the programme.
4. A new pouch ID is bound to the deposit transaction at the kiosk.
5. The identity mapping remains in a logically separated service with tightly controlled access.
6. The reviewer sees the pouch ID, measurements and prior programme risk signals necessary for the case, not direct identity.

## 3. Core event model

| Event | Minimum fields | Purpose |
|---|---|---|
| TokenIssued | token ID, expiry, campaign | One valid attempt |
| SessionStarted | device, coarse site, time, token hash | Begin controlled flow |
| SafetyDeclared | accepted class selections, instructions version | Record user-facing screen, not prove physical condition |
| PouchBound | pouch ID, tare, batch, device | Prevent reuse and calculate net mass |
| WeightCaptured | gross, tare, net, stability, calibration state | Consumer value and anomaly check |
| DepositClosed | passage result, shutter/cassette state, event signature | Confirm custody transition |
| RewardProvisional | points, rule version, hold reason | Transparent pending wallet |
| CaseSelected | random/risk reason, reviewer queue | Controlled QA |
| QualityRecorded | allowed findings, evidence reference, reviewer role | Approve, adjust, void or escalate |
| CassetteCollected | cassette ID, seals, operator, time | Chain of custody |
| FacilityReceived | received mass, discrepancies, non-conformance | Reconcile field records |
| TreatmentRecorded | partner batch, status, mass basis | Outcome evidence |
| RewardFinalised | points, decision, notice | Close consumer state |
| AppealResolved | request, reviewer, outcome, remedy | Fair challenge process |

Every event requires a schema version, actor, timestamp, idempotency key and integrity protection appropriate to the risk.

## 4. Reward formula hypothesis

Illustrative, not approved:

```text
eligible_net_grams = min(max(stable_gross - pouch_tare, 0), 500)
base_points = floor(eligible_net_grams * 0.5)
final_points = base_points only after quality status is APPROVED
```

Controls:

- Maximum 500 eligible grams per deposit.
- Daily and monthly deposit/value caps.
- Velocity limits across nearby devices.
- No chemistry multiplier that encourages risky batteries.
- No reward for rejected, unsafe or embedded items.
- Community donation option.
- Paused value calculation when a scale is outside tolerance.
- Published terms explain provisional status, sampling, expiry and appeal.

Illustrative redemption: 100 points = £0.50 partner voucher value. The sponsor must set an affordable liability and consider consumer, promotions, tax, accounting and equality treatment.

## 5. Quality model

### Automated checks

- Token and pouch have not been used.
- Pouch batch and tare are valid.
- Weight is stable and in range.
- Scale health and calibration state are valid.
- Session duration and sequence are plausible.
- Shutter passage and cassette states agree.
- Account/device velocity is within campaign limits.

### Random sampling

Random review estimates true contamination and terminal-isolation quality without treating every user as suspicious. Sampling rate begins high in supervised beta and adjusts only after statistical and safety review.

### Risk-based selection

Potential signals include repeated maximum-weight deposits, large scale discrepancies, improbable session timing, reused pouch scans, unusual site/account velocity and correlation with contaminated prior samples. Signals generate a case; they are not proof of misconduct.

### Controlled review findings

- Clean / accepted.
- Preparation correction only.
- Non-battery contamination.
- Prohibited but stable battery/item.
- Damaged or abnormal battery—safety escalation.
- Weight discrepancy.
- Evidence inconclusive.

## 6. Decision ladder

1. **Approve:** release the provisional reward.
2. **Educate:** release or proportionately adjust based on published rule; show specific preparation guidance.
3. **Void affected reward:** only where the sampled deposit fails a clear published eligibility rule.
4. **Temporary restriction:** after repeated verified misuse and human review.
5. **Suspend:** only for serious or repeated verified abuse, with notice and appeal unless an immediate restriction is necessary for safety.

Never ask a consumer to retrieve or handle an unsafe deposit to preserve a reward.

## 7. Appeal

- Notice identifies the affected deposit, decision, rule and value.
- Consumer can challenge from the marketplace app or an accessible assisted channel.
- A person not responsible for the original decision reviews the case.
- Identity and evidence access is logged.
- Inconclusive evidence favours a proportionate consumer remedy while safety operations continue separately.
- Outcome and any restored value are communicated within the published service level.

## 8. Privacy work

Complete a DPIA covering:

- Controller and processor roles across marketplace, BattBox, operator, BCS and treatment partner.
- Purpose and lawful basis for service, reward, security, QA, regulatory evidence and research data.
- Necessity and proportionality of account linking and sampling.
- Automated-decision and profiling implications.
- Retention by event category.
- International transfers and subprocessors.
- Transparency, access, deletion, objection and appeal.
- Children and vulnerable users if the service is open to them.
- CCTV separation at host locations.

### Retention hypothesis

| Data | Initial hypothesis |
|---|---|
| Raw kiosk/session telemetry | 90 days unless incident hold |
| Deposit and reward ledger | Contract/legal period, minimised after reconciliation |
| Pouch-to-subject mapping | Shortest period supporting reward and appeal |
| QA evidence | Appeal period plus controlled safety/legal hold |
| Device security logs | Risk-based period with restricted access |
| Aggregated operational metrics | Retain after robust de-identification |

Final periods require a documented legal and operational basis.

## 9. Security controls

- Signed single-use tokens with expiry and audience restriction.
- Mutual device authentication and credential rotation.
- Signed firmware/configuration and controlled rollback.
- Encryption in transit and at rest.
- Role-based access and separate identity/reviewer privileges.
- Append-only audit for reward and QA decisions.
- Idempotent deposit and reward APIs.
- Rate limits and replay prevention.
- Alerting for device tamper, unusual access and event-sequence breaks.
- Supplier vulnerability-management and incident-response obligations.

## 10. Reporting definitions

- **Deposited mass:** net mass recorded at the kiosk after a completed shutter event.
- **Accepted mass:** deposited mass remaining after quality adjustments.
- **Collected mass:** cassette mass transferred from sites, reconciled to net deposits.
- **Received mass:** downstream facility measured mass.
- **Treated mass:** mass recorded as entering the approved treatment process.
- **Recycled output:** material output meeting the approved calculation and evidence method; not inferred from kiosk weight.

Dashboards and public claims must display the correct stage and time period.

## 11. Open decisions

- Is the reward a marketplace voucher, loyalty point, charity donation or mixed wallet?
- What value and cap avoid unsafe collection while changing behaviour?
- Which review findings can adjust reward, and by how much?
- What sampling rate gives a defensible quality estimate?
- What is the minimum identity link required for statutory evidence versus promotion?
- Can non-account or assisted users participate without discrimination?
- How will partner account suspension remain separate from BattBox programme restrictions?

---

This policy is a product concept. Final terms require legal, privacy, consumer, security, equality, tax and accounting approval.