Privacy Policy Powerpass

Thank you for using our Powerpass mobile application ('app'). This information applies to the following services and functions, provided they are available in a country, an app version and depending on the mobile device and vehicle model.

Please find below information on the data controllers and their responsibilities (section A), on how your data is collected, processed and used in conjunction with the use of the app (section B) Charging Services (section C, D and E) and on your rights and points of contact (section F and G).

A. Data Controller, Joint Controllership

If you use the Powerpass charging service ("Charging Service"), your data is being processed by Volkswagen Group Charging GmbH, Mollstraße 1, 10178 Berlin, email: info@elli.eco, entered in the Commercial Register of the District Court of Charlottenburg under No. HRB 208967 B ('Elli Germany') and Volkswagen Group Charging CZ s.r.o., Ve svahu 482/5, Podolí, 147 00 Praha 4, Czech Republic (which Volkswagen Group Charging GmbH has appointed to provide the charging service within the Czech Republic) ('Elli Czechia') under joint responsibility (joint controllership).

In order to determine their respective responsibilities, Elli Germany and Elli Czechia have concluded an agreement for the joint processing of your personal data in accordance with Article 26, paragraph 1 GDPR. You hereby receive information about the essential content of this agreement.

According to the agreement Elli Germany carries out the processing of personal data in connection with the provision of the Powerpass in general. Elli Czechia only receives and processes your personal data if you carry out charging sessions within Czech Republic for the purpose of billing, invoicing and charging payments as described in section D II. and III. In the agreement it is also determined that Elli Germany is responsible for providing the information referred to in Articles 13 and 14 GDPR and for processing any assertion of rights by costumers. You find more information on your rights and point of contact in section F and G.

Elli Czechia or Elli Germany are both known as 'Elli' and therefore hereinafter referred to as 'Elli', 'we' or 'us'.

B. General information on using the app

I. General information

Unless you register or otherwise provide us with information, we collect the data described below, which is technically necessary for us to offer you the functions of the App and to ensure the stability and security of the App:

We process this information to enable a technically functional app (e.g. by adapting the app to the needs of your device type). In addition, this information is processed to optimize the Elli-App and to guarantee the stability and security of the app and our information technology systems. The automatically collected data is not personal related and does not allow any inference to you, it is stored for 30 days and then properly deleted, unless longer storage is required or justified by law.

II. Search and find charging stations and share with Google/Apple maps

If you wish to use the search and find function for charging stations, the Google Maps (Google Inc.) map service is integrated on your device. This map service allows you to view charging stations. If you use this service, once enabled, your location is sent to the map service at the time of your query. Please note that this map service is provided to you by Google under its own responsibility. We are not responsible for data processing by Google. Privacy information for the Google Maps service may be found at https://policies.google.com/privacy.

You can also share the charging stations described as above on your device with your own map service available or installed on your device (e.g. Apple Maps, Google Maps etc.). If you use this function, the relevant map service will process your location at the point at which you share it, as well as shared destinations (e.g. an available charging station together with the address). Please note that the map services are provided by the relevant providers respectively under their own responsibility. We are not responsible for data processing. Privacy information for the map service can be found in the privacy policies for the relevant provider, such as for Apple Maps at https://www.apple.com/legal/internet-services/maps/terms-en.html or for Google Maps at https://policies.google.com/privacy.

If you use one of the two aforementioned services, we will store the corresponding data for technical reasons only temporarily. The legal basis for this data processing is your use of the corresponding services (Article 6, paragraph 1, letter b, GDPR). As soon as you log off, your personal data is deleted. After one year of non-use at the latest, they are deregistered for security reasons and have to register again. In this case too, the temporarily stored data will be deleted.

III. Tracking Tools

Volkswagen Group Charging GmbH uses Microsoft App Center to collect anonymous data on the use of the software for the purpose of improving the software, the components configured with it and the services. Documented are the frequency of use of the software, individual functions, malfunctions of the software, model, version and status information of the component as well as model, operating system, language and country of the device. No personal data will be transmitted to Volkswagen Group Charging GmbH.

C. Data Processing upon conclusion of the contract

I. ŠKODA ID

To use our service via the App you need either a ŠKODA ID user account provided by ŠKODA AUTO a.s., tř. Václava Klementa 869, Mladá Boleslav II, 293 01 Mladá Boleslav, Identification No.: 00177041, registered in the Commercial Register kept by the Municipal Court in Prague under Section B, File No. 332 (hereinafter referred to as "ŠKODA AUTO"). Please note the detailed Privacy Policy applicable ŠKODA ID. This policy can be viewed athttps://skodaid.vwgroup.io/data-privacy.

When you use our services, we process the information from your ŠKODA ID user account (your personal contact and identification data (such as your name, address and email address)) for the purposes of contractual fulfilment (Article 6, paragraph 1, letter b GDPR) if you agree to such transfer of information.

II. Powerpass (Public Charging)

a. Charging Card provision

To start and end a charging session, you need an RFID Charging Card ('Charging Card'). This is provided by Plasticard-ZFT GmbH & Co. KG, Reisewitzer Straße 82, 01159 Dresden, who acts and processes data on our behalf. Plasticard-ZFT GmbH & Co. KG receives your contact details (first and last name and address) in order to deliver the Charging Card to you. We receive an RFID identifier assigned to your order and the Charging Card number from Plasticard-ZFT GmbH & Co. KG. This allows us to assign the Charging Card to your user account. You have the option to set up an additional delivery address for the Charging Card, which we also provide to Plasticard-ZFT GmbH & Co. KG. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

An RFID identifier is stored on the card and is used to assign it to your user account. The Charging Card number is printed on the Charging Card. Beyond that, there is no personal data stored digitally on the Charging Card, particularly not your name or address.

b. Charging Plans, Payment Method

To use our Charging Services you select a charging tariff ('Charging Plan') and your preferred payment method. To conclude a Charging Service contract, we process your first and last name, address, email address and, if you have supplied it, your VAT ID number. You can view and manage your selected plan in your user profile. You can also change your stored payment method and billing address. The data processing is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

c. Data processing for payment purposes

To process credit card payments, we process the following data: First and last name, credit card details (credit card number, CVC code (card verification number) and expiry date) address and email address. We collect credit card details to pass them on to payment services. We also send the address and email address you supplied us to the payment services. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

We use Volkswagen Payments S.A. at 19-21 route d'Arlon L 8009 Strassen as our payment service provider for payment processing. Volkswagen Payments S.A. uses your data for the specific purpose intended as part of the payment service and is solely responsible for the data processing. Therefore, when using credit card payment, you are subject to thePrivacy Policy of Volkswagen Payments S.A. that can be found at the URL https://www.wallet.volkswagenpayments.com/documents/file_data_privacy_customer_en-us.pdf. When you enter your credit card details for the first time during your Elli-registration, their validity and authenticity are verified by the payment service. The result of the verification procedure is transmitted to us by the payment service as a success or error message so that we can inform you in the App. If we need to ask you for further identification on behalf of your credit card issuer, this may, for instance, take the form of an SMS or email code that you receive from your credit card issuer and enter for authentication purposes either in the App or a website operated by your credit card issuer, which we forward you to. The payment service provider saves your payment data in a payment database so you do not have to re-enter your data for every charging session. If the payment service responsible for processing your payments should change, the data is transferred from the former payment service to the new payment service.

d. Manage payment method

You can change the credit card details you entered on registration at a later point in your user account under "Payment method". In this process, the same data is transmitted to our payment service provider (Volkswagen Payments S.A. in 19-21 route d'Arlon L 8009 Strassen) as for registration: first and last name, credit card details (credit card number, CVC code, expiry date), address and email address. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

D. Data Processing in connection with charging sessions

I. Use of the charging service

Charging stations can be started and ended using your Charging Card at the charging station or via the App. To control the charging session via the App, you select a charging station in the App. Your RFID identifier, Charging Card number and Elli-internal contract number are sent to the charging station for authentication. The charging session starts once authentication is successful. In order to ensure the functionality and processing of your Charging Plan and the relevant charging sessions, we process your personal data and technical data in conjunction with the Powerpass Contract for the relevant Charging Plan (including charging statistics and charging history (e.g. charging volume, duration or start and end of a charging session), your vehicle identification number (the first eight digits only) and the location of the charging station used (charge point address (EVSE))). The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR). Depending on the charging station you use, to process charging sessions, we use IONITY GmbH, Moosacher Strasse 84, 80809 Munich and has-to-be GmbH, Salzburger Straße 20, 5550 Radstadt, Austria as data processors who act and process data on our behalf.

To provide you with a comprehensive charging service, we also work with providers who process data under their own responsibility. Under these circumstances, we transmit your Charging Plan ID in conjunction with the relevant Powerpass Contract, which cannot be traced back to you personally. You can find more privacy information on the relevant provider's website. The following providers are part of our charging network:

II. Invoicing and Billing

Data processing for the purpose of invoicing and billing is carried out by Elli Czechia if you use charging stations within Czech Republic or by Elli Germany if you use charging stations outside Czech Republic. Based on the Charging Plan and charging history information, we calculate the costs of the charging session using your selected Charging Plan for the purposes of invoicing and billing. For invoicing and billing purposes, we pass on the charging history and your first and last name, address, email address, if you have supplied it, your VAT ID number to Nitrobox GmbH, Fuhlentwiete 14, 20355 Hamburg whom we have commissioned with the data processing and who acts and processes data on our behalf. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

III. Charges and reversed charges

Data processing for the purpose of charging payments and of reversed charges is carried out by Elli Czechia if you use charging stations within Czech Republic or by Elli Germany if you use charging stations outside Czech Republic. With the debit order, we send the relevant payment service a charge text that will appear on your account statement, as well as the amount. The text includes the charge period and billing number. If a charge fails, such as because the credit card used does not have sufficient coverage or the period of validity has expired, we shall be informed of this by the payment service. In that event, we are sent the reason for the error and your identification number that was generated by us. In the event of a reverse charge you have not personally authorised, for instance if a charge was reversed due to being insufficiently covered, you commission us to perform the charge again. In the event that you initiate a reverse charge procedure or we grant you a refund, the relevant amount is charged back by the payment service. We transmit the following data to the payment service for this purpose: amount, the reason for the reverse charge and your user ID and the transaction ID generated by us and allocate to the session. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

IV. Charge at Home (only available for Wallbox with connectivity functions)

Please note that use of Charge at Home and associated online services requires electrical start-up and configuration of a wallbox with connectivity functions. To ensure that your wallbox remains communicative and up-to-date during the electrical start-up and configuration process, we process technical data (e.g. device identification, brand, generation, device type and software version).

If you wish to use Charge at Home and associated online services, you must authorise your wallbox and pair it with your existing user account using a pairing code. You can then access charging statistics and charging history, manage and remotely control your wallbox (e.g. control access permissions) and manage RFID cards (e.g. activate or deactivate for use on the wallbox) at any time. In conjunction with use of Charge at Home and associated online services, we process the following personal and additional technical data for the purposes of service provision and delivery: customer and user identification (data provided from your user account and email addresses of your optional enabled users), wallbox ID and RFID identifier and wallbox management status (e.g. administrator rights), RFID charging card numbers for your enabled RFID charging cards, charging statistics and charging history (e.g. charging volume, duration or time, start and end of a charging session, charging ID), connection status and last communication timestamp (history and logging data) and optional location and location description for your charging station (charge point address (EVSE)). We process your personal data for the purposes of contractual fulfilment (see Article 6, paragraph 1, letter b GDPR) for as long as this is required for the above purpose and generally delete it without delay after the legal basis ceases to exist, if it is no longer required for the stated purposes or if the stated purposes cease to exist and insofar as there is no other legal basis (e.g. retention periods under trade and fiscal law), otherwise after the other legal basis ceases to exist or if we are obliged to do so for other legal reasons.

E. Customer Service, Marketing activities, Retention Period, Third Party Providers

I. Contact and customer service

You can use a contact form to make contact with us via the stored email address or telephone number and send us a query. In this context, we process the information and data you provide (including personal data) in a ticket in order to make contact with you and process your query (Article 6, paragraph 1, letter b GDPR). Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg and Majorel Berlin GmbH, Wohlrabedamm 32, 13629 Berlin assist us as processors and act and process your data on our behalf. Your data is also stored and processed in our CRM system. We use Salesforce.com, Inc. (The Landmark @ One Market Street, San Francisco, CA 94105, USA) as a processor for this purpose to act and process your data on our behalf. It is not possible to rule out Sales-force.com, Inc. having access to the information, so a corresponding EU standard agreement (appropriate guarantee on data processing in non-European countries) has been concluded. You can access the EU standard contractual clauses at the URL https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914. We delete your data as soon as we have answered your query to your satisfaction, providing there are no other retention periods (e.g. fiscal retention periods) that come into conflict with this.

II. Consent to Marketing activities

If you would like to receive information about our products, you can order the corresponding advertising. For this purpose, the following data will be processed within the scope of the consent to be given by you (Article 6, paragraph 1, letter a GDPR) for the purpose of advertising delivery: Name, first name, e-mail address and telephone number.

You can revoke your consent at any time and free of charge to Volkswagen Group Charging GmbH with effect for the future. You will find further information on how to assert your rights in the section "Your rights" of this data protection declaration.

As soon as you have revoked your consent, your personal data will be deleted, unless other retention periods (e.g. tax retention periods) conflict with this.

III. Retention Period

We process your personal data for as long as this is required for the respective purposes. If we process data based on a legitimate interest and you object to such data processing, we shall delete personal data, unless its further processing is permitted or required in accordance with relevant statutory provisions. We shall also delete personal data if we are obliged to do so for other legal reasons. Applying these general principles, we usually delete personal data as soon as the legal basis for the respective processing ceases to exist, if it is no longer required for the stated purposes or if the stated purposes cease to exist, provided there is no other legal basis or obligation for further processing (e.g. retention periods under trade and fiscal law).

IV. Data Processing by Third Party Providers

If service providers process personal data on our behalf, we have concluded contract processing agreements with each of the service providers and agreed on appropriate guarantees on safeguarding the protection of personal data with these service providers. We also select our service providers with care. They process personal data exclusively for the purpose of fulfilling their responsibilities and are contractually bound by our instructions, have suitable technical and organisational measures for the protection of personal data at their disposal and are regularly monitored by us. EU standard contractual clauses for transferring personal data to processors in third countries (appropriate guarantee for data processing in non-European countries) have been concluded accordingly. You can access the EU standard contractual clauses at the URL https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914. You can find an overview of the service providers we use at any time on www.elli.eco.

F. Your rights

You may assert the following rights vis-à-vis the data controllers at any time free of charge.

Right of access: You have the right to receive information from us (Article 15 GDPR) regarding the processing of your personal data.

Right to rectification: You have the right to request that we rectify (Article 16 GDPR) any of your personal data that is incorrect or incomplete.

Right to erasure: You have the right, in the event that the requirements specified in Article 17 GDPR have been met, to request the erasure of your data. Accordingly, you may request the erasure of your data, for instance, if it is no longer necessary for the purposes for which it was collected. Furthermore, you can also request erasure if we process your data on the basis of your consent and you withdraw this consent.

Right to restriction of processing: You have the right to request the restriction of the processing of your personal data if the requirements specified under Article 18 GDPR have been met. This is the case, for example, if you dispute the accuracy of your data. You may then request that processing is restricted for as long as it takes to examine the accuracy of your data.

Right to object: If processing is based on an overriding legitimateinterest you have the right to object to the processing of your data. An objection is permissible if processing is either in the public interest or on account of a justified interest of Volkswagen Group Charging GmbH or a third party. In the event of objection, you are kindly requested to notify us of your reasons for objecting to data processing. Besides this, you also have the right to object to data processing for the purpose of direct marketing. The same applies to profiling, if this is related to direct marketing.

Right to data portability: Provided that the data processing is based on consent or on the fulfilment of a contract and that it is also carried out using automated processing, you have the right to receive your data in a structured, common and machine-readable format and to forward it to another data processor.

Right of withdrawal: Insofar as the data processing is undertaken based upon consent, you have the right to withdraw your consent, with future effect at any time, free of charge.

Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. with the data protection officer for Berlin) regarding our processing of your data.

G. Your points of contact

Points of contact for exercising your rights

For the exercising of your rights and more information, please send an email via privacy@elli.eco or a letter to the Data Protection Officer of Volkswagen Group Charging GmbH, Mollstraße 1, 10178 Berlin. Irrespective of the agreements between Elli Czechia and Elli Germany you may also contact Elli Czechia for exercising your rights.

Data Protection Officer

Our Data Protection Officer is your point of contact for issues related to data protection:

Datenschutzbeauftragter der Volkswagen Group Charging GmbH Mollstraße 1, 10178 Berlin privacy@elli.eco

Version dated: October 2020