Powerpass Privacy Policy
Last updated: December 2024
Thank you for using our charging services.
This information applies to the following services and functions, provided they are available in a country, in a particular version of the app, and for the mobile device and vehicle model.
Please find below information about the data controllers and their responsibilities (Section A), how your data is collected, processed, and utilized in connection with the use of the app for information purposes (Section B) and in connection with the use of the Charging Services (Sections C–G), as well as about your rights and contact persons (Sections H and I).
Please note that the use of the Powerpass charging service ("Charging Service") takes place via the MyŠkoda app ("App"), a mobile application available to customers of Škoda Auto a.s., tř. Václava Klementa 869, Mladá Boleslav II, 293 01 Mladá Boleslav, Czech Republic, identification no: 00177041, registered in the Commercial Register of the Municipal Court in Prague, Section B, File No. 332 ("Skoda Auto") for free download via an app store of the respective operator. Please note that the app is provided by Škoda Auto a.s. on its own responsibility and Škoda Auto a.s. is solely responsible for data processing in connection with the provision of the app. Information on data protection for the app can be found at: https://skodaid.vwgroup.io/data-privacy
If you use the Powerpass service (“Charging Service”), your data is being processed by Volkswagen Group Charging GmbH, Karl-Liebknecht-Str. 32, 10178 Berlin, email: info@elli.eco, entered in the Commercial Register of the District Court of Charlottenburg under No. HRB 208967 B (“Elli Germany”) and Volkswagen Group Charging CZ s.r.o., Ve svahu 482/5, Podolí, 147 00 Praha 4, Czech Republic (which Volkswagen Group Charging GmbH has appointed to provide the charging service within the Czech Republic) (“Elli Czechia”) under joint responsibility (joint controllership).
Elli Germany and Elli Czechia have entered into an agreement on the joint processing of your personal data pursuant to Art. 26(1) of the GDPR in order to define their respective responsibilities. This document provides you with key information contained in this agreement.
Under the agreement, Elli Germany shall be responsible for the processing of personal data in connection with the provision of the Charge Service. Elli Czechia receives and processes your personal data only if you use the Charge Service within the Czech Republic for the purposes of settlement of accounts, invoicing, and payment settlement as described in Section C.
In the agreement it is also determined that Elli Germany is responsible for providing the information referred to in Articles 13 and 14 GDPR and for processing any assertion of rights by costumers. You find more information on your rights and point of contact in section H and I.
Elli Czechia and Elli Germany, known as “Elli,” are hereinafter referred to as “Elli,” “we,” or “us.”
I. ŠKODA ID
To use our service via the app, you need a ŠKODA ID user account provided by ŠKODA AUTO a.s., tř. Václava Klementa 869, Mladá Boleslav II, 293 01 Mladá Boleslav, identification no: 00177041, registered in the Commercial Register of the Municipal Court in Prague, Section B, File No. 332 (hereinafter referred to as "ŠKODA AUTO"). Please note the detailed ŠKODA privacy policy that applies to the ŠKODA ID. These provisions can be viewed at https://skodaid.vwgroup.io/data-privacy
When you use our services, we process the information from your ŠKODA ID user account (your personal contact and identification data, such as your name, address and email address) for the purpose of fulfilling the contract (Art. 6 Para. 1 lit. b GDPR).
We use Auth0 (10800 NE 8th Street, Suite 700, Bellevue, WA 98004, U.S.) to provide your account and login with your ŠKODA ID, whereby your data is processed in the USA. Use includes the storage of personal contact and identification data, such as name, postal address, and e-mail address.
To this end, we have concluded EU standard contractual clauses with the service provider, which act as a guarantee for this transfer of data. You can request information on the content of these standard contractual clauses at any time from the contacts listed in Section I.
You need an RFID charging card (“charging card”) to start and stop a charging session. This is made available to you by Identa Ausweissysteme GmbH, Steinkirchring 16, 78056 Villingen-Schwenningen, Germany, on our behalf. In order to send you the charging card, our processor Identa Ausweissysteme GmbH is sent your contact details (first/last name and address). We receive the RFID assigned to your order and the charging card number from Identa Ausweissysteme GmbH so that we can assign the charging card to your user profile. You have the option of adding an additional shipping address used in the delivery of the charging card, which we will also send to Identa Ausweissysteme GmbH. The processing of data required for this purpose is carried out within the scope of fulfilling the agreement (Art. 6(1)(b) GDPR).
An RFID is stored on the card, which is used to assign it to your user account. The charging card number is printed on the card. Furthermore, no personal data, in particular your name or address, is stored in digital form on the card.
To use the charging service, select a tariff (“charging tariff”) and your preferred payment method. For purposes of concluding the agreement, we process your first and last name, your postal/e-mail address, and, if you entered this information, your tax identification number. You can view and manage the tariff you selected in your user profile. You can also edit the payment method and billing address saved by you. Data is processed for the purpose of fulfilling the agreement (Art. 6(1)(b) GDPR).
We process the following personal data for purposes of payment settlement:
Credit card payment:
First and last name
Credit card details (credit card number, CVC code (card verification code), and expiration date)
Street address
Email address
Paypal:
First and last name
Street address
Email address
Payer ID
We collect the payment data in order to transfer it to the payment services. In addition to this, we also transfer the postal and e-mail address you provided to us to the payment services. The processing of data required for this purpose is carried out within the scope of fulfilling the agreement (Art. 6(1)(b) GDPR).
For payment settlement, we employ the services of J.P. Morgan Mobility Payments Solutions S.A., 161 Rue du Kiem L 8030 Strassen, Luxembourg, as the payment service provider. J.P. Morgan Mobility Payments Solutions S.A. uses your data for this specific purpose in connection with the payment service and is independently responsible for data processing. When you make payments, you are therefore subject to the privacy policy of J.P. Morgan Mobility Payments Solutions S.A., which you can view by following this link: https://www.wallet.volkswagenpayments.com/documents/file_data_privacy_customer_de-de.pdf.
When you register for the charging service and enter your payment details for the first time, the payment service will carry out a check to validate and authenticate them. The results of the check are sent to us by the payment service as a success or error message. We will inform you of the results of the check in the app. If we are required to request for further identification from you on behalf of the issuer of your credit card or PayPal, this may, for example, be done in the form of a text message or an e-mail code that you receive from the issuer of your credit card or PayPal and enter for authentication either in the app or on a website of the issuer of your credit card or PayPal, to which we will redirect you. Your payment details are saved in a payment storage system by the payment service provider so that you do not have to re-enter your payment details each time you carry out a charging session. If the payment service responsible for processing your payments changes, the data will be transferred from the outgoing payment service to the payment service who will be responsible for processing in the future.
In the event of non-payment, Elli reserves the right to employ the services as a collection agency to take over the outstanding claim on our behalf within the scope of a dunning process. For this purpose, it may be necessary to transmit further customer-relevant data to our service provider atriga GmbH. atriga GmbH uses your data for this specific purpose as part of the claims process and is independently responsible for processing the data.
Your personal data will be handled by atriga GmbH in accordance with the applicable privacy policy. For more information please go to https://www.atriga.com/datenschutz/.
You can change the payment method you entered at registration later under “Payment method” in your user account. As part of this process, the same data that is transferred during registration is transmitted to our payment service provider (J.P. Morgan Mobility Payments Solutions S.A., 161 Rue du Kiem L 8030 Strassen, Luxembourg):
First and last name
Credit card details (credit card number, CVC code, and expiration date)
Street address
Email address
The data required for this purpose is processed in order to fulfill the agreement (Art. 6(1)(b) GDPR).
You use your charging card to start or stop charging sessions at the charging station or right in your app. To manage the charging session using your app, first select a charging station in the app. Your RFID, the charging card number, and the contract number are transmitted to the charging station for authentication purposes. The charging session begins once your user ID has been authenticated. To ensure the proper functioning and handling of the charging tariff and the relevant charging sessions, we process your personal data as well as technical data in connection with the electricity supply agreement of the relevant charging tariff (including charging statistics and information on the charging process (e.g., charging volume, duration and/or start and end of a charging session), your vehicle identification number (only the first eight digits) along with the location of the charging station used (address of the charge point (EVSE))). The processing of data required for this purpose is carried out within the scope of fulfilling the agreement (Art. 6(1)(b) GDPR). Depending on the charging station you use, we employ the services of IONITY GmbH, Moosacher Straße 84, 80809 Munich, Germany as the processor.
In order to offer you an end-to-end charging service, we also work with providers who perform data processing under their own responsibility. In such cases, we transmit your tariff ID which cannot be used to identify you as a person. For more information on data protection, refer to the relevant provider’s website. The following providers are part of our charging network:
Hubject GmbH, EUREF-Campus 22, 10829 Berlin (www.hubject.com)
GIREVE, 108-110 Avenue du Général Leclerc, 78220 Viroflay, France
(www.gireve.com)
Stromnetz Hamburg GmbH, Bramfelder Chaussee 130, 22177 Hamburg
(www.eround.de)
e-clearing.net GmbH, Krefelder Straße 195, 52070 Aachen (www.e-clearing.net)
Data processing for purposes of settlement of accounts and invoicing is carried out by Elli Czechia if you use charging stations within the Czechia, or by Elli Germany if you use charging stations outside the Czechia. On the basis of the charging plan and charging history data, we calculate the cost of the charging session using the charging plan you selected for purposes of settlement of accounts and invoicing.
Data processing for purposes of direct debits and chargebacks is carried out by Elli Czechia if you use charging stations within the Czechia, or by Elli Germany if you use charging stations outside the Czechia.
We send the debit order along with the amount and a posting text that is to appear on your account statement to the relevant payment service. This text contains the accounting period and account number.
If your account cannot be debited, for example, due to insufficient funds on the payment method or because the payment method has expired and is no longer valid, we will be notified of this by the payment service provider. The reason for the error and your ID number generated by us will be transmitted to us. In the event of a chargeback that you did not personally initiate, e.g., if a direct debit was charged back due to insufficient funds, you authorize us once more to debit your account. In the event that you initiate a chargeback or we issue you a refund, the charges for the amount in question will be reversed by the payment service. For this purpose, we transmit the following data to the payment service:
The amount
The reason for the chargeback
Your user ID
The transaction ID generated by us and assigned to the charging session
The processing of data required for this purpose is carried out within the scope of fulfilling the agreement (Art. 6(1)(b) GDPR).
You have the possibility to contact us and send us a request. In the event that you do so, we process the information and data you provide (including personal data) in a ticket in order to contact you and process your request (Art. 6(1)(b) GDPR).
We employ the services of processors in order to process your personal data, in particular with reference to customer inquiries and support and for our CRM system. We have concluded corresponding data processing agreements with our service providers. If your data is transferred to a third country, the transfer of said data is secured by means of suitable guarantees given by third countries, such as by way of an adequacy decision or standard contractual clauses adopted by the EU Commission. We would be happy to provide you with further information on this. To do so, use the contact options listed in Section I.
We will delete your data as soon as we have responded to your request to your satisfaction, provided there are no other retention periods (e.g., retention periods under tax law) to the contrary.
We employ the services of cloud service providers as our processors for the following data processing operations, and have entered into relevant data processing agreements. The necessary procedures are in place (adequacy decision or standard contractual clauses) should your personal data be transferred to a third country. You can request further information on this at any time via the contacts specified in Section I.
Purpose of processing:
To guarantee and improve product quality, research and development regarding new products and services
To identify and solve, among other things, technical issues in the service (bugs)
For business planning, process mining, internal reporting, and forecasting
Categories of personal data for this purpose:
User and usage data
Logs on the use of the charge points showing the customer’s individual charging sessions
All data collected during the charging session
Purchase, shipping, and payment information
Customer Support processes
Data on the use of apps and online stores
Vehicle identification number (VIN), truncated to remove the final six digits (vehicle model ID)
Subscription and tariff information
Invoices
The data is processed exclusively pseudonymously for this purpose. Pseudonymization involves the removal of all direct personal identifiers (e.g., name, e-mail address, telephone number). Indirectly traceable identifiers (pseudonyms) are retained. Data is not analyzed in the analytics systems of Elli until it has been pseudonymized. At no time is a direct reference to a specific person re-established. The results of the analysis (in particular, metrics and KPIs) are fully anonymous. The processing of pseudonymous data is necessary because there are interactions between the user account and the relevant services. In such cases, the use of the pseudonym is absolutely necessary in order to link the data from the user account and the linked services on which the analysis is based. The data processed for purposes of analysis will be deleted after thirty-six (36) months (three (3) years). This processing serves the legitimate interest of Elli to meet high customer demands in terms of the existing products and services and to be able to fulfill future requirements of our customers by means of new products and services that have yet to be developed (Art. 6(1)(f) GDPR).
Purpose of processing:
Direct and indirect personal data is analyzed in order to detect cases of fraud and abuse at an early time.
Fields containing personally identifiable information for this purpose
Salutation
First name
Last name
Street address
Postal code
Town/city
Country
Language
Email address
Payment method (no payment information such as credit card number, etc.)
Date of registration
Start date of subscription
Fields containing personally identifiable information in the form of pseudonyms for this purpose:
Customer number
Subscription number
RFID card number
The personal data that can be directly or indirectly attributed to a specific person indicated above is analyzed after registration or after concluding a subscription in order to check that the information is complete and valid. The purpose of this processing is to prevent cases of fraud and abuse.
This processing serves the legitimate interest of Elli to prevent cases of fraud and abuse that cause major financial harm resulting from the use of invalid customer data (Art. 6(1)(f) GDPR).
In addition to the processors and service providers described separately in the processing operations, we also use other could service providers to deliver our services. The cloud service providers we employ are:
Google Cloud Platform, a service of Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google Cloud EMEA Limited uses Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google LLC”) as a subcontractor. This means that data transfer to the USA cannot be ruled out. For information on this, please read Google's privacy notice: https://cloud.google.com/terms/cloud-privacy-notice?hl=de. The EU standard contractual clauses used by Google can be viewed via the following link: https://cloud.google.com/terms/eu-model-contract-clause
Oracle Corporation UK Limited, Oracle Parkway, Thames Valley Park, Reading, Berkshire, RG6 1RA, UK. The transfer of data to the United Kingdom is protected under an EU adequacy decision.
In particular, your information from your user profile concerning your charging contracts and sessions, invoices, charger information, and billing transactions is stored in the cloud services.
You can request further information at any time using the contact details found in Section I.
We process your personal data for as long as is necessary for the aforementioned purposes. This is required for invoicing and settlement of accounts up to three (3) months after the agreement ends. In the event that you object to processing based on our legitimate interests, we will erase your personal data unless further processing is permitted under the relevant statutory provisions. We also delete personal data if we are obliged to do so for other legal reasons. Applying these general principles, we delete personal data immediately after the legal basis ceases to apply if it is no longer required for the stated purposes or the stated purposes cease to apply and provided that no other legal basis exists (e.g., retention periods under commercial and tax law); otherwise, the data will be deleted after the other legal basis ceases to apply.
You can assert the following rights vis-à-vis Volkswagen Group Charging GmbH at any time at no charge.
Right to information: You have the right to receive information from us (Art. 15 of the GDPR) regarding the processing of your personal data.
Right to rectification: You have the right to obtain from us the rectification (Art. 16 of the GDPR) of inaccurate or incomplete personal data concerning you.
Right to erasure: You have the right to obtain the erasure of your data if the conditions set out in Art. 17 of the GDPR are satisfied. You can then, for example, obtain the deletion of your data if it is no longer necessary in relation to the purposes for which it was collected. You can also obtain erasure if we process your data on the basis of your consent and you withdraw this consent.
Right to restriction of processing: You have the right to obtain the restriction of the processing of your data if the requirements of Art. 18 of the GDPR are satisfied. This would be the case, for example, if you were to contest the accuracy of your data. You can then obtain the restriction of processing for a period enabling the controller to verify the accuracy of the data.
Right to object: If the processing is based on an overriding legitimate interest, you have the right to object to the processing of your data. You also have the right to object if the processing is either in the public interest or on the basis of a legitimate interest of Volkswagen Group Charging GmbH or a third party. In the event that you object to data processing, we ask that you inform us of the reasons for your objection. You also have the right to object to data processing for direct marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing.
Right to data portability: If the processing of data is based on consent or on a contract and is also carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to withdraw consent: If the processing of data is based on consent, you have the right to withdraw your consent at any time at no charge with future effect.
Right to lodge a complaint: You also have the right to lodge a complaint with respect to our processing of your data with a supervisory authority (for example, the Commissioner for Data Protection and Freedom of Information of the State of Berlin).
Who to contact to exercise your rights
If you have any questions regarding the processing of your personal data or wish to exercise your rights under data protection law, you can contact our data protection team:
You can reach our data protection officer at:
PROLIANCE GmbH
www.datenschutzexperte.de
Leopoldstr. 21
80802 München
datenschutzbeauftragter@datenschutzexperte.de
When contacting the data protection officer, please specify Volkswagen Group Charging GmbH as the company to which your request refers. Please refrain from including sensitive information such as a copy of your ID with your request.