Privacy Policy Powerpass

Thank you for using our MyŠkoda​ mobile application ('app'). This information applies to the following services and functions, provided they are available in a country, an app version and depending on the mobile device and vehicle model.

Please find below information on the data controllers and their responsibilities (section A), on how your data is collected, processed and used in conjunction with the use of the app Charging Services (section B, C, D, E and F) and on your rights and points of contact (section G and H).

Please note that use of the Powerpass charging service (“Charging Service”) takes place via the MyŠkoda app ('app'), a mobile application which is provided to the customer by Škoda Auto a.s., tř. Václava Klementa 869, Mladá Boleslav II, 293 01 Mladá Boleslav, Czech Republic, Identification No.: 00177041, registered in the Commercial Register kept by the Municipal Court in Prague under Section B, File No. 332 ('Skoda Auto') to download free of charge via an App store from the relevant operator. Please note that the App is provided by Škoda Auto a.s. under its own responsibility and Škoda Auto a.s. is solely responsible for data processing in connection with the provision of the App. You can find privacy information for the App at: https://skodaid.vwgroup.io/data-privacy

A, Data Controller, Joint Controllership

If you use the Powerpass charging service ("Charging Service"), your data is being processed by Volkswagen Group Charging GmbH, Karl-Liebknecht-Str. 32, 10178 Berlin, email: info@elli.eco, entered in the Commercial Register of the District Court of Charlottenburg under No. HRB 208967 B ('Elli Germany') and Volkswagen Group Charging CZ s.r.o., Ve svahu 482/5, Podolí, 147 00 Praha 4, Czech Republic (which Volkswagen Group Charging GmbH has appointed to provide the charging service within the Czech Republic) ('Elli Czechia') under joint responsibility (joint controllership).

In order to determine their respective responsibilities, Elli Germany and Elli Czechia have concluded an agreement for the joint processing of your personal data in accordance with Article 26, paragraph 1 GDPR. You hereby receive information about the essential content of this agreement.

According to the agreement Elli Germany carries out the processing of personal data in connection with the provision of the Powerpass in general. Elli Czechia only receives and processes your personal data if you carry out charging sessions within Czech Republic for the purpose of billing, invoicing and charging payments as described in section D II. and III. In the agreement it is also determined that Elli Germany is responsible for providing the information referred to in Articles 13 and 14 GDPR and for processing any assertion of rights by costumers. You find more information on your rights and point of contact in section G and H.

Elli Czechia or Elli Germany are both known as 'Elli' and therefore hereinafter referred to as 'Elli', 'we' or 'us'.

B. Data Processing upon conclusion of the contract

I. ŠKODA ID

To use our service via the App you need a ŠKODA ID user account provided by ŠKODA AUTO a.s., tř. Václava Klementa 869, Mladá Boleslav II, 293 01 Mladá Boleslav, Identification No.: 00177041, registered in the Commercial Register kept by the Municipal Court in Prague under Section B, File No. 332 (hereinafter referred to as "ŠKODA AUTO"). Please note the detailed Privacy Policy applicable ŠKODA ID. This policy can be viewed athttps://skodaid.vwgroup.io/data-privacy.

When you use our services, we process the information from your ŠKODA ID user account (your personal contact and identification data (such as your name, address and email address)) for the purposes of contractual fulfilment (Article 6, paragraph 1, letter b GDPR) if you agree to such transfer of information.

We use Auth0 (10800 NE 8th Street, Suite 700, Bellevue, WA 98004, U.S.A.) to provide your account and login with your Škoda-ID user account. This use includes the storage of personal contact and identification information, such as name, address, and email address. Access to the information by Auth0 cannot be excluded, so a corresponding EU standard contract (adequate guarantee for data processing in non-European countries) has been concluded. The EU standard contractual clauses used can be accessed via the URL https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

II. Powerpass (Public Charging)

a. Charging Card provision

To start and end a charging session, you need an RFID Charging Card ('Charging Card'). This is provided by Identa Ausweissysteme GmbH, Steinkirchring 16, 78056 Villingen-Schwenningen, who acts and processes data on our behalf. Identa Ausweissysteme GmbH receives your contact details (first and last name and address) in order to deliver the Charging Card to you. We receive an RFID identifier assigned to your order and the Charging Card number from Identa Ausweissysteme GmbH. This allows us to assign the Charging Card to your user account. You have the option to set up an additional delivery address for the Charging Card, which we also provide to Identa Ausweissysteme GmbH. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

An RFID identifier is stored on the card and is used to assign it to your user account. The Charging Card number is printed on the Charging Card. Beyond that, there is no personal data stored digitally on the Charging Card, particularly not your name or address.

b. Charging Plans, Payment Method

To use our Charging Services you select a charging tariff ('Charging Plan') and your preferred payment method. To conclude a Charging Service contract, we process your first and last name, address, email address and, if you have supplied it, your VAT ID number. You can view and manage your selected plan in your user profile. You can also change your stored payment method and billing address. The data processing is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

c. Data processing for payment purposes

For the processing of the payment, we process the following personal data:

Credit card payment • First and last name • Credit card data (credit card number, CVC code (card verification number) and expiration date) • Credit card address • E-mail address

Paypal • First and last name • Paypal address • Email Address • Payer ID

The payment data is collected by us for transmission to the payment services. In addition, we transmit to the payment services the address and e-mail address you provided to us. The data processing required for this is carried out within the framework of the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR).

For the purpose of payment processing, we use J.P. Morgan Mobility Payments Solutions S.A. at 161 Rue du Kiem L 8030 Strassen as a payment service provider. J.P. Morgan Mobility Payments Solutions S.A. uses your data for a specific purpose within the framework of the payment service and is independently responsible for processing data. When making payments, you are therefore subject to the privacy policy of J.P. Morgan Mobility Payments Solutions S.A., which you can view at the following link https://www.wallet. volkswagenpayments.com/documents/file_data_privacy_customer_de-de.pdf.

When you enter your payment data for the first time during your registration for Elli Charging, their validity and authenticity are verified by the payment service. The result of the verification is sent to us by the payment service as a success or error message. We will inform you about the result in the app. If we need to ask you for further identification on behalf of the issuer of your credit card or Paypal, this may be, for example, an SMS or email code that you receive from the issuer of your credit card or Paypal and enter for authentication either in the app or on a website of the issuer of your credit card or Paypal, to which we redirect you. So that you do not have to re- enter your data for each loading process, your payment data is stored in a payment memory by the payment service provider. If the payment service responsible for processing your payments changes, the data will be transferred from the outgoing payment service to the payment service responsible in the future.

Should a payment default occur, Elli - A Brand of the Volkswagen Group reserves the right to resort to a debt collection service provider on our behalf in order to take over the outstanding debt in a dunning process. For this purpose, it may be necessary to transfer further customer- relevant data to our service provider atriga GmbH. The atriga GmbH uses your data for a specific purpose within the framework of the receivables process and is independently responsible for the processing of the data.

Your personal data will be handled by atriga GmbH in accordance with the applicable data protection regulations. You can also find more information about this at https://www.atriga.com /datenschutz/.

d. Manage payment method

You can change the payment method you entered on registration at a later point in your user account under “Payment method”. In this process, the same data is transmitted to our payment service provider (J.P. Morgan Mobility Payments Solutions S.A. in 161 Rue du Kiem L 8030 Strassen Luxembourg) as for registration: first and last name, credit card details (credit card number, CVC code, expiry date), address and email address. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

C. Data Processing in connection with charging sessions

I. Use of the charging service

Charging sessions can be started and ended using the MyŠkoda app. To manage the charging session using your MyŠkoda app, first select a charging station in the app. Your user ID is transmitted to the charging station for authentication purposes. The charging session begins once your user ID has been authenticated. To ensure the proper functioning and handling of the charging tariff and the relevant charging sessions, we process your personal data as well as technical data in connection with the electricity supply agreement of the relevant charging tariff (including charging statistics and information on the charging process (e.g.. charging volume, duration and/or start and end of a charging session) along with the location of the charging station used (address of the charge point (EVSE))). The processing of data required for this purpose is carried out within the scope of fulfilling the agreement (Art. 6(1)(b) GDPR). Depending on the charging station you use, we employ the services of IONITY GmbH, Moosacher Strasse 84, 80809 Munich, Germany, as the processor. In order to offer you an end-to-end charging service, we also work with providers who perform data processing under their own responsibility. In such cases, we transmit your user ID which cannot be used to identify you as a person. For more information on data protection, refer to the relevant provider’s website. The following roaming platform providers are part of our charging network:

II. Invoicing and Billing

Data processing for the purpose of invoicing and billing is carried out by Elli Czechia if you use charging stations within Czech Republic or by Elli Germany if you use charging stations outside Czech Republic. Based on the Charging Plan and charging history information, we calculate the costs of the charging session using your selected Charging Plan for the purposes of invoicing and billing.

III. Charges and reversed charges

Data processing for the purpose of charging payments and of reversed charges is carried out by Elli Czechia if you use charging stations within Czech Republic or by Elli Germany if you use charging stations outside Czech Republic. With the debit order, we send the relevant payment service a charge text that will appear on your account statement, as well as the amount. The text includes the charge period and billing number. If a charge fails, such as because the payment method used does not have sufficient coverage or the period of validity has expired, we shall be informed of this by the payment service. In that event, we are sent the reason for the error and your identification number that was generated by us. In the event of a reverse charge you have not personally authorised, for instance if a charge was reversed due to being insufficiently covered, you commission us to perform the charge again. In the event that you initiate a reverse charge procedure or we grant you a refund, the relevant amount is charged back by the payment service. We transmit the following data to the payment service for this purpose: amount, the reason for the reverse charge and your user ID and the transaction ID generated by us and allocate to the session. The data processing required for this is performed for the purposes of contract fulfilment (Article 6, paragraph 1, letter b, GDPR).

IV. Processing of your data for analysis purpose

Purpose of processing

Categories of personal data for this purpose:

The data is processed for this purpose exclusively in a pseudonymized or anonymized manner. Pseudonymization includes the removal of all direct personal identifiers (e.g. name, email address, telephone number). Indirect traceable identifiers (pseudonyms) are retained. Only after this pseudonymization is the data analyzed in the analytics systems of Volkswagen Group Charging GmbH. At no time is the direct personal reference restored. The results from the analysis (especially metrics and KPIs) are completely anonymous. The processing of pseudonymous data is necessary because there are interactions between the user account and the respective services. In these cases, the use of the pseudonym is absolutely necessary in order to correlate the analysis of the underlying data from the user account and the linked services.

V. Data processing within the Google Cloud Platform

Volkswagen Group Charging GmbH uses Google Cloud Platform (GCP) to process the following data categories:

This data is collected and used for the purpose of:

For this we use the data processor Google Ireland Limited ("Google") with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, which uses Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google LLC") as subprocessor. Appropriate EU standard contractual clauses (as an appropriate guarantee for data processing in non-European countries) have been concluded for the transmission of personal data. You may review the applied EU standard contractual clauses via the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914

D. Customer Service, Marketing activities, Retention Period, Third Party Providers

I. Contact and customer service

You can You can get in touch with us. In this context, we process the information and data you provide (including personal data) in a ticket in order to make contact with you and process your query (Article 6, paragraph 1, letter b GDPR). Volkswagen AG, Berliner Ring 2, 38440 Wolfsburg and Majorel Berlin GmbH, Wohlrabedamm 32, 13629 Berlin assist us as processors and act and process your data on our behalf. Your data is also stored and processed in our CRM system. We use Salesforce.com, Inc. (The Landmark @ One Market Street, San Francisco, CA 94105, USA) as a processor for this purpose to act and process your data on our behalf. It is not possible to rule out Salesforce.com, Inc. having access to the information, so a corresponding EU standard agreement (appropriate guarantee on data processing in non-European countries) has been concluded. You can access the EU standard contractual clauses at the URL https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32021D0914. We delete your data as soon as we have answered your query to your satisfaction, providing there are no other retention periods (e.g. fiscal retention periods) that come into conflict with this.

II. Consent to Marketing activities

If you would like to receive information about our products, you can order the corresponding advertising. For this purpose, the following data will be processed within the scope of the consent to be given by you (Article 6, paragraph 1, letter a GDPR) for the purpose of advertising delivery: Name, first name, e-mail address and telephone number.

You can revoke your consent at any time and free of charge to Volkswagen Group Charging GmbH with effect for the future. You will find further information on how to assert your rights in the section "Your rights" of this data protection declaration.

As soon as you have revoked your consent, your personal data will be deleted, unless other retention periods (e.g. tax retention periods) conflict with this.

III. Retention Period

We process your personal data for as long as this is required for the respective purposes. If we process data based on a legitimate interest and you object to such data processing, we shall delete personal data, unless its further processing is permitted or required in accordance with relevant statutory provisions. We shall also delete personal data if we are obliged to do so for other legal reasons. Applying these general principles, we usually delete personal data as soon as the legal basis for the respective processing ceases to exist, if it is no longer required for the stated purposes or if the stated purposes cease to exist, provided there is no other legal basis or obligation for further processing (e.g. retention periods under trade and fiscal law).

E. Data Processing by Third Party Providers

If service providers process personal data on our behalf, we have concluded contract processing agreements with each of the service providers and agreed on appropriate guarantees on safeguarding the protection of personal data with these service providers. We also select our service providers with care. They process personal data exclusively for the purpose of fulfilling their responsibilities and are contractually bound by our instructions, have suitable technical and organisational measures for the protection of personal data at their disposal and are regularly monitored by us. EU standard contractual clauses for transferring personal data to processors in third countries (appropriate guarantee for data processing in non-European countries) have been concluded accordingly. You can access the EU standard contractual clauses at the URL. https://eur- lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914. You can find an overview of the service providers we use at any time on www.elli.eco.

I. Data processing on the Google Cloud Platform

Volkswagen Group Charging GmbH uses the Google Cloud Platform (GCP) to process the following categories of data:

This data is collected and used for the following purposes:

For this purpose, we employ the services of the processor Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland, which uses Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google LLC”) as a sub-processor. Corresponding EU standard contractual clauses have been concluded for the transfer of personal data (as an appropriate guarantee for data processing in non-European countries). You can view the EU standard contractual clauses used at https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914. Google LLC is additionally certified in accordance with the EU-US Data Privacy Framework.

II. Data processing at CELONIS

Volkswagen Group Charging GmbH employs the services of CELONIS to process the following categories of data:

This data is collected and used for the following purposes:

For this purpose we employ the services of processor CELONIS SE (“Celonis”), Theresienstrasse 6, 80333 Munich, Germany.

F. Data processing for purposes of analysis

I. Product development and business planning

Purpose of processing:

Categories of personal data for this purpose:

The data is processed exclusively pseudonymously for this purpose. Pseudonymization involves the removal of all direct personal identifiers (e.g., name, e-mail address, telephone number). Indirectly traceable identifiers (pseudonyms) are retained. Data is not analyzed in the analytics systems of Volkswagen Group Charging GmbH until it has been pseudonymized. At no time is a direct reference to a specific person re-established. The results of the analysis (in particular, metrics and KPIs) are fully anonymous. The processing of pseudonymous data is necessary because there are interactions between the user account and the relevant services. In such cases, the use of the pseudonym is absolutely necessary in order to link the data from the user account and the linked services on which the analysis is based. For this purpose, the data is stored and analyzed on the Google Cloud Platform and in CELONIS and Salesforce. The data processed for purposes of analysis will be deleted after 36 months (three years). This processing serves the legitimate interest of Volkswagen Group Charging GmbH to meet high customer demands in terms of the existing products and services and to be able to fulfill future requirements of our customers by means of new products and services that have yet to be developed (Art. 6(1)(f) GDPR).

II. Processing of your data for purposes of fraud prevention

Purpose of processing: Direct and indirect personal data is analyzed in order to detect cases of fraud and abuse at an early time.

Fields containing personally identifiable information for this purpose:

Fields containing personally identifiable information in the form of pseudonyms for this purpose:

The personal data that can be directly or indirectly attributed to a specific person indicated above is analyzed after registration or after a subscription is concluded in order to check that the information is complete and valid. The purpose of this processing is to prevent cases of fraud and abuse. The data is processed for this purpose on the Google Cloud Platform and in Salesforce.

This processing serves the legitimate interest of Volkswagen Group Charging GmbH to prevent cases of fraud and abuse that cause major financial harm resulting from the use of invalid customer data (Art. 6(1)(f) GDPR).

G. Your rights

You may assert the following rights vis-à-vis the data controllers at any time free of charge.

Right of access: You have the right to receive information from us (Article 15 GDPR) regarding the processing of your personal data.

Right to rectification: You have the right to request that we rectify (Article 16 GDPR) any of your personal data that is incorrect or incomplete.

Right to erasure: You have the right, in the event that the requirements specified in Article 17 GDPR have been met, to request the erasure of your data. Accordingly, you may request the erasure of your data, for instance, if it is no longer necessary for the purposes for which it was collected. Furthermore, you can also request erasure if we process your data on the basis of your consent and you withdraw this consent.

Right to restriction of processing: You have the right to request the restriction of the processing of your personal data if the requirements specified under Article 18 GDPR have been met. This is the case, for example, if you dispute the accuracy of your data. You may then request that processing is restricted for as long as it takes to examine the accuracy of your data.

Right to object: If processing is based on an overriding legitimateinterest you have the right to object to the processing of your data. An objection is permissible if processing is either in the public interest or on account of a justified interest of Volkswagen Group Charging GmbH or a third party. In the event of objection, you are kindly requested to notify us of your reasons for objecting to data processing. Besides this, you also have the right to object to data processing for the purpose of direct marketing. The same applies to profiling, if this is related to direct marketing.

Right to data portability: Provided that the data processing is based on consent or on the fulfilment of a contract and that it is also carried out using automated processing, you have the right to receive your data in a structured, common and machine-readable format and to forward it to another data processor.

Right of withdrawal: Insofar as the data processing is undertaken based upon consent, you have the right to withdraw your consent, with future effect at any time, free of charge.

Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority (e.g. with the data protection officer for Berlin) regarding our processing of your data.

H. Your points of contact

Points of contact for exercising your rights

For the exercising of your rights and more information, please send an email via privacy@elli.eco or a letter to the Data Protection Officer of Volkswagen Group Charging GmbH, Karl-Liebknecht-Str. 32, 10178 Berlin. Irrespective of the agreements between Elli Czechia and Elli Germany you may also contact Elli Czechia for exercising your rights.

Data Protection Officer

Our Data Protection Officer is your point of contact for issues related to data protection:

Datenschutzbeauftragter der Volkswagen Group Charging GmbH Karl-Liebknecht-Str. 32, 10178 Berlin privacy@elli.eco

Version dated: March 2024