Last updated: 16 August 2026
Protection of personal data
This explains what we collect, why, who receives it, how long we keep it and what you can ask of us. It is written to be read, not to be ticked.
1. Who processes the data
The data controller must be the legal entity identified on the Legal details page. A field marked incomplete means the controller disclosure is not complete and must not be read as an operator identity. Use the address below for a privacy request; the missing legal details remain a launch requirement, not information supplied by this text.
2. What we collect
We collect only what the function you use needs. Not every category below applies before launch: charging, payment and billing data arise only if the corresponding service is enabled and used.
- Identification and contact details — name, email address, phone number, town, and for business customers the company name and tax details.
- Account data — the password stored as a hash, preferred language, communication preferences and sign-in history.
- Vehicle data — make, model and connector type, if you choose to add them.
- Session data — the station and location used, start and end time, energy delivered, cost and the RFID card used.
- Payment data — card type, the last four digits and the transaction identifier from the payment processor. The full card number never reaches us.
- Billing data — billing address, invoice series and number, amounts and payment method.
- Correspondence with us — messages sent through the form, tickets and notes from phone conversations.
- Applications — the CV and the details from the careers form, plus notes from the recruitment process.
- Technical data — IP address, browser type, pages visited and cookie identifiers.
3. Purposes and legal bases
Every processing operation has a purpose and a legal basis from art. 6(1) of Regulation (EU) 2016/679 (GDPR). We do not use the data for anything not written below.
| Purpose | Legal basis | Retention period |
|---|---|---|
| Creating and running your account | Performance of the contract — art. 6(1)(b) GDPR | For as long as the account exists, plus 3 years after it closes, the general limitation period |
| Providing the charging service and managing sessions | Performance of the contract — art. 6(1)(b) GDPR | For the duration of the contract, plus 3 years |
| Issuing invoices and keeping accounting records | Legal obligation — art. 6(1)(c) GDPR, Accounting Law no. 82/1991 and the Fiscal Code | The statutory accounting period, generally 5 years calculated from 1 July of the year following the relevant financial year, or longer where another rule requires it |
| Taking payment, refunds and fraud prevention | Performance of the contract and legitimate interest — art. 6(1)(b) and (f) GDPR | For the duration of the contract, plus 3 years |
| Answering messages, tickets and complaints | Performance of the contract, or our legitimate interest in answering people who write to us — art. 6(1)(b) and (f) GDPR | 3 years from closing the ticket |
| Recording your marketing choice and, only if the communication channel is activated, sending the messages you agreed to receive | Consent — art. 6(1)(a) GDPR | Until consent is withdrawn |
| Assessing applications received through the careers page | Pre-contractual steps at your request — art. 6(1)(b) GDPR; for keeping a CV on file for future roles, consent — art. 6(1)(a) | 6 months after the process ends, or 2 years if you agreed to be considered for future roles |
| Platform security, technical logs, filtering automated messages | Legitimate interest — art. 6(1)(f) GDPR | 12 months |
| Recording cookie choices, first-party performance measurement when accepted, and any later functional or marketing integration only after the relevant consent | Consent — art. 6(1)(a) GDPR and art. 4(5) of Law no. 506/2004 | See the duration of each category in the cookie policy |
4. Who we share it with
We do not sell personal data. Depending on the function you use and the suppliers configured for this network, data may be disclosed only where needed for the purposes described below and under the applicable data-protection terms.
- The payment processor, for charges, pre-authorisations and refunds.
- The transactional email provider, so that confirmations and invoices reach you.
- The hosting and infrastructure provider, on whose servers the platform runs.
- Our accountant and, where applicable, our auditor, for invoices and reporting.
- The external map-tile provider receives ordinary request data, such as IP address and browser headers, when your browser opens the station map.
- Public authorities, only where the law obliges us and only within the limits of their request.
5. Transfers outside the European Union
The configured hosting location is identified on the legal-details page once completed. A configured supplier may process data outside the European Economic Area; where Chapter V GDPR requires a transfer mechanism, we use an applicable adequacy decision or contractual safeguards and provide information about them on request.
6. Security
Measures used by the platform include TLS for production traffic, one-way password hashing, restricted internal access and encryption for fields configured as sensitive. No measure removes every risk. We assess any personal-data breach and notify the supervisory authority within the applicable period, including the 72-hour GDPR period where required; affected people are informed when the legal threshold is met.
7. Your rights
The GDPR gives you the rights below, subject to the conditions and exceptions in the Regulation. Requests are generally free of charge.
- The right of access — to know whether we process data about you and to receive a copy of it, together with the purposes and the recipients (art. 15).
- The right to rectification — to have inaccurate or incomplete data corrected or completed (art. 16).
- The right to erasure — to have data deleted once we no longer have a lawful reason to keep it (art. 17).
- The right to restriction of processing — to have it paused while we verify a challenge (art. 18).
- The right to data portability — to receive your data in a structured, commonly used, machine-readable format, or to have it sent to another controller (art. 20).
- The right to object — to processing based on our legitimate interest, and at any time and without reason to direct marketing (art. 21).
- The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant ones (art. 22).
- The right to lodge a complaint with the supervisory authority and to go to court (art. 77-79).
Where processing is based on consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before it, per art. 7(3) GDPR.
8. How to exercise your rights
Write to [email protected] or use the contact form. We answer within one month of receiving the request; if it is complex we may extend by two months and will tell you why. There is no charge, except for manifestly unfounded or excessive requests. So that we do not hand your data to somebody else, we may ask for further information to identify you.
9. Complaining to the supervisory authority
If our answer does not satisfy you, you have the right to lodge a complaint with the Romanian supervisory authority.
10. Automated decisions and profiling
Form-security filters may quarantine a submission for review, and a configured payment processor may run automated fraud checks that accept or refuse a transaction. These operational checks are not intended to make solely automated decisions with legal or similarly significant effects about you. Contact us if you believe a legitimate message or transaction was incorrectly blocked so the case can be reviewed.
11. Children
Accounts and future paid charging services are intended for people over 18. If you believe a minor has submitted personal data, write to us so we can assess and erase it where there is no lawful reason to retain it.
12. Changes to this document
When we change this document we publish a new effective date. A material change is highlighted on the site and communicated directly where the law requires direct notice or renewed consent.