PERSONAL DATA PROTECTION POLICY

CHARGE&GO d.o.o. Beograd

 Charge&GO Beograd handles the personal data of natural persons and processes them in accordance with the applicable regulations, primarily following the Personal Data Protection Law (The Official Gazette of RS, No. 87/2018). The aim of this policy is to explain in a clear, comprehensible and easily accessible way what personal data Charge&GO collects and for what purpose, how it protects the collected data and how persons whose personal data is processed can exercise their rights guaranteed by the Personal Data Protection Law .

In accordance with the Personal Data Protection Law, the terms used have the following meaning:

Processing of personal data entails any action performed with personal data and/or their sets, automated or non-automated, such as collection, use, recording, sorting, grouping (structuring), storing, adapting, changing, revealing, transmitting, providing, making available for inspection, copying or duplicating, comparing, limiting, deleting or destroying, which Charge&GO does directly or through its partners and related parties.

Personal data is any data relating to a natural person whose identity is determined or determinable, directly or indirectly, especially on the basis of an identity marker, such as name and identification number, location data, identifiers in electronic communication networks or one, i.e. more features of their physical, physiological, genetic, mental, economic, cultural and social identity;

The person to whom the data refers is any natural person whose personal data is processed by Charge&GO.

A special type of personal data is personal data revealing racial or ethnic origin, political opinion, religious or philosophical belief or trade union membership, as well as the processing of genetic data, biometric data for the purpose of unique identification of a person, data on health status or data on sexual life or sexual orientation of a natural person.

1. Implementation of the personal data protection policy

The personal data protection policy applies to all personal data of the person to whom the data relates and which Charge&GO processes and/or determines the purpose and method of processing. The personal data protection policy applies to all Charge&GO services and products, the use of which or the interest in using them involves the processing of personal data. If the basis of the processing is consent, the given consent to the processing of personal data also applies to all Charge&GO services and products used by the person who gave the consent.

The personal data protection policy is primarily intended and refers to natural persons who are interested in using and using electric vehicle charging services via  the Charge&GO online platform or application and/or natural persons who are interested in browsing the Charge&GO website or using other website functions.

The personal data protection policy does not apply to anonymized data (data based on which the identity of a person cannot be directly or indirectly determined), considering that anonymized data represents data that has been changed so that it cannot be linked to a specific natural person, so, in accordance with the current regulations, it is not considered personal data. Charge&GO processes personal data for different purposes, and the means of collection, the legal basis for processing, use, disclosure and retention periods may differ depending on the purpose.

2. Principles of personal data processing

In order to process personal data in a legal manner, Charge&GO will adhere to the following legal principles:

– Personal data is processed lawfully, fairly and transparently in relation to which the data relates, while data processing in accordance with the provisions of the Personal Data Protection Law is hereinafter referred to as legal processing;

– Personal data is collected for purposes that are specifically determined, explicit, justified and legal and cannot be processed in a way that is inconsistent with those purposes (“limitation in relation to the purpose of processing”);

– Personal data that is processed must be appropriate, essential and limited to what is necessary in relation to the purpose of processing (“data minimization”);

– Personal data that is processed must be accurate and, if necessary, updated, with the obligation to take reasonable measures to ensure that inaccurate personal data is deleted or corrected without delay (“accuracy”);

– Personal data is stored in a form that enables the identification of the person only for the period necessary to achieve the purpose of the processing (“storage limitation”);

– Personal data is processed in a way that ensures adequate protection of personal data, including protection against unauthorized or illegal processing and against accidental loss, destruction or damage by applying appropriate technical, organizational and personnel measures (“integrity and confidentiality”).

In order to fully comply with the legal principles of personal data processing, Charge&GO will:

– In a clear, simple and transparent manner, inform the persons to whom the data refer about the purpose of the processing and the legal basis for the processing and process personal data for purposes that are specifically determined, explicit, justified and legal;

– Process data that is necessary to provide the service to the person to whom the data refers, process data for which the processing is prescribed as a legal obligation of the operator, process data that is necessary for the realization of the legitimate interest of Charge&GO (in cases where that interest prevails over on the interest of the data subject), as well as carry out data processing based on the consent of the data subject.

In obtaining personal data, Charge&GO adheres to the principle of the minimum amount of data, for which reason only those personal data that are necessary to fulfil the purpose for which they are processed are collected, while any necessary additional personal data are obtained with the consent of the person to whom the data is being processed. Charge&GO ensures the accuracy of personal data by applying technical and organizational measures and periodically updating the data.

Data storage terms are determined in Charge&GO’s internal acts in order to ensure data storage for the period that is necessary to achieve the purpose of processing and that is in accordance with legal regulations. Charge&GO respects the principle of integrity and confidentiality of personal data and has implemented technical and organizational measures for the protection of personal data based on valid legal regulations, good business practices and internationally recognized standards in this area. Charge&GO can hire an entity to carry out personal data processing on the basis of a special contract prescribed by the provisions of the Personal Data Protection Law, which specifically defines the duties of the data processor in terms of personal data protection.

3. Method of data collection

Charge&GO collects personal data if there is a legal basis prescribed by the Personal Data Protection Law, while data is collected directly by filling in (entering) data in the questionnaire by the person to whom the data relates during registration and/or application on the Charge&GO web platform or the Charge&GO application, for which reasons, does not have a physical archive of personal data.

During use, the Charge&GO application prevents the mobile device from going to sleep and accesses additional data necessary to provide electric vehicle charging services using the application, such as data on the user’s current location (approximate location determined via the mobile network and precise location determined via the mobile and GPS networks) and camera. Access and use of all the above data during the use of the Charge&GO application are approved by the user of the mobile device on which the application is installed. Apart from data on the location and start and end time of the electric vehicle charging session, any other data relevant to the provision of the service using the application is not stored after use.

Charge&GO uses Google Maps services. This allows us to display interactive maps directly on our application and ensures reliable map usage. When using Google Maps, the Google Terms of Service and the Additional Terms of Service of Google Maps/Google Earth apply, which can be accessed on the website via the link https://www.google.com/intl/sr_US/help/terms_maps/ .

4. Types of data collected

Charge&GO collects and processes data submitted by the persons to whom the data refer by filling out forms on the Charge&GO website and/or application. The following categories of personal data are collected and processed, in relation to the various processing purposes, namely name and surname, email address, city/place of residence (for the purpose of sending a possibly ordered RFID card), mobile phone number, payment card data or other data that will be entered for a better user experience and personal identification, as well as other personal data for which there is a legal basis for their processing in accordance with the law.

5. Purposes for which personal data are used

Charge&GO collects and processes data for the purpose of identifying service users, contacting and maintaining relationships with users, for invoicing and debt collection, the introduction and development of charging services and other services provided by Charge&GO, monitoring the use of charging services, direct marketing, public opinion research and market research, as well as for other legitimate purposes.

Charge&GO processes the personal data of the person to whom the data refer only when such processing is legal. Processing is lawful in the following cases:

– Processing is necessary to provide a service to the person to whom the data refer or to undertake actions at the request of the person to whom the data refer;

– The processing is necessary in order to comply with the legal obligations of Charge&GO, which implies the obligation that the collected data be, if the legal requirements are met, submitted to the relevant state authorities based on their written request (Courts, Prosecutor’s Office, Municipal Police, Inspection Services, etc.) or that the competent authorities have access to certain data;

– Processing is necessary in order to achieve the legitimate interests of Charge&GO or a third party, except when those interests are stronger than the interests or the fundamental rights and freedoms of the person to whom the data refer, which require the protection of personal data and especially if the person to whom the data refer is minor. Under the legitimate interest of Charge&GO is meant especially processing that serves to improve the process, product development and business improvement, modernize services and offer products and services that are expected to improve business with Clients.

– The person to whom the data refers has given their consent to the processing of their personal data for one or more specific purposes, whereby this consent must be demonstrable and voluntary, written in an understandable language, and the person to whom the data refers has the possibility and legal the right to withdraw consent at any time.

– Processing is necessary for the vital interests of the person to whom the data refer or another natural person;

– The processing is necessary for the purpose of carrying out work in the public interest or the execution of Charge&GO’s statutory powers.

5. Automatic data processing

Charge&GO does not perform automatic data processing.

6. Access to personal data and to whom it may be forwarded

Only designated Charge&GO employees have access to personal data. Data access can also be provided by hired associates in accordance with the tasks entrusted to them by Charge&GO and only to the extent that it is minimally necessary, with the obligation to fully comply with Charge&GO’s normative acts in the field of personal data protection. Personal data is accessible to third parties outside of Charge&GO only in the following cases:

– if there is a legal obligation or express authorization based on the law (requirements of state authorities);

– if a third party who has the capacity of a data processor is engaged for the performance of certain tasks and who must act in everything in accordance with Charge&GO’s orders. In that case, Charge&GO ensures all the prescribed data protection measures as if it were doing this business independently;

– affiliated companies of Charge&GO under the condition of having an adequate legal basis (consent of the person or legitimate interest of Charge&GO);

– if the data needs to be forwarded in order to perform the service;

– to other persons outside Charge&GO to whom the person to whom the data refer has given express consent.

As a rule, Charge&GO processes personal data in the Republic of Serbia. Exceptionally, personal data may be processed in other countries or international organizations in accordance with the Personal Data Protection Law.

7. Personal data protection method

Personal information is treated as a business secret and is classified as confidential information. Adequate protection measures are applied to personal data to protect the data from damage, unauthorized access, accidental loss, destruction, damage and any other threat to security. Charge&GO undertakes adequate measures to enable and monitor access and activities in information systems and the application of software solutions for the protection of information resources, as well as undertakes the required measures to fulfil the obligation of full legal action of all third parties who may acquire a legal right of access to personal data

In this sense, and considering as the personal data obtained during the use of the website and the Charge&Go application are not stored in physical form, the Charge&GO website and application are regularly checked to detect possible security risks and common dangers, while the system is regularly checked and updated to detect malware. Personal data is located behind secure networks and can only be accessed by a limited number of persons who have special access rights to such systems and who are required to maintain the confidentiality of the data. All sensitive information (such as credit card numbers) is encrypted using Secure Socket Layer (SSL) technology.

In the event of a personal data breach that results in or may result in the accidental or intentional destruction, loss, alteration or unauthorized disclosure of personal data during their processing, and which also may result in the emergence of high risk to the rights and freedoms of natural persons to whom the data refer, upon learning of such violation Charge&GO will immediately, without undue delay, inform the Commissioner and the person to whom the data refer in a clear and comprehensible manner, with the mandatory indication of the contact information of the authorized person for the personal data protection, a description of the possible consequences and a description of the measures taken.

In the event of a breach of personal data, Charge&GO will immediately take appropriate measures in order to prevent further damage to the rights and freedoms of the person to whom the data relates and reduce the consequences resulting from the breach.

8. Rights of persons to whom the data refer

Service users, potential users of services and other persons to whom personal data refer can exercise the following rights:

– The right to access personal data is the applicant’s right to obtain information about the existence of personal data processing related to him, the purpose of processing, the type of personal data being processed, the recipients or categories of recipients to whom the personal data is disclosed or may be disclosed, about storage periods, about the existence of the right to request correction or deletion of personal data, that is, the right to limit the processing of such data, about the existence of the right to file a complaint with the Commissioner;

– The right to correction of personal data is the right for the person to whom the data refer to request the correction of incorrect or incomplete personal data;

– The right to limit the processing of personal data, namely: – when the accuracy of personal data is contested, data processing will be temporarily limited for a period sufficient to check the accuracy of personal data; – when there is no legal basis for the processing of personal data, and the person to whom the data relates opposes the deletion of data for the purpose of filing or defending legal claims; – when the data is no longer needed by Charge&GO to achieve the purpose of the processing, but the person to whom the data refers has requested it in order to submit, implement or defend a legal claim; – when an objection to the processing is filed, and an assessment is underway as to whether the legal basis for processing by Charge&GO outweighs the interests of that person;

– The right to object refers to the right of the person to whom the data relates to submit to Charge&GO at any time the legality of the processing of personal data established on the basis of the appropriate grounds for processing.

– The right to erasure (“the right to be forgotten”), which can be exercised in the following cases: – personal data are no longer necessary to achieve the purpose for which they were collected or otherwise processed; – the person to whom the data refers revokes the consent on the basis of which the processing was carried out and there is no other legal basis for the processing; – the person to whom the data refer has filed an objection to the processing in accordance with the Law and there is no other legal basis for the processing that prevails over the legitimate interest, right or freedom of the person to whom the data refers; – personal data were illegally processed; personal data must be deleted in order to fulfil the legal obligations of the operator; – personal data are collected in connection with the use of information society services.

– The right to data portability is the right of a person who previously submitted their personal data to Charge&GO, in a structured, commonly used and electronically readable form, as well as the right to transfer this data to another operator without interfering with Charge&GO, provided that the processing is based on consent and that the processing is performed automatically.

9. Ways of exercising rights

The person to whom the data refers can personally or through an attorney exercise all rights related to personal data processed by Charge&GO at the premises of Charge&GO located in Belgrade (Rakovica), 22, Oslobođenja Street, as well as by sending complaints in electronic form to the email address podrska@chargego.rs .

All additional questions related to personal data processing, as well as questions related to the exercise of rights, can be directed to the person for the protection of personal data at the address: podrska@chargego.rs .

The request that is submitted should be legibly and properly filled out and signed, while the request that is submitted through the proxy must also be accompanied by a power of attorney certified by a notary public, which authorizes the proxy to take actions before Charge&GO in connection with the exercise of the rights prescribed by the Data Protection Law.

The signed request for the exercise of the rights of the person to whom the data refers is submitted at the premises of Charge&GO, which will respond to the request without delay and no later than within 30 days from the date of receipt of the complete and correct request, while taking into account the complexity and number of requests. If necessary, this deadline can be extended for another 60 days. Charge&GO will inform the person to whom the data refer about the extension of the deadline and the reasons for that extension within 30 days from the date of receipt of the request.

10. Filing a complaint to the Commissioner for Information of Public Importance and Personal Data Protection

The supervisory body for the protection of personal data in the Republic of Serbia is the Commissioner for Information of Public Importance and Protection of Personal Data, 15, Kralja Aleksandra Boulevard, Belgrade.

The person to whom the personal data refers has the right to file a complaint with the Commissioner if they believe that the processing of their personal data by Charge&GO was in violation of the provisions of the Law. The person to whom the personal data relates has the right to judicial protection if they believe that, contrary to the Law, their rights prescribed by the Law have been violated by the handler or data processor by the action of processing their personal data. Filing a lawsuit in court does not affect the right of this person to initiate other administrative or judicial protection procedures.

 

Information about the personal data handler:

Charge&GO d.o.o. Belgrade (Rakovica), 22b Oslobođenja Street

Phone number: +381 11 715 85 98

e-mail: podrska@chargego.rs

website: chargego.rs

 

Contact details of the personal data protection person

Ana Spasojevic

Email address: podrska@chargego.rs

Phone number: + 381 11 715 85 98