1. Subject of this data protection declaration
The protection of your personal data (hereinafter referred to as "data") is a major and very important concern for us. In the following, we would therefore like to inform you in detail about which data is collected during your usage of our App and how these are processed or used by us in the following. Furthermore, we would like to inform you about the rights you are entitled to and the technical and organisational protective measures we have taken with regard to the processing of your data.
2. Name and address of the data controller and service provider
Responsible in terms of the basic data protection regulation (DSGVO) and at the same time service provider in terms of the German Telemedia act (“Telemediengesetz” -TMG) is IONITY GmbH, Moosacher Straße 84, 80809 Munich, Germany, see our imprint.
You can contact our data protection officer as follows:
Data Protection Officer
Moosacher Strasse 84
D-80809 Munich, Germany
3. General information about data processing
a. Legal basis for the processing of personal data
It is necessary to process personal data in line with the usage of our charging services through the IONITY App. We will only process your personal data in the context of:
- the execution of the contract is subject to Article 6(1)(b) European General Data Protection Regulation (hereafter “GDPR”), in order to offer you our charging services and to provide invoices and payment processes.
- the legal commitment is subject to Article 6(1)(c) GDPR, which for example includes the retention of invoices and contracts.
- the legitimate interest of our company is subject to Article 6(1)(f) GDPR, in order to provide and where necessary improve or adjust the security, availability and capabilities of our charging infrastructure and the corresponding processes.
- your freely given consent is subject to Article 6(1)(a) GDPR covering activities and offers, which exceed the legal basis of data processing (e.g. direct marketing, customer satisfaction surveys).
b. Categories of personal data which will be processed whilst using the IONITY App
Generally, we will process the following personal data whilst using the IONITY App (Download, installation, login/registration, charging, invoicing). Details and process related data will be covered in section B: Details of individual data processing steps.
General data / personal contact information
- Email address
- Personal address data / invoicing address
- Date of birth / age
- Contractual data/ subscription
- Invoicing and payment data
- Bank account data / credit card data
- If applicable, tax number / VAT ID or other tax information
- Contractual history / Usage history
Services and IT (Usage) Data
- Device Code
- Access Data
- Identification Data / IDs
- Telecommunications data / Message content
- Usage and access data / Meta data
c. Special categories of personal data and personal data of children
We will not collect or process any data which falls under the special category for personal data. This includes according to Article 9 GDPR data that specifies racial or ethnical origin, political opinion, religious or ideological beliefs or trade union membership, as well as genetical data, biometric data to clearly identify a natural person, health data or data relating to sexual life or sexual orientation.
Children should not transfer any personal data to us or use the IONITY App without parental or legal guardian consent. The obligatory supervision lies with the legal guardian. We do not knowingly ask for nor process personal data of children.
We utilise processors to help implement our services. Those processors have been carefully chosen and are embedded via contractual obligations for data processing according to Article 28 GDPR. Payment service providers are also obligated to provide a certified PCI DSS Compliance (Payment Card Industry Data Security Standard), which we check on a yearly basis for data processing compliance.
e. Data processing in third party countries outside of the European Union
We will transfer data for data processing to service providers and vicarious agents who are situated in third party countries. We are ensuring contractually that all data protection levels are met. All our service providers in third party countries are processing the data as instructed by us and are bound by contract. We are transferring data to the following third party countries:
- USA: Article 46(2)(c) GDPR covers the adequate data protection levels through Standard contractual clauses (SCC) for data transfers between EU and non-EU countries.
f. Security level for data processing
We as well as our contractually bound processors are utilising the most up to date technical and organisational security measures to protect your data from accidental or deliberate manipulation, loss, deletion or unauthorised access. Those security measures will be continuously improved upon in line with technological developments.
4. Details of individual data processing steps
a. Data processing when downloading the IONITY App
We only offer the IONITY App via Apple App Store (iOS) and Google Play Store (Android).
If you download the IONITY App using an app store the following data will be transferred to the app store: user name, email address, your account number, time of download, payment information and individual device ID. We cannot influence this, and this process is not part of the data processing for the IONITY App but remains with the usage requirements of the relevant app store. For further information please contact the information centre or data protection information of the app store providers:
- Apple App Store: https://support.apple.com/de-de/HT210584
- Google Play Store: https://policies.google.com/privacy
b. Data processing whilst installing and using the IONITY App – technically necessary data and logfiles
The following data will be transferred to us when you install and use the IONITY App on your device:
- Device ID (ID of App (iOS Vendor ID or Android Add-ID [GAID])
- App version (clientApplicationVersion)
- App operating system version (clientOsVersion)
- IP Address
- Date and time of request
- Timezone difference from Greenwich Mean Time (GMT)
- Contents of account (precise page)
- Access status/HTTP status code
- Respectively transferred data volume
- Device type and manufacturer
We collect and process this data in order to ensure the functionality, stability, improvement and security of the IONITY App. The legal basis for the data processing is Article 6(1)(b) or (f) GDPR. We will delete the data as soon as it is not needed anymore for the afore mentioned process. Should we save an IP address, we will delete or anonymise this no later than 7 days. The collection of this data as well as the storage of this data in logfiles is essential for the usage of the IONITY App.
c. Data processing when creating and using a customer account in the IONITY App
In order to use the IONITY App you require a customer account, which can be created in the IONITY App free of charge. The personal data which is required as part of the registration process are:
- Frist Name
- Last Name
- Email Address
- Telephone Number
- Password (encrypted and not readable)
- Optional credit cards or other payment information and, if applicable, tax informations; Those are needed for the charging process.
We require this data in order to execute the contract, to offer you the services of our charging service and to issue invoices. You will be able to change the above information within the IONITY App at any time. IONITY keeps personal data no longer than necessary for the purpose of how they were collected and processed.
It is also generally possible to access our services without registration and without the IONITY App. You can do so by visiting our mobile website on https://payment.ionity.eu .
d. Storage location of customer data
Your customer data will be stored within a cloud environment, which is provided through Amazon Web Services EMEA SARL (‘AWS’) within the European Union (region Frankfurt -Germany).
e. Data processing during a payment process
In order to settle the services (charges) through our IONITY App we require, in addition to your customer account information, your credit card or other payment information. The personal data required depends on the payment method chosen. You can provide this data when setting up your customer account or when you charge your vehicle. This information is mandatory for the payment and invoicing process. There cannot be a charge with the IONITY App with missing payment information.
- Payments: We will securely pass on your credit card or other payment details of your charge to our payment service provider immediately after the conclusion of your charge together with the to be charged amount. We will solely send your payment details for one charge.
- Invoicing: Additionally, we will pass your first name, last name, address, telephone number, email address and, if applicable, tax informations to our invoicing service provider in order to send you an invoice with the relevant legal requirements. The data processing is handled securely and only for one charge.
5. Details of technical data processing
a. Permissions for your device
In order to fully utilise the functionality of the IONITY App, we recommend that you enable the location function of the IONITY App. Through the usage of GPS data and location details from WIFI hotspots and telephone poles we can identify your approximate location to check if you are in the proximity of an IONITY charging station. IONITY can use this information to store and process locations and to improve our services. Should you wish to scan one of our QR-Codes available on our charging stations, we will ask you for permission to utilise your camera. We will ask you for specific permission to access your location or your camera, which you are able to reject. You will be able to utilise the IONITY App without the usage of the location or camera functionality.
b. Cookies and similar technologies
Whilst using the IONITY App and Website, we are using cookies which your device browser and/or the IONITY App have saved short-term (‘Session’-Cookies) or long-term (‘permanent’-Cookies). Cookies are small data sets with information which our server and/or third party servers send to your browser to send them again to our server and/or the third party server during your next visit.
We utilise Google Analytics Firebase (subsequently Google Firebase) to analyse the usage of the IONITY App. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
We are using the following Google Firebase products for the IONITY App: Crashlytics, Google Analytics for Firebase and Cloud Messaging (described in detail under paragraph 3. “Notifications and push services”). These products process different data categories for different intended purposes:
- Google Analytics for Firebase: We process the following data for analytics: device information, information about the utilised IONITY App, data for the usage of the app, locations, user ID and information relating to individual enquiries within the app (events). We utilise the data in order to analyse the interaction of the IONITY App as well as the reactions and execution of the IONITY App and, based on the results, to improve the usability and functionality. The legal basis for processing the data is as per Article 6(1)(f) GDPR. We have a legitimate interest to improve the functionality, logic, appearance and usability of our IONITY App. We do not use Google Analytics Cookies for any additional Google Services.
- Firebase Crashlytics: For Firebase Crashlytics we are using data for the undertaking of the IONITY App, inclusive of the type of used operating system, information about disruption during operations (type of disruption, time of disruption, duration of disruption, utilisation of the IONITY App at the time of the disruption) and device information. On the basis of this data, we are able to efficiently correct errors and promote IONITY App stability when noting disruptions or problems with the operations of the IONITY App. The processing of the data is subject to Article 6(1)(f) GDPR. We have a legal basis to identify and rectify stability problems which impact the quality of the IONITY App. This results in increased usability for our customers.
c. Notifications and push services
After you have completed the registration with IONITY, we are able to provide you with different notifications types and content. We distinguish between mandatory and optional notifications.
Mandatory notifications are notifications, which are utilised for verification, security and transparency of service fulfilment.
- to verify your account during the registration process
- to communicate with you during support and clarification cases.
- to provide digital invoices and receipts.
SMS (Short Message Service)
- One time usage during the registration process to verify your phone number.
Push notifications in the IONITY App
- Account, tariff, availability and security information as well as IONITY App related information about new or changed functions as well as updates.
Optional notifications are notifications which improve the usage of our services or inform you about general offers and publications. In order to be notified about the progress of the charging process, you will have the option to receive push notifications through the IONITY App. We will ask for your consent as part of the installation / initialisation of the IONITY App, which you can refuse at any time. You will also be able to deactivate those settings within the notification settings of your device.
Furthermore, we are offering as part of the registration and usage of our IONITY App optional notifications which will inform you outside of the usage of the IONITY App about relevant developments with IONITY (e.g. the opening of new stations) or special offers, marketing campaigns and news. We will only send you those optional notifications if you have given us your consent (marketing consent) as part of the registration of your customer account.
We are using Amazon Simple Notification Service and Amazon Simple Email Service for email and SMS services provided by Amazon Web Services (subsequently AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg.
- Amazon Simple Notification Service: This service is being used to verify your phone number during the creation of your IONITY customer account through a SMS message. We will delete your phone number immediately after the completion of the verification process.
Further data protection information about this service is available on the following link: https://docs.aws.amazon.com/de_de/sns/latest/dg/sns-data-protection.html
- Amazon Simple Email Service: We will use this service to send automated emails to you.
You will find further information about the data protection policies of services from Amazon Web Services through the following in link: https://aws.amazon.com/de/compliance/germany-data-protection/
App internal messages and push notifications are provided by Google Firebase Cloud Messaging. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.
- Firebase Cloud Messaging: Firebase Cloud Messaging allows us to send you targeted and context relevant message in order to keep you up to date and to encourage you to utilise the IONITY App. We process information for subject, type of message, time of sending the message and if and when the message was received and read. We partially use this data in the context of analysis.
d. Map services
Apple Maps (iOS)
For the purpose of displaying maps within our IONITY App as well as being able to show nearby IONITY charging stations (it is required to access your location data through the GPS function on your mobile device) we are using Apple Maps, a service of the Apple Inc. (Infinite Loop, Cupertino, CA 95014, USA, ‘Apple’). For the usage of our IONITY App we will send Apple information that you are using the IONITY App as well as information about the usage of the map functionality. Should you be logged in with Apple, this information will be allocated to your Apple user account. Should you not wish to utilise this functionality, you will need to log out of your Apple account before using the IONITY App. The legal basis for the processing of data is Article 6(1)(f) GDPR. We are not able to influence the data collection and processing of Apple.
You can find additional information about the data processing through Apple on their data privacy notice, which can be found here: https://www.apple.com/de/privacy. .
Google Maps (Android)
For the purpose of displaying maps within our IONITY App as well as being able to show nearby IONITY charging stations (it is required to access your location data through the GPS function on your mobile device) we are using Google Maps, a service of the Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ‘Google’). For the usage of our IONITY App we will send Google information that you are using the IONITY App as well as information about the usage of the map functionality. Should you be logged in with Google, this information will be allocated to your Google user account. Should you not wish to utilise this functionality, you will need to log out of your Google account before using the IONITY App. The legal basis for the processing of data is Article 6(1)(f) GDPR. We are not able to influence the data collection and processing of Google.
You can find additional information about the data processing through Google on their data privacy notice, which can be found here: https://policies.google.com/privacy .
6. Rights of the data subject
a. Your rights
As per Article 15 GDPR you have the right to be informed with clear and concise information about what we do with your personal data and you have the right to ask us to access your personal data we process about you. As per Article 16 GDPR you have the right to ask us to rectify inaccurate personal data or complete them if they are incomplete. As per Article 17 GDPR you have the right in certain circumstances to ask us to erase your personal data (“Right to be forgotten”). As per Article 18 GDPR you have the right to ask us to restrict the processing of your data. As per Article 20 GDPR you have the right to ask to ask us to receive the personal data which you have provided to us in a structured, commonly used, and machine-readable format and you have the right to ask us to transmit those data to another controller without hindrance. With regards to the right of information the restrictions of § 34 of the German Federal Data Protection Act applies and for rights of data deletion § 35 of the German Federal Data Protection Act applies.
If we process your data because of legitimate interests according to Article 6(1)(f) GDPR or for the performance of a public task according to Article 6(1)(e) GDPR and there are legitimate reasons against this processing due to your particular situation, you have the right to object to this processing as per Article 21(1) GDPR. In the event of an objection, we will no longer process your data for these purposes unless we can demonstrate compelling legitimate reasons for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
You have a right to object without restrictions to any form of processing your data for the purpose of direct marketing, according to Article 21(2) and (3) GDPR .
Provided we process your data on the basis of having received your consent, you have the right to revoke your consent at any time. Your data will then no longer be processed for the purpose of your consent. Please note, that the legal basis of data processing, which happens before the revocation, is not affected by the revocation. On how to explain the individual revocations, please refer to the aforementioned information or information of the individual consent.
b. Complaint with the regulating authority
To exercise your rights, please contact: firstname.lastname@example.org.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you is in breach of the GDPR (Art. 77 DPA).
In Bavaria the competent supervisory authority is Bavarian State Office for Data Protection Supervision, Postfach 606, 91511 Ansbach, www.lda.bayern.de.
7. Version and updates of this privacy statement