1.Introduction – about this Policy
We respect your privacy in our websites and applications. Below you will find the general rules under which we process information about people who use our services or contact us, referred to as personal data. This privacy information explains, among other things, who the controller of your data is, what information we collect and why, and what rights you have in connection with its processing.
References to the “GDPR” in this Policy mean the General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
A change to the Policy (in whole or in part) may result, among other things, from the need to adapt to changes in the law, privacy standards, the extension of services or other changes (e.g. technological and functional), including updates to the website. Editorial changes aimed at clarity or completeness of information may also be a reason for changing the Policy.
2.Data controller
Who is the data controller?
The entity deciding how your personal data will be used (for what purposes and by what means) is:
Data controller: EcoStation P.S.A. (EcoStation Prosta Spółka Akcyjna), ul. Dobrego Pasterza 120C/4, 31-416 Kraków, Poland, KRS 0001101713, NIP 9452290691, REGON 528427014.
Contact us
By email: [email protected] or by post: EcoStation P.S.A., ul. Dobrego Pasterza 120C/4, 31-416 Kraków, Poland – you can contact us on all matters concerning the processing of your personal data (to exercise your rights related to data processing or to obtain more information about it).
3.Your rights
With regard to the processing of personal data, under the General Data Protection Regulation (GDPR) you have the following rights:
- The right of access to your personal data and to obtain a copy of it – the controller provides information about the processing of personal data, the purposes, the scope of data held, the legal bases for processing, disclosures and the planned date of data deletion, and also enables you to obtain a copy of the data.
- The right to request rectification of data – you exercise this right when you notice that your data is inaccurate or incomplete.
- The right to erasure of personal data – you exercise this right when: the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent to processing or raise an effective objection to it; the processing is unlawful.
- The right to restriction of processing – when you notice that the data is inaccurate and request restriction of processing for a period allowing the accuracy of the data to be verified; if the processing is unlawful but you want to replace erasure with restriction of processing; if the controller no longer needs your personal data but you need it to establish, exercise or defend legal claims; pending verification of whether the controller’s legitimate grounds override the grounds of your objection.
- The right to data portability – to the extent that your data is processed on the basis of consent or for the conclusion and performance of a contract.
- The right to object – an objection, justified by your particular situation, to the processing of data on the basis of a legitimate interest (Article 6(1)(f) GDPR).
- The right to object for marketing purposes – an objection to direct marketing, including profiling, which does not require justification.
- The right to human intervention, to express your point of view and to contest an automated decision taken about you – applicable where the controller would take a so-called automated decision producing legal effects concerning you or similarly significantly affecting you.
- The right to withdraw consent – you may exercise it at any time if your personal data is processed on the basis of your consent; this does not affect the lawfulness of processing carried out before its withdrawal.
- The right to lodge a complaint with a supervisory authority dealing with the protection of personal data – in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
How EcoStation handles your rights
To exercise your rights or obtain additional information, use the contact details given above and, for individual services, the online tools available in the service.
If you decide to contact us, when handling your request (including to maintain appropriate security measures) we may ask you for the necessary verification information or for an additional action (e.g. logging in to your Account and using the available option).
Your EcoStation account
With regard to your EcoStation user account, log in and go to the options available in the Billing details tab, where you can edit, add or delete your data. Instructions for deleting your account are available on the Account deletion page.
Managing cookie consent
With regard to the processing and collection of cookies – registration and then logging in to the application constitutes consent to their processing. If you want to withdraw consent, simply send an email to [email protected] requesting withdrawal of consent, or delete your account in the mobile app. The use of cookies on the ecostation.io website is described in the Cookies section.
4.Where do we get your data from?
What data does EcoStation process?
The scope of your personal data that we process differs between individual services or functionalities (it depends on which of them you use). Detailed information is provided when you register for a given service, activate it or in its terms. In particular, this is data provided directly by you, resulting from:
- communication with EcoStation – contacting us requires providing a return address / contact details (e.g. the email of the person submitting a request); we process the data necessary to conduct the correspondence and to handle or verify the request;
- communication about changes at EcoStation – we may inform you, using your contact details, in particular about any provisions, terms and notices concerning our relationship with you (and changes to them), especially in order to fulfil legal obligations or our commitments to you – e.g. to inform you about an important change in the terms of a service;
- registering, completing and editing an Account – in the account registration form on the EcoStation service, providing the necessary data (completing a required field such as email, password, mobile phone number) is required to conclude and perform the contract (with the content of the terms you accept); the Account also allows you to complete your data for full use of the service (address data, vehicle data or invoicing data);
- simplified registration – providing (assigning) data to the extent necessary to use an account in our service (login and registration), resulting from the option of logging in through external authentication services (e.g. Google or Apple ID); this may concern in particular: email, avatar or its URL, user name (first name / surname) and sometimes other indicated data. When using external authentication services, you should read the terms and personal data processing rules of the entities offering such services;
- using the Account or the service – when using the Account / service you may voluntarily provide us with other optional data or data required for a specific functionality, and we may also collect information about your activity in the services – websites, the application (e.g. pages visited, clicks, duration of the visit, content presented on the pages or in the app) or other information resulting from providing the service’s functionality for logged-out or logged-in users (e.g. the history of your charging services, fault reports added to the service); this applies to notification subscriptions and filling in the forms of our services;
- participation in a programme (loyalty, partner, buyer protection or other) – participation in a programme organised by EcoStation may require the processing of registration or other data; more detailed processing rules may be set out in the dedicated terms of those programmes;
- our right to pursue claims or defend against claims – in justified situations, where the claims have not become time-barred under applicable law (the scope of data depends on the subject of the claim);
- participation in a competition or promotional campaign – detailed information on the scope of data and its processing is provided at the specific event or in the terms of the competition or promotional campaign (depending on their type, this may be e.g. first name and surname, contact details, email, or any other data necessary to meet the participation criteria or to award / deliver the prizes);
- marketing, analytical and statistical activities – you can expect processing, based on a legitimate interest (ours or our partners’) or on your consent, of information that helps us match advertisements and content to your preferences and expectations (including data from cookies, information about your traffic on the site, IP address). It may also be processed by creating comparisons or summaries resulting from the activity of other users and then analysed for analytical, statistical and marketing purposes (for example, we may suggest popular charging stations or advertisements matched to how you use the service);
- technical matters and the implementation of the cookie policy – we may also process information that may be considered your personal data (e.g. IP address, mobile device identifier or other online identifier) using technologies such as cookies, tracking pixels, locally shared objects (e.g. in the browser or on the device and in its cache) and those that may be automatically generated by the device / browser (e.g. device type, browser version and user agent) and recorded for technical reasons during your activity on the websites and in the app (together with automated analysis of such activity), necessary due to the nature of the services provided electronically, the purposes described in the Policy and legitimate interests.
Providing personal data may be a statutory requirement – e.g. to the extent that you are the winner of a competition or promotion and receive a prize that requires tax settlement. Apart from a statutory obligation or necessity for the conclusion and performance of a contract, providing personal data is voluntary and may result from the consent given.
5.What are the purposes of processing?
Legal bases and purposes of our processing
The scope of your personal data that we process differs between individual services or functionalities (depending on which of them you use). Detailed information is provided when you register for a given service, activate it or in its terms / contract.
Contract / terms
We process your data to the extent necessary to perform the contract concluded with us for the provision of a given service (e.g. based on the terms of the service or additional terms). For example, registering an account in our service authorises us to process the data provided during registration or completed through it, necessary to provide the services and functionality of the service for logged-in / registered users. Failure to provide such data makes it impossible for us to conclude or perform the contract – we could not provide you with the service and you could not use it.
The processing of EcoStation service user data related to the performance of the contract covers the purposes and services resulting from the terms – enabling the use of the service and its services provided electronically, creating and managing an account together with enabling the monitoring of orders and their history, enabling the conclusion and execution of transactions (enabling payment for transactions carried out), enabling the posting of opinions in the service, participation in programmes (based on additional terms), contacting you for purposes related to the provision of services and handling requests concerning the service.
Lawfulness of processing: Article 6(1)(b) GDPR.
Legitimate interest
On the basis of a so-called legitimate interest, we may process your data in order to:
- ensure the security of the service and of other people using the services / service (including internet traffic and IT resources), and enforce the provisions of the contract / terms (e.g. counteract abuse, fraud, breaches of good practice, flood / spam phenomena, dishonest product promotion). If necessary for the above reasons, data sent to the server by web browsers or your devices that allows a unique digital “fingerprint” of devices or application instances to be created, such as technical elements of the device, browser settings and detailed information about your behaviour in our service, may be used – e.g. to prevent abuse and fraud or for additional authentication;
- carry out statistical measurements and analytical activities – data used to analyse activity, especially related to managing internet traffic, the popularity of searched keywords or categories in the service and statistical analysis, developing general aggregate statistics on the use of the service, as well as demographic information, purchasing preferences or improving the functionality and quality of our services or the content of the service – also to adapt them for the convenience of users (e.g. personalisation or other suggestions of services or content);
- conduct marketing activities, including adapting services, content and the service – consisting of: promoting our own activities or the activities of third parties (direct marketing, also on behalf of advertisers), in particular by displaying marketing content and advertisements (including those consistent with content previously viewed on the pages you visited, matched to product categories or individual offers, taking into account the account settings in the EcoStation service if registered); taking actions necessary for us so that the service and its content are interesting to you or relevant to your activity in the service; notifying you about new or changed services and functionalities, signalling partner promotional campaigns or programmes or competitions in which you can take part (including organising our own loyalty programmes and competitions);
- receive and handle requests and enquiries sent to our contact details or initiate correspondence, which covers needs such as: solving technical problems, administrative interventions in the service’s functionality or content added through its forms, examining and pursuing claims, defending against claims, debt collection, conducting court, arbitration and mediation proceedings.
Lawfulness of processing: Article 6(1)(f) GDPR.
Legal obligation
Where processing is necessary to fulfil a legal obligation incumbent on us – required by law (e.g. provisions related to tax or accounting purposes, the complaint procedure).
Lawfulness of processing: Article 6(1)(c) GDPR.
Your consent
Processing data with your consent is always voluntary (not giving it will not deprive you of access to our services) and takes place for the purposes and to the extent indicated in the consent (we provide detailed information when asking for consent). A request for your consent may also result from applicable law (e.g. the Act on the provision of services by electronic means or telecommunications law).
Lawfulness of processing: Article 6(1)(a) GDPR.
6.Retention period
How long do we plan to process your data?
We process personal data for as long as a legal basis for its processing exists:
- performance of a contract – where data is necessary for the performance of a contract, for the duration of its performance and until the limitation period for claims under that contract expires, which, depending on the situation defined by law, may be 3 years (counted until the last day of the calendar year following the expiry of 3 years from the end of the provision of the service) or no longer than 6 years from the end of the calendar year in which the event that may constitute the basis for claims occurred. The 6-year period, where applicable, is extended to the end of the calendar year in which it expires – in accordance with Article 118 of the Polish Civil Code (e.g. if it expires on 1 June of a given year, the limitation period is extended to 31 December of that year). The period starts on the day the claim becomes due;
- legal obligation – where required to meet a legal requirement, e.g. for tax and accounting purposes, to the extent and for the time consistent with applicable law. For example, when running a competition or programme that we organise, we may process data for its duration and for the relevant tax settlements. Meeting statutory obligations under tax and accounting regulations may require processing data for, e.g., 5 years, counted in accordance with the regulations (e.g. from the end of the calendar year in which the tax payment deadline expired, or from the beginning of the year following the financial year in which the transaction took place);
- legitimate interest – where the basis for processing is the controller’s legitimate interest, until you stop using our services or until you raise an effective objection to the processing of personal data; where it consists in protecting the Company’s rights (pursuing claims and defending against claims under the contract / related to the provision of services, including debt collection, court, arbitration and mediation proceedings), until the last day of the calendar year following the expiry of 3 years from the end of the provision of the service;
- consent – where consent has been given, until it is withdrawn, restricted or otherwise limited by your actions.
Detailed information may be provided for a specific service.
7.Data recipients
Recipients and transfers of your data
Your data may be transferred by us to:
- entities processing personal data on our behalf (the controller’s), in accordance with our purposes and instructions (based on an agreement with the controller) – these may be IT service providers / partners, entities providing technical or organisational support, other subcontractors for data storage, payment services, debt collection, analytics, customer service, marketing, etc.;
- entities processing personal data in their own name (a controller separate from us and processing your data independently), e.g. third parties to whom you decide to disclose your data, with whom we cooperate or for whom we are partners, including marketing partners or social media entities.
On the basis of your voluntary consent (and sometimes also on the basis of the controller’s legitimate interest), data may be shared with partners we cooperate with or whose services we use when processing the information described in the cookies section (so-called trusted partners).
On the basis of applicable law and to the extent permitted by applicable law, we may disclose data to:
- entities (public authorities) entitled to obtain it (such as law enforcement authorities, in connection with proceedings concerning possible violations of the law or combating other possible violations of the terms, including fraud);
- institutions dealing with debt collection and trading in receivables.
Transfers of data to countries outside the European Economic Area
Your personal data will be transferred outside the European Economic Area, among others to Google LLC, including in connection with the use of the reCAPTCHA mechanism to ensure security – preventing certain functions of the service from being performed in an automated manner by internet bots.
Your personal data may be transferred outside the European Economic Area (e.g. where our partners are established outside the EEA). EcoStation relies on mechanisms ensuring an adequate level of protection or appropriate legal safeguards, including the use of contractual clauses for the transfer of personal data to entities established in third countries, approved by the European Commission. Copies of such clauses can be obtained by sending a request to the above contact details.
8.Marketing activities
As part of our marketing activities, EcoStation P.S.A. may process your personal data in order to:
- send commercial and marketing information, including: notifications about new features, products, services and promotions; information about competitions, loyalty programmes and promotional campaigns we organise;
- personalise marketing content and adapt it to your preferences, including: selecting advertisements based on your activity in the service, data from cookies or similar technologies and your history of using the services; creating user profiles for marketing purposes in order to better adapt our content to your expectations and needs;
- analyse the effectiveness of marketing activities, including statistical and analytical research.
Legal basis for processing data for marketing purposes
- your consent (Article 6(1)(a) GDPR), if you have given it, e.g. by ticking the appropriate box in the contact form;
- the controller’s legitimate interest (Article 6(1)(f) GDPR) in marketing its own products and services, provided this does not require additional consent.
Marketing communication channels
Your data may be used for marketing activities through:
- email (newsletters, marketing emails),
- SMS messages,
- notifications in the mobile app or on the website,
- telephone contact (if you have consented to such contact).
Profiling for marketing purposes
Your personal data may be used to create profiles that help to better adapt advertising content to your preferences and interests. Profiling is based on data about your use of our services (e.g. browsing history in the service, clicks on advertisements, purchase history), demographic data and data from cookies. Profiling does not produce legal effects and does not similarly significantly affect you.
Your rights in connection with marketing activities
You have the right to:
- withdraw consent to the processing of data for marketing purposes at any time, without affecting the lawfulness of processing carried out before its withdrawal;
- object to the processing of data for marketing purposes, including profiling, without having to give reasons;
- exercise the other rights set out in the “Your rights” section of this Privacy Policy.
Withdrawing consent and opting out of marketing activities
If you do not want to receive marketing messages from us, you can at any time:
- click the unsubscribe link in the email,
- send a request to [email protected].
Processing of data through cookies for marketing purposes
Your personal data may be processed using cookies and similar technologies that allow us to tailor advertising content to your preferences. You can find more information in the Cookies section.
Sharing data for marketing purposes
Your personal data may be transferred to our marketing partners and trusted suppliers who support us in carrying out marketing activities, on the basis of appropriate agreements ensuring the protection of your personal data.