Privacy Policy

This Privacy Policy explains how ENNA Charge d.o.o. (the “Controller”, “we” or “us”) processes personal data in connection with ENNA Charge charging services and/or ENNA Charge app.

This Policy provides the information required under Article 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation or the “GDPR”).

This Privacy Policy applies in addition to the General Privacy Policy of ENNA Group, available at https://www.enna.hr/en/privacy/.

The controller of your personal data is ENNA Charge d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN (OIB): 97052395887

For any questions, inquiries or request related to processing and protection of personal data, you can contact us on email dpo@enna-charge.com.

The categories of personal data processed depend on how you use services provided by ENNA Charge. You may use the service without an ENNA Charge account by paying directly by card, through a registered ENNA Charge app account, including registration or sign-in through Google or Apple, or through an account, application, card or token provided by another e-mobility service provider in a roaming arrangement. Processing may also depend on optional app functions selected by the user, such as location-based functions, QR-code scanning, saved payment methods, notifications, marketing preferences or diagnostics.

Where personal data are not obtained directly from you, they may be received from charging stations and backend charging systems, payment service providers, Google or Apple where you select third-party sign-in or related functionality, roaming platforms and e-mobility service providers, business or fleet-account administrators, app stores, map/location providers, technical service providers and competent authorities, as applicable to the service used.

Providing data marked as mandatory is necessary to enter into or perform the relevant service or to meet a legal requirement. If such data are not provided, ENNA Charge may be unable to create the account, authorise or provide charging, process payment, issue an invoice or provide the requested functionality. Optional permissions and data may be withheld or withdrawn, although the related optional function may then be unavailable.

Depending on how you use the ENNA Charge service, we may share personal data with the following categories of recipients:

• companies within the ENNA Group, where necessary for administration, legal, compliance, financial, accounting, customer support, IT or security purposes;
• cloud, hosting, infrastructure, communication and IT service providers supporting the operation of the ENNA Charge platform and application, including Amazon Web Services and other cloud infrastructure providers;
• payment service providers, payment processors, acquiring banks, card schemes and digital wallet providers involved in processing payments, pre-authorisations, refunds and related payment transactions. Depending on the payment channel used, this may include providers such as Elavon (including payment terminal processing) and Stripe (including online and in-app payment processing);
• providers supporting charging infrastructure management, interoperability and roaming services, including roaming platforms and e-mobility ecosystem participants. Where roaming charging is used, charging-session information may be exchanged with the user's e-mobility service provider and interoperability partners, including Hubject;
• providers of map, geolocation and navigation services used to display charging-station locations or route users to charging stations, including Mapbox;
• identity, authentication, mapping and navigation service providers used in connection with optional application features. Depending on the functionality selected by the user, this may include Google and Apple for sign-in, authentication, map display or navigation services;
• providers of accounting, enterprise resource planning, invoicing and business administration services, including systems used for accounting and financial reporting, including Microsoft Business Central;
• communication, productivity and collaboration service providers, including Microsoft 365 services used for customer communications, internal administration, customer support and operational activities;
• professional advisers, including lawyers, auditors, insurers and tax advisers;
• competent authorities, regulators, courts, law-enforcement authorities or other third parties where disclosure is required by law or necessary to establish, exercise or defend legal claims.

Certain third-party service providers used in connection with payment processing, identity verification, mobile-app distribution, roaming services, mapping services or other functionality may process personal data as independent controllers in accordance with their own privacy policies.

ENNA Charge primarily processes and stores personal data within the European Union and the European Economic Area ("EEA").

Certain service providers used by ENNA Charge may process, access or support personal data from locations outside the EEA. Such processing may occur, for example, in connection with:

• payment-processing services;
• cloud and technology infrastructure;
• map and geolocation services;
• authentication services;
• enterprise productivity and communication platforms;
• technical support, security monitoring, diagnostics or fraud-prevention activities.

ENNA Charge currently uses service providers including:

• Amazon Web Services (AWS), with primary cloud infrastructure hosted in the EU (eu-central-1 region);
• Stripe (privacy policy);
• Elavon (privacy policy);
• Mapbox (privacy policy);
• Microsoft 365 and Microsoft Business Central (privacy policy);
• Google (privacy policy) and Apple (privacy policy), where users choose to use Google Sign-In, Apple Sign-In, Google Maps, Apple Maps or related functionality; and
• Hubject (privacy policy) or other roaming/interoperability providers where roaming services are used.

Some of these providers may process or permit access to personal data from countries outside the EEA, including the United States.

Where personal data is transferred outside the EEA, ENNA Charge ensures that appropriate safeguards are implemented in accordance with Chapter V GDPR. Such safeguards may include:

• an adequacy decision issued by the European Commission;
• the EU-U.S. Data Privacy Framework, where applicable;
• Standard Contractual Clauses approved by the European Commission; and/or
• additional contractual, technical and organisational measures designed to provide an equivalent level of protection.

Additional information regarding international transfers and applicable safeguards may be requested using the contact details set out in this Privacy Policy.

Personal data is retained only for as long as necessary for the purposes for which it is processed, taking into account applicable legal obligations, contractual requirements, regulatory requirements, operational needs and the establishment, exercise or defence of legal claims.

In particular, accounting, invoicing, transaction and related business records containing personal data are retained in accordance with applicable accounting, tax and financial reporting legislation. Under Croatian accounting legislation, such documentation is generally retained for a period of 11 years, unless a longer retention period is required by law.

Personal data relating to charging services, user accounts, contractual relationships, customer support, complaints, debt collection and related activities may continue to be retained after the end of the relevant relationship where necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims. As a general rule, such data may be retained for the duration of the applicable statutory limitation periods, which are generally five (5) years under Croatian law, unless a longer period applies in a particular case.

Where processing is based on consent, personal data may be retained until consent is withdrawn, provided that another legal basis for continued retention does not apply.

After the applicable retention period expires, personal data will be deleted, anonymised or otherwise securely disposed of, unless further retention is required or permitted by applicable law.

More detailed retention information may be provided in relation to specific services, processing activities or categories of personal data where appropriate.

Unless expressly stated otherwise in a separate privacy notice, we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Subject to the conditions and limitations under applicable law, you may have the right to:

• request access to your personal data;
• request rectification of inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability, where applicable;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, please contact the privacy contact indicated above in section “Data Protection Contact”.

If you consider that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In the Republic of Croatia, this is:

Croatian Personal Data Protection Agency | Agencija za zaštitu osobnih podataka (AZOP)
Ulica Metela Ožegovića 16
10000 Zagreb, Croatia
E-mail: azop@azop.hr
Website: https://azop.hr

You may also contact us directly, and we will endeavour to address your concerns.

Appropriate technical and organisational measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

This Privacy Policy may be updated from time to time.

The latest version will always be published on the relevant website and indicated by the “Last updated” date above.