• Charging programs
  • Companies
  • Households
  • Cities
  • Dashboard
  • About us
  • Client Zone

Privacy policy

In connection with the provision of our products and services related to electromobility, we collect and use personal data of potential customers, Customers, app users, newsletter subscribers and other natural persons (hereinafter only as the "Customers"). We want our Customers to know what kind of data we use, what we do with it, who we provide it to and to have them understand their rights, via which they can inspect the processing of their personal data.

This document contains information on conditions of processing personal data of Customers in line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) and the Act No. 18/2018 Z.z. on protection of personal data and on amendment of certain acts.


1 BASIC TERMS

We believe that more information means a better understanding of the rules to process personal data. In the following section, you can therefore find the explanation of the most important terms used in connection with the protection of personal data.

Personal data - Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data subject – Identified and/or identifiable natural person, to whom the personal data applies. Data subjects are all ZSE Customers – natural persons (including self-employed entrepreneurs).

Controller – Subject that specifies the conditions of processing personal data and is liable for the processing of personal data.

Processor – Subject that processes personal data on behalf of the Controller. The Controller shall be entitled to appoint the Processor with the processing of personal data without the consent of the Data Subject, whereas he anyhow has to make sure that the Processor provides sufficient guarantees to ensure the compliance of the processing with GDPR.

Processing – Operations / activities conducted with personal data, such as collecting, recording, managing, structuring, retaining, changing / amending, searching, viewing, using, transferring, providing and otherwise disclosing, regrouping or combining, limiting, deleting and liquidating, regardless of whether it is done automatically or manually.

Profiling - Any form of automated processing of personal data, comprising of the use of such data to assess personal aspects related to a natural person, particularly analysing and/or presuming aspects of natural person data subjects related to their assets, personal preferences, interests, reliability, behaviour, position and/or movement.


2 RESPONSIBILITY FOR PERSONAL DATA PROCESSING

Západoslovenská energetika, a.s., with the situation of the registered office at Čulenova 6, 816 47 Bratislava, CRN: 35 823 551, registered at the Companies Register of the City Court Bratislava III, Section: Sa, File No.: 2852/B (hereinafter only as “ZSE” or “we” in the respective grammatical form), www.skupinazse.sk, processes personal data of Customers to the extent and subject to terms and conditions specified in this document and as the data controller is liable for their protection and processing. Unless otherwise stated in legal regulations, ZSE is also responsible for the processing of personal data by processors appointed by ZSE for this purpose.


3 CONDITIONS FOR PERSONAL DATA PROCESSING

3.1 PERSONAL DATA CATEGORIES

Depending on the specific purpose of processing and the legal basis, we process the following personal data categories (specific extent of personal data used for the specific purpose is indicated in Clause 3.2):

a) Identification data (given name, surname, academic decree, date of birth, CRN, register details);

b) Contact data (residence / registered office, mailing address, phone number, email address);

c) Bank account details;

d) Information on the charging card (holder, card ID);

e) Information on the vehicle for which the charging card was issued (brand, model, type, registration year, licence plate);

f) Information on the use of products and services, particularly the type of used products and how these are used (e.g. information on the place, duration and time of charging, provided contractual performances);

g) Further data provided by the Customer in connection with using the products and services or solving Customer requests;

h) Client zone credentials (email, password);

i) Information on the user’s activity in the Client zone (user preferences and interests);

j) Information on the Customer’s interactions and feedbacks (viewing a specific offer, showing

interest in a specific product, product experience, requests, complaints);

k) Audio recordings of calls;

l) Further data necessary to fulfil legal requirements and justify, exercise and prove legal claims.


3.2 LEGAL BASIS AND PURPOSE OF USING PERSONAL DATA

We use personal data of our Customers, if inevitable, to perform the contract, or in pre-contractual relations, if their use is ordered by applicable laws, if it is necessary to protect our justified interests, or if the Customer granted us valid consent.

The processing of data based on consent is specific as it is voluntary, which means that the Customer as the data subject may recall it any time. In such case, we stop processing personal data and if there is no legal basis for their use or retention, we discard them without undue delay.

The use of personal data to perform the contract, or in pre-contractual relations is a contractual requirement. If we do not have personal data in the required extent (particularly to verify the identity and gather data required for the performance of the Contract), we are unable to conclude a Contract.

We want to protect certain interests important for the proper provision of our business activities (e.g. collect outstanding payments, defend any other legal claims), whereas we use Customer personal data for these purposes. We are always mindful of not making our justified interests inadequate. If, despite this, our Customers fear that the processing prevails over their basic rights and freedoms, they are free to object to it.

We process personal data and provide them to other subjects also in case of legal requirements under applicable laws.

Acquired personal data can subsequently be processed for statistical purposes in a manner compatible with the original purpose, whereas ZSE shall ensure that personal data are only used to the necessary extent, or that only information which is not deemed personal data is processed.


3.2.1 Contract performance and pre-contract relations

ZSE also processes personal data within pre-contractual relations (e.g. sending contracts, handover protocols and other documents, if the Customer shows interest via the contact form, email, or phone, or the provision of additional information to products and services, to conclude, amend and terminate contracts under applicable laws, supply goods and provide services depending on the subject of the contract, use of ZSE apps, registration in the Client zone on www.zsedrive.sk, billing, handling the Customer’s requests and communication with the Customer in other matters.

We process personal data specified in Clause 3.1, Sub-clauses a) through h) for this purpose. The extent of the processed data is based on the respective contractual and other documents. The duration of the processing is limited by the term of the respective contractual relation. After the term of the Contract, personal data are kept and processed to comply with legal requirements and our justified interests in line with the Rules and Plan of Company Records and Administration for up to 10 years from the termination of the contractual relationship, unless a justified need to keep data for longer arises in the future (e.g. due to ongoing legal dispute or other proceedings). Personal data will only be used to fulfil purposes of processing lasting after the termination of the contractual relationship and we will not use them in any other way.


3.2.2 Legal obligation

Within the performance of obligations under applicable laws, we process personal data (including their provision to other subjects) particularly for the following purposes:

− resolving legal disputes (Act No. 160/2015 Z.z. Civil Dispute Code, Act No. 162/2015 Z.z. Administrative Court Proceedings Code and related regulations),

− disclosure of information for purposes of criminal proceedings (Act No. 301/2005 Z.z. Criminal Code, Act No. 171/1993 Zb. on Police Force and related regulations),

− disclosure of information required for the evaluation of the state of facts (Act No. 160/2015 Z.z. Civil Dispute Code and related regulations),

− alternative resolution of consumer disputes (Act No. 391/2015 Z.z. on Alternative Resolution of Consumer Disputes),

− resolving distrainment (Act No. 59/2018 Z.z. Distrainment Code),

− bankruptcies and restructuring (Act No. 7/2005 Z.z. on Bankruptcies and Restructuring),

− registry administration – recording, creation, storage, protection of registry records, access

to them and ensuring of their elimination (Act No. 395/2002 Z.z. on Archives and Registries),

− resolving administrative proceedings (Act No. 71/1967 Zb. Administrative Procedure Code

and related regulations),

− offence proceedings (Act No. 372/1990 Zb. on Offences and related regulations),

− handling complaints (Act No. 250/2007 Z.z. on Consumer Protection),

− handling data subject requests to exercise rights under GDPR and the Act,

− notification of infringement of personal data protection under GDPR and the Act,

− processing of accounting documents (Act No. 431/2002 Z.z. on Accounting, Act No. 222/2004

Z.z. on Value-Added Tax),

− tax administration (Act No. 563/2009 Z.z. Tax Procedure Code, Act No. 595/2003 on Income

Tax),

− fulfilment of applicable legal or regulatory requirements in special cases under applicable

laws.

For this purpose we use personal data categories as per Clause 3.1, Sub-clauses a) – g), k) and l). The exact scope of personal data is derived from applicable laws and specific situation.

Time of personal data processing is based on applicable laws. If there is no justified need to retain the data over a longer period in the specific case, they are retained for no longer than 10 years from the termination of the contractual relation.

Personal data are provided to state bodies and other authorised entities under applicable laws. These are especially courts, lawyers, distrainors, notaries, trustees in bankruptcy, law enforcement bodies, tax administrator, district courts, Office for Personal Data Protection of the Slovak Republic, Slovak Trade Inspection, Ministry of Interior of the Slovak Republic.


3.2.3 Justified interest

Justified interest is the basis for processing personal data if we follow certain interests crucial for us, whereas the personal data processing is required to protect and perform these interests. As prior consent is not required to process Customer data, such personal data processing has to be done in an adequate manner, which the data subjects can expect in connection with relations towards ZSE and in a manner that prevents excessive interference with interests and basic rights of data subjects.

You have the right to object to the processing of data for purposes of justified interests. In that case we may still process your personal data only if we prove necessary justified reasons for processing which prevail over your interests, rights and freedoms.

ZSE processes personal data for purposes of justified interests, which are:

− protection of property and property rights,

− proving the compliance with legal and contractual obligations,

− ensuring and improving the quality of services,

− Customer care,

− building relationship with the Customers and increasing Customer satisfaction.

For these purposes, personal data are processed in the following cases:

− Recording of data subject requests to exercise their rights. Personal data categories as per Clause 3.1, Sub-clause a) – b), g) are processed for 5 years from when the request was handled.

− Exercising, defending and proving legal claims (e.g. to recovery of receivables, compensation for damage). Scope of processed personal data categories as per Clause 3.1, Sub-clause a) – g). Retention period depends on legal periods of limitation. If there is no justified assumption of longer retention in the specific case, data are liquidated after the expiration of 10 years from the termination of the contractual relationship.

− Records of incoming and outgoing mail. Scope of processed personal data categories as per Clause 3.1, Sub-clause a) – b). Retention period is 5 years from when the mail was received or posted.

− Administration and records of contracts and other agreements. Scope of processed personal data categories as per Clause 3.1, Sub-clause a) – e) depending on the document. Data are retained no longer than 10 years from the contract termination.

− Direct marketing - sending information on offers on own goods and services in cases when there is the assumption that such information is interesting to the Customer, as he/she has been using a similar product or service. Direct marketing can only be done by means of mail or email (not via phone), whereas Customers are entitled to object it any time. In case of objections, personal data shall not be further used for direct marketing. Scope of personal data to be processed: Given name, surname, residence / registered office, mailing address, email address, information on used products. Personal data are retained no longer than the contractual term (meaning we do not apply direct marketing to former Customers).

− Customer satisfaction surveys regarding products and services, and their evaluation in order to increase the quality of services and Customer satisfaction in cases when Customers—due to their contractual relationship with ZSE—may reasonably expect that they will be contacted (e.g. new Customers who recently complained, started using a new product or service or used some of the benefits offered by the service or product). Scope of processed personal data categories as per Clause 3.1, Sub-clause a), b), f), g). Data are retained for the duration of the contractual relationship.

− Statistical purposes. Personalised data and data regarding the contractual relationship with ZSE are processed only in justified cases and in the necessary extent, and statistical outputs do not contain personal data. Data are processed during the preparation of statistical data.

− Answering user reactions via social networks. Name of the user account is processed (name, surname). ZSE does not retain these data.

− Sending greetings and other non-marketing information on special occasions, such as important holidays, name day, birthday. Scope of personal data processed: name, surname, day and month of birth, email address. Personal data are processed for the duration of the contractual relationship.

− Organising competitions for Customers, their evaluation and announcement of results. Scope of processed personal data categories as per Clause 3.1, Sub-clause a), b). Exact scope of data may differ depending on the type of competition. Personal data will be processed until the evaluation of the competition and announcement of results. Personal data of winners who will take over their prizes are further processed for purposes of contract performance (see Clause 3.2.1) and fulfilment of legal obligations (see Clause 3.2.2).

− Identification and resolution of anomalies in processes and systems concerning the Customer. Scope of processed personal data categories as per Clause 3.1, Sub-clause a), b), d), f) and h). Personal data are processed for the duration of the contractual relationship between the Customer and ZSE.


3.2.4 Consent to process personal data

Consent to process personal data is required if processing cannot be done under one of the aforementioned legal bases. The Customer, in his/her position of a data subject, may express his/her consent by various means, particularly in writing, verbally or by electronic means (e.g. ticking a web form field).

The consent is particularly characterised by the fact that it has to be free (you cannot force the data subject to grant consent) and voluntary. Voluntary means that the granted consent may be recalled at any time in a manner equally simple as granting it was (which does not mean that it has to be the same manner). If the consent is recalled, personal data cannot be further processed and have to be discarded (under the assumption there is no further purpose for processing based on a different legal basis). The recall of the consent has no effect whatsoever on the legality of processing prior to the recall of the consent.

ZSE processes personal data of Customers under granted valid consent for the following purposes:

− Informing on news in the field of electromobility by means of an electronic newsletter. The newsletter can contain also advertising information on own ZSE products and services (new products, advertising campaigns, special offers, discounts, bonuses).

Newsletter subscribers are only provided with general information, without specific individual consideration of their preferences. Scope of personal data to be processed: Email address. Data are retained during the term of the valid consent, which is granted for 2 years,

− Informing on ZSE’s own products and services (marketing campaigns, special offers, discounts, bonuses) via mail, phone or email. Customers are only provided with general information, without specific individual consideration. Scope of processed personal data categories as per Clause 3.1, Sub-clause a) and b).

− Informing on ZSE’s own products and services (marketing campaigns, special offers, discounts, bonuses) tailored to the Customer’s individual interests based on analysis of information on the use of products and services, preferences and interests of the Customer (e.g. viewing of a certain offer, showing interest in a products, etc.). Scope of processed personal data categories as per Clause 3.1, Sub-clause a), b), f), i), j).

− Analysis of Customer experience with ZSE products and services and its evaluation in order to optimise and increase the quality of provided services and Customer satisfaction. Scope of processed personal data categories as per Clause 3.1, Sub-clause a), b), f) and g). Personal data are retained for the duration of the valid consent.


3.3 SOURCE OF PERSONAL DATA

ZSE collects personal data particularly from Customers in their position of data subjects, from public authorities and other subjects specified in Clause 3.2.2., as well as publicly available sources. If personal data are to be collected from another natural person, we require previous written consent of the data subject, save for cases when applicable laws specify otherwise.


3.4 AUTOMATED DECISIONS, PROFILING AND COOKIES

We do not make automated individual decisions including profiling without human intervention which would have any legal effects or other significant impact on the Customers.

ZSE-operated websites (www.zsedrive.sk, www.kdenabijat.sk and others) use cookies. Cookies are files stored by the server in the browser of the device of the visitor when entering a website or using the website (hereinafter only as “cookies”). Cookies enable e.g. the collection of data on the use of websites, data on selections, preferences and website settings made by visitors. You can find more information in the conditions for using cookies on the respective websites.


3.5 PERSONAL DATA TRANSFER

Transfer of personal data to third countries (outside EU/EEA) will only take place if according to the decision of the Commission (EU) the third country provides adequate protection or the controller and/or processor who imported the data offered adequate guarantees of personal data protection (e.g. through standard clauses on data protection).


 4 DATA RECIPIENTS

 Personal data of our Customers are provided to processors who were authorised by us to process them on our behalf. These are particularly ZSE Group companies (www.skupinazse.sk), printing companies, call centre service providers, consulting companies and agencies, collection companies, suppliers of RFID cards, providers of IT services and other persons whose services we use during the provision of our services. We carefully choose our processors in order to be able to ensure that the legal requirements for data protection are met.

ZSE provides personal data of Customers also to parcel and courier companies, state authorities and other subjects in the scope of legal obligations (see Clause 3.2.2) and in the event of using electromobility services abroad, necessary data are exchanged with the applicable roaming partner.


5 DATA SUBJECT'S RIGHTS AND THEIR EXERCISE

5.1 Customerrights

Customers, in their position of data subjects, have the following rights:

− recall the consent to process personal data at any time (if the processing is based on their consent),

− obtain from ZSE a confirmation whether personal data relating to him or her are processed and if so, he or she is entitled to access to such personal data, information on personal data processing and a copy of data (ZSE shall be entitled to charge an adequate fee for administrative costs related to issuing additional copies requested by the Customer);

− for ZSE to rectify incorrect personal data relating to the data subject without undue delay,

− right to erasure, i.e. right to make ZSE without undue delay erase personal data relating to him or her, and ZSE is obliged to erase personal data without undue delay, provided that conditions

indicated in Article 17 of GDPR are met;

− to restriction of personal data processing in cases specified in Article 18 of GDPR;

− Right for transferability of data, meaning the right to get personal data related to him/her, which

he/she provided to ZSE, in a structured, generally used format that can be displayed on computers, and the right to transfer this data to another controller, if conditions under Article 20 of GDPR are met;

− Object against the processing of personal data related to him/her any time due to reasons related to his specific situation, if such processing is being conducted based on a justified interest, including objecting against profiling;

− Right not to be subject to decisions based exclusively on automated processing, including profiling, which has the legal effects applying to him/her, relates to him/her or significantly impacts him/her,

− request protection of his/her rights at the applicable court under Article 78 of GDPR,

− Lodge a complaint with the supervisory authority, especially in the member state of his or her habitual residence, place of work or place of the alleged infringement if the data subject assumes that the processing of personal data relating to him or her infringes GDPR. For the Slovak Republic, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, phone: +421 2 3231 3214, email:

statny.dozor@pdp.gov.sk.


5.2 How to exercise your rights

In order to protect the rights of customers and prevent potential misuse or leak of personal data, rights of data subjects can exclusively be applied in the following manner:

− By means of a letter sent or delivered to the registered office / mailing office of ZSE;

− Via email at: elektromobilita@zse.sk.

For the request to exercise the rights to be accepted it is necessary to sufficiently identify the applicant and to clearly specify the subject of the request. Otherwise the request will be rejected. In order to make access to their rights easier for data subjects, we prepared template applications available at www.skupinazse.sk, section "Personal data protection”.

In case of right to access to data, the right for transferability of data and right to erasure of data whose misuse could seriously affect the data subject's rights and freedoms, we require for the applicant's signature on the request sent by post or delivered to the post room to be officially certified; if the request is sent via email, it must be signed using the applicant's qualified electronic signature.

If the data subject's right is exercised by another person based on the power of attorney, we require the original of the power of attorney with officially certified authorizer's signature; the power of attorney may not be older than 6 months.


6 DATA PROTECTION OFFICER

Should you have any questions or comments related to personal data protection, please contact our data protection officer via email at:dpo@zse.skor by means of letter to Západoslovenská energetika, a.s. – Data protection officer, Čulenova 6, 816 47 Bratislava.


7 FINAL PROVISIONS

As of 25 May 2018, this document replaces information on protection and processing of personal data in ZSE specified in any customer documents (contracts, applications, forms) in the extent and under the terms and conditions of the original Act No. 122/2013 Z.z. on personal data protection and on the amendment of certain acts as amended.


Version: August 2020