Data Protection

General:

SMATRICS GmbH & Co KG
Europaplatz 2 / Stiege 4 / 3.OG
1150 Vienna
Austria

info@smatrics.com

As the party responsible for complying with data protection, we process your data for the following purposes: (a) creating and providing advertising and descriptions of our products, (b) responding to your queries and follow-up questions, including creating offers for contracts relating to our products and services as well as contract conclusions, (c) fulfilling existing contracts relating to our products and (d) operating and optimising our website.

Data is processed on the basis of the statutory provisions of Section 96 Par 3 Telecommunications Act and (a) for advertising on the basis of consent in accordance with Art 6 Par 1 lit a GDPR. Data is processed for (b) responding to your queries and follow-up questions, including creating offers for contracts relating to our products (c) and for fulfilling existing contracts relating to our products as well as contract conclusions on the basis of the respective contract or pre-contractual measures with the relevant customer in accordance with Art 6 Par 1 lit b GDPR. Data is processed for operating and optimising our websites (d) on the basis of the legitimate interests of SMATRICS in accordance with Art 6 Par 1 lit f GDPR in optimising our website, whereby the data is anonymised here.

If you hand over your business card to us in the course of a first contact or expressly provide us with your contact data by telephone, we will use your personal data on the basis of your verbal consent (Art 6 Par 1 lit a GDPR) for the following purposes: to initiate business, to offer products and services and to carry out pre-contractual measures. If you have given us your consent, we will also process your data to send you our newsletter. The data are full name, address, telephone number, as well as e-mail address of the contact person and further contact data, which are indicated on the business card. You can withdraw your consent at any time without giving reasons. To do so, please send an e-mail to info@smatrics.com.

If you have already concluded a contract relating to the use of SMATRICS products and services, or if you want to conclude a contract of this type, your rights and obligations in connection with the provision of your data are regulated in this contract; a conclusion or fulfilment of the respective contract relating to the use of our products and services is not possible if this data is not provided.

If you have not concluded or do not want to conclude a contract with SMATRICS, you are not obligated to provide personal data; however, the consequence of not providing your personal data is that SMATRICS cannot provide the requested services.

The personal data that you entered on our websites is forwarded to only the following persons for the provision of services in accordance with our offers on our websites: IT service providers and web agencies. If our products are used for charging, SMATRICS as the party responsible in the sense of General Data Protection Regulation (EU) 2016/679 ("GDPR") is entitled to process the personal data that was disclosed and obtained in the context of the business relationship and (especially from public SMATRICS charging stations and/or wall boxes and/or charging stations from partners of SMATRICS) for the purpose of performing this contract relating to the product for charging and to transmit this data – wholly or in part– in connection with the fulfilment of this contract to suppliers, IT service providers, customer service, banks, accountants, tax consultant, auditors and if necessary collection agencies, insurance companies and legal representatives.

This concerns full name, academic title, postal address, e-mail contact, telephone number, date of birth, billing data, account data, customer ID number, charging location, charging start, charging end, charging station used, roaming partner, ID of the device when using the SMATRICS APP, consumption data, vehicle charging capacity, registration number for the contract vehicle, make, commercial name and year of construction of the contract vehicle. To process the billing of charging processes at the charging stations belonging to the roaming partners of SMATRICS, SMATRICS transmits customer ID numbers in an anonymised format to the roaming partners. The roaming partners do not have any access to the personal data that is stored by SMATRICS as a result. The contract cannot be fulfilled in accordance with this paragraph if this data is not provided.

To pay by credit card, you have to enter your card number, expiry date and the CVC code for the credit card. SMATRICS is entitled to forward this data without storing it to its sales partners (currently Wirecard Central Eastern Europe GmbH). This partner checks the expiry date of the credit card and that the data entered was correct and processes the payment. Contracts with payment by credit card cannot be fulfilled in accordance with this paragraph if this data is not provided.

The personal data that you entered on our website is stored for the purpose of providing the service according to our offers on our websites for as long as this is necessary for fulfilling our reporting obligations and our obligations to furnish proof.

If you use our products for charging, the necessary data is stored for the duration of the contract and afterwards for as long as is necessary for the purpose of fulfilling the contract, in the event of disputes, or for reporting obligations and obligations to furnish proof.

General information about this data processing:

In this data processing "public charging", personal data of you will be processed exclusively if you are entitled to charge at public charging stations due to a contract with us.

This data processing also includes roaming. If there is any deviation from this information in the context of roaming, this will be explicitly stated.

Categories of data processed and categories of data subjects:

This data processing exclusively concerns customers of SMATRICS.

Within the scope of this data processing, we process the following categories of personal data:

Data identifying you, Data communicating with you, Contract data, Data relating to your charges (including data relating to charges with roaming partners), Billing data and Payment data.

Purposes of data processing:

The purposes of data processing are the providing of contractual services, including its ancillary services and other obligations resulting from the contract (which includes the processing of roaming), the prevention of misuse, the assertion of legal claims and the fulfillment of (post-)contractual statutory storage obligations.

Legal basis of data processing:

We process the categories of data listed above based on the performance of (pre-)contractual measures pursuant to Art 6 para 1 lit b GDPR and based on our legitimate interest pursuant to Art 6 para 1 lit f GDPR.

Our legitimate interest is, in addition to the proper processing of the contractually specified services and the ancillary services, ensuring compliance with contractual provisions and - in the event of breaches of contractual provisions - the enforcement of these breaches, the allocation of payments and the management of customer data.

Duration of data processing:

All data will be processed until 3 years after the termination of the contract.

Thereafter, only those data will continue to be stored which are required to be stored in order to comply with statutory storage obligations, in particular pursuant to Section 132 (1) of the Federal Tax Code (in german: „Bundesabgabenordnung“). The mandatory storage of this data is based on Art 6 para 1 lit c and Art 6 para 1 lit f GDPR. The legitimate interest of us in this case is the fulfillment of legal storage obligations.

Recipients:

Your data will be passed on by us to our IT infrastructure service providers as data processors, to our CRM service provider as data processors and to our service providers for services from the invoicing process and payment.

If your contract also provides for payment by credit card, we will pass on your credit card data to our payment service provider as our data processor and to our acquirer as own data controller.

In the event of litigation or non-payment, we will also share your information with law firms and/or courts or with a debt collection service provider.

If you are entitled to roam, we pass on data for identification purposes in - from the point of view of roaming platform operators - anonymized form to roaming platform operators.

We as the recipient of your data:

When you charge at a SMATRICS EnBW GmbH charging station, SMATRICS EnBW GmbH as CPO transmits personal data to us. This data is data to identify you and data about the charging itself. SMATRICS EnBW GmbH collects and forwards this data to us on our behalf. SMATRICS EnBW GmbH is our data processor.

If you are entitled to roam, we receive data about your charge and identification data from roaming partners (other charging station operators with whom we have concluded contracts) and subsequently from the roaming platforms. This data is collected by the roaming partner, forwarded to the roaming platform and the roaming platform forwards this data to us. The data identifying you are not a new personal data for us, but those are already known to us, as it has been created by us.

All these roaming data are not publicly accessible.

General information about this data processing:

Online Direct Payment, colloquially referred to as "ad hoc charging", means the charging of vehicle on an ad hoc basis without entering into a longer-lasting contractual relationship as specified in Section 3 para 4 of the Federal Act on the Establishment of Uniform Standards in the Construction of Infrastructure for Alternative Fuels (in german: „Bundesgesetz zur Festlegung einheitlicher Standards beim Infrastrukturaufbau für alternative Kraftstoffe“).

This type of charging allows you to charge a vehicle without entering into a longer-lasting contractual relationship with us. The Online Direct Payment contract automatically expires after the end of the charging process.

The provision of data in this data processing is not required by law. However, without the provision of your data, we can not provide our services.

Categories of data processed and categories of data subjects:

The data processing exclusively concerns Online Direct Payment customers.

Within the scope of this data processing, we process the following categories of data: Contact data (Email address), credit card data, loading data and billing and payment receipt data.

Purposes of data processing

The purposes of data processing are the processing of contractual services and the fulfillment of legal storage obligations.

Legal basis of data processing:

We process the categories of data listed above based on our legitimate interest pursuant to Art 6 para 1 lit f GDPR and based on the implementation of (pre-)contractual measures pursuant to Art 6 para 1 lit b GDPR.

Our legitimate interest is, in addition to the proper processing of the contractually specified services and ancillary services the processing of payment, the issuing of an invoice and sending the same and - if the contract has not been properly fulfilled - in the defense or assertion of legal claims.

Duration of data processing:

All data will be processed until 3 years after complete fulfillment of the contract.

Thereafter, only those data will continue to be stored which must be stored in order to comply with the statutory retention obligations, in particular due to Section 132 para 1 Federal Tax Code (in german: „Bundesabgabenordnung“). The mandatory storage of this data is based on Art 6 para 1 lit c GDPR.

Recipients:

The credit card data is passed on by us to our payment service provider, Quenta Payment CEE GmbH, as our data processor.

In addition, the credit card data is passed on to our acquirer, card complete Service Bank AG, as an own data controller.

Your contact data will be passed on by us to our service provider for sending e-mails, VERBUND Services GmbH, as our order data processor.

General information about this data processing:

In this data processing " Charge at Home", personal data of you will be processed if you conclude a contract for the SMATRICS Charge at Home.

The provision of data in this data processing is not required by law. However, without the provision of your data, we cannot provide our services.

Categories of data processed and categories of data subjects:

The data processing exclusively concerns customers of SMATRICS.

Within the scope of this data processing, we process the following categories of data:

Data to identify you, Data to communicate with you, Delivery and billing address, Installation location as well as Payment data and Billing data.

Purposes of data processing

The purposes of the data processing are the providing of the contractual services, including its ancillary services and other obligations resulting from the contract and the fulfilment of legal storage obligations.

Legal basis of data processing:

We process the categories of data listed above based on the implementation of (pre-)contractual measures pursuant to Art 6 para 1 lit b DSGVO and based on our legitimate interest pursuant to Art 6 para 1 lit f DSGVO.

Our legitimate interest is the contractual processing of the services specified in the contract and the ancillary services, which also includes the processing of payment and invoicing, the issuing of an invoice for sending the same and - if the contract has not been properly fulfilled - in the defense or assertion of legal claims.

Duration of data processing:

All data will be processed until 3 years after complete fulfilment of the contract.

Thereafter, only those data will continue to be stored which must be stored in order to comply with the statutory retention obligations, in particular on the basis of § 132 para 1 of the Federal Fiscal Code (Bundesabgabenordnung). The mandatory storage of this data is based on Art 6 para 1 lit c DSGVO and Art 6 para 1 lit f DSGVO. The legitimate interest of us in this case is the fulfilment of legal retention obligations.

Recipients:

Your data will be passed on by us to our IT infrastructure service providers as data processors, to our CRM service provider as data processor and to our suppliers and service providers for the fulfilment of deliveries and services under the contract. We pass your name with your employer to confirm your entitlement to enter into the contract.

In the event of litigation or non-payment, we will also share your data with law firms and/or courts or with a debt collection service provider.

General information about this data processing

On our website you have several opportunities to use contact forms to get in touch with us.

The provision of data in this data processing is not required by law or contract. Without the provision of the e-mail address, we can not respond to your request. Without providing the data from the "How can we help you?" field, your request may be assigned to the wrong competent department, preventing or delaying the processing of the request. We cannot respond to a request without entering a message. The remaining data is optional and merely facilitates the processing of your request or shortens the processing time.

Categories of data processed and categories of data subjects

The data processing may only concern requesting persons. Such requesting persons may be customers, suppliers, interested parties or any other persons.

In the context of this data processing, we process the following mandatory categories of data: Contact data (e-mail address), data to classify your request, the request and technical data arising during processing (for example, error messages in the delivery of the response to the request).

Optionally, you can also provide data of the following data categories: Personal data (first name, last name), contact data (telephone number) and data on the company to which you belong (company name, country/region).

Purposes of data processing

The purpose of the data processing is to handle your request (for example, answering your questions, preparing an offer, conducting pre-contractual discussions and responding to criticism).

The optional data has the purpose of facilitating the processing of your request by allowing us to call you instead of sending you an email or to assign your request to you as a customer (if you are a customer of ours).

Legal basis of data processing

We process the mandatory data on the basis of the implementation of (pre-)contractual measures pursuant to Art 6 (1) point b GDPR and on the basis of our legitimate interest pursuant to Art 6 (1) point f DSGVO.

Our legitimate interest is the processing of the request and/or the conclusion of a contract, including all activities to be carried out until the conclusion of the contract.

Duration of data processing

If a request is attributed to you as a customer, the data will be stored for as long as your data is stored as a customer (usually until 3 years after termination of the contract).

If you are not a customer of ours, your data will be stored for 3 years from the time of the last communication.

Processors

Your personal data will be passed on to our service provider for Microsoft Office, VERBUND Services GmbH and to our CRM service provider as our order data processors.

Other recipients

There are no other recipients.

However, data may be passed on in case of an occasion, for example, if the inquiry is a product inquiry and the product in question can only be offered with one of our partners, then your data will be passed on to this partner as own controller, or if a legal dispute arises from an inquiry, your data will be passed on to lawyers, courts or administrative authorities.

General information about this data processing

This section informs you about the data processing that will be carried out after submitting the form for our product CPOaaS.

The provision of data in this data processing is not required by law or contract. Without the provision of the contact data, no conversations can be initiated. Without the provision of the other data, we cannot create an offer, make an evaluation of whether CPOaaS is the right product and thus conclude a contract.

Categories of data processed and categories of data subjects

The data processing exclusively concerns interested parties in products offered by SMATRICS.

Within the scope of this data processing, we process the following categories of data:

Identification data, address data, contact data, communication data, offer data, contract data, location data, technical data on the installation site, technical data on already existing charging stations, data on the optional, desired service components, data on the desired charging infrastructure as well as other data on the service provision (site plan, energy diagram, other documents and freehand comments).

Purposes of data processing

The purposes of the data processing are the identification of our future contractual partner, the processing of the inquiry, which includes in particular the evaluation whether CPOaaS is the appropriate product and the evaluation of your needs, the contact with you to present the product CPOaaS and potentially other products, the conduct of pre-contractual discussions, the negotiations, the performance of an installation check, finally the preparation of an offer and the conclusion of the contract.

Legal basis of data processing

We process the categories of data listed above on the basis of our legitimate interest pursuant to Art 6 (1) point f GDPR and on the basis of the implementation of (pre-)contractual measures pursuant to Art 6 (1) point b GDPR.

Our legitimate interest is the preparation of an offer tailored to you, in the conduct of pre-contractual discussions, as well as in the performance of an installation check to determine the effort and material in the event of an installation and in the conclusion of a contract.

Duration of data processing

Should we conclude a contract with you, all data will be processed until 3 years after the termination of the contract or after the contractual services ended, whichever is later.

Thereafter, only those data will continue to be stored which must be stored in order to fulfill the statutory retention obligations, in particular due to § 132 (1) Federal Tax Code (in German: “Bundesabgabenordnung”). The mandatory storage of this data is based on Art 6 (1) point c GDPR.

If we do not conclude a contract with you, the data will be processed until 3 years after the time at which it is determined that no contract will be concluded.

Processors

Your data will be passed on by us to our CRM service provider as our data processor.

In addition, we pass on certain data to one of our service providers to carry out an Instal-Check as their own data protection controller.

Other Recipients

There are no other recipients.

General information about this data processing

You have the opportunity to register for various free webinars on our website.

The webinars will be recorded unless otherwise expressly announced. You will be notified before you enter the webinar that a recording is taking place. The recording will only capture the screen transmission and audio, but not the participants or chat. Therefore, if you do not wish to appear in the recording, we recommend that you use the chat for questions, comments, or anything else.

After the webinar, these will be made available to everyone on-demand.

The provision of data in this data processing is not required by law or contract. However, without providing the email address, we cannot send an invitation to the webinar.

Categories of data processed and categories of data subjects

The data processing exclusively concerns interested parties of SMATRICS products.

Within the scope of this data processing, we process the following categories of data: Contact data (email address), if you also speak in the webinar: Recording data (your voice in the recording). Optionally, you can enter identification data (first name, last name, company, position).

Purposes of data processing

The purpose of the data processing is to organize and conduct the webinar, including the preparation and follow-up of the webinar, including sending the webinar materials to you and contacting you for more detailed information about our products.

Legal basis of data processing

We process the categories of data listed above due to the performance of a contract pursuant to Art 6 (1) point b GDPR (conduction of the webinar).

Duration of data processing

Your personal data will be deleted 1 year after the email with which you are sent the webinar materials following the webinar. If no e-mail with the webinar materials is sent following a webinar, your data will be deleted 1 year after the webinar has been held.

However, this only applies as long as no permissible further processing of the data takes place, for example if you ask us questions about the webinar or a business relationship arises from the webinar.

Processors

Your personal data will be passed on to our CRM service provider, HubSpot Inc, as our data processor. This company sends the emails about the webinar on our behalf (registration confirmation, reminders and, following the webinar, the email about the recording and webinar materials).

To conduct the webinar, we use the Zoom tool from Zoom Video Communications Inc, which is our data processor as well.

Other Recipients

There are no other recipients.

However, there may be a disclosure of data in case of cause, for example, if a legal dispute arises from a registration, your data will be disclosed to lawyers, courts or administrative authorities.
 

General information about this data processing:

You have the option of registering for our newsletter on our website so that you receive the most important first-hand information on the topic of electromobility.

The consent to the newsletter takes place according to the so-called "double opt-in" procedure to ensure that the consent is given from the data subject.

The provision of data in this data processing is neither legally nor contractually required. However, without the provision of the e-mail address, we can not send the newsletter.

Categories of data processed and categories of data subjects:

The data processing exclusively concerns subscribers to the newsletter.

Within the scope of this data processing, we process the following categories of data: Contact data (e-mail address), data regarding your consent (date of consent), technical information (undeliverability of the e-mail, error message) and the newsletter sent.

Purposes of data processing

The purpose of data processing is the delivery of the newsletter.

Legal basis of data processing:

We process the categories of data listed above based on your consent pursuant to Art 6 (1) point a GDPR.

You can withdraw your consent at any time by either clicking on the withdraw button in one of the newsletters or sending an email to info@smatrics.com. Please note, however, that the withdrawal of your consent does not affect the lawfulness of the processing until the withdrawal.

Duration of data processing:

Your personal data will be processed until you withdraw your consent.

Processors:

Your personal data will be passed on to our CRM service provider, who will also send out the newsletter designed by us on our behalf.

Other Recipients:

There are no other recipients.

However, there may be a disclosure of data in case of cause, for example, if a legal dispute arises from a newsletter, your data will be disclosed to lawyers, courts or administrative authorities.

As a data subject, you have various rights. Below you will find a short description of the rights to which you are entitled as a data subject.

Right to access

You have the right to request information about the personal data processed. This right to information also includes your right to request a copy of the personal data about you.

Right to rectification

You have the right to request us to correct any inaccurate personal data concerning you and also the right to request us to complete any incomplete personal data concerning you.

Right to erasure

Under the circumstances established by law, you have the right to request from us the deletion of the personal data concerning you.

Right to restriction

In the circumstances established by law, you have the right to request from us the restriction of the processing of personal data concerning you.

Right to data portability

In the circumstances established by law, you have the right to request us to transfer the personal data concerning you to another controller or to receive the personal data concerning you in a structured, commonly used and machine-readable format.

Right to object

For reasons arising from your particular situation, you have the right to object to processing at any time, provided that our processing is based on Art 6 (1) point e GDPR, Art 6 (1) point f GDPR or if we do profiling.

Right to complain

If you believe that our processing of personal data concerning you violates applicable data protection law, you have the right to submit a complaint to the supervisory authority.

The supervisory authority responsible for us and its address is as follows:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna

Right to withdraw consent

If data processing is based on consent given by you, you may withdraw this consent at any time by writing an informal e-mail to info@smatrics.com stating that you withdraw your consent. This option exists besides any special withdrawal options, such as buttons in e-mails.

Please note that the withdraw of consent does not affect the lawfulness of the processing until the consent is withdrawed.

Profiling and automated decision in individual cases

Profiling or an automated decision individual decision-making does not take place.

Our website also contains links to other websites. However, this privacy policy does not apply to these websites. We therefore ask you to visit these other websites directly in order to obtain the data protection-related information for the other websites there. SMATRICS cannot be held responsible for any measures arising from these websites or for their contents.

The following data, which your Internet browser transmits to us, is automatically recorded on our server and stored in what are called log files:

• Browser type and version
• Operating system used
• Website from which you visit us (referrer URL)
• Website that you call up on our server
• The date and time when you accessed the website
• Your IP address

This data is stored separately from any personal data that you may have provided and so cannot be traced to an individual person. It is assessed on the basis of events for troubleshooting and for statistical purposes so that we can optimise our website, or so that we can obtain additional information in the event of specific indications of possible unlawful use. When they reach a certain size, these log files are automatically rotated and therefore overwritten. 

Our website uses what are called cookies. These are small text files that are stored on your device with the help of the browser. They do not cause any damage. The following data is recorded:

• IP addresses

Your IP address is recorded but it is immediately anonymised by deleting the last 8 bits. This means that only a general localisation is possible. Our website uses what are called session cookies. These are cookies that are active only while you visit the website. Session cookies are therefore valid for a limited period of time and are deleted when you close the browser/tab. A token is saved on the server for a maximum of 30 minutes. Session cookies only store IP addresses.

We use cookies to make our offering more user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser the next time you visit. If you do not want this, you can configure your browser so that it informs you when cookies are set and you can allow this on a case-by-case basis. Deactivating cookies may restrict the functionality of our website.

Our website uses functions of the web analytics services Google Analytics and Hubspot.

Cookies are used here that enable analysis of the use of this website. The information that they create is transmitted to the provider’s server where it is stored.

You can prevent this by setting up your browser in such a way that it does not store any cookies. The IP addresses that are recorded based on the legal basis of "legitimate interest“ of SMATRICS in accordance with Art 6 Par. 1 lit f GDPR are anonymised by using a code line before they are stored on a server. In other words, the last 8 bits of the IP address are deleted and thus cannot be uniquely allocated to any person.

Google Analytics

Google Ireland Limited

Gordon House, Barrow St

Dublin 4

Ireland

Google Analytics uses so-called "cookies". The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there.

However, in the event that IP anonymization is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before this happens. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage. The IP address transmitted by your browser within the scope of Google Analytics is not combined with other data from Google.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link.

HubSpot

Hubspot, Inc.
25 First Street
Cambridge, MA 02141
USA

The Hubspot Tracking Tool includes the following data: Your IP address, browser type, domain name, Internet service provider (ISP), files viewed on our site (e.g., HTML pages, graphics, etc.), operating system, clickstream data, access times and addresses of websites from which you linked to our site. If we have your personal data (name, address, etc.) because you have provided it to us, this data will be linked to the log data (device and activity data) mentioned in this paragraph, so that a personal reference is also made with regard to the log data.

We use the subscription service of HubSpot Inc. for marketing and lead generation purposes. This subscription service allows visitors to learn more about our company, download content, and provide their contact information or other demographic information. This information is stored and maintained on servers of HubSpot Inc. or its affiliates (e.g., HubSpot Germany GmbH). This information is used to contact and interact with visitors regarding their interest in our goods or services. For information about how HubSpot handles your personal information, please click on the following link: HubSpot Privacy Policy.

Your data is hosted by a provider that is located within the European Union. Both SMATRICS and the provider use technical and organizational security measures to protect your data from manipulation, loss, destruction or access by unauthorized persons. Irrespective of the above, we would like to inform you that any transfer of data via the Internet is not secure and there is therefore a risk that it may be intercepted and used by third parties. Our security procedures are continually enhanced as new technology becomes available. Please feel free to contact us via the contact details mentioned above to obtain further information about our security measures.

This privacy policy is adapted according to continuing further development of our services. Changes to our website will be announced in good time before they are implemented. You should therefore refer to this privacy policy at regular intervals for the latest version.

Last revised: January 2023