1.1 CKW AG, a Swiss legal entity registered in the Swiss commercial register under number CHE-105.941.235, having its registered office at Täschmattstrasse 4, 6015 Luzern, Switzerland («CKW»), together with Jedlix B.V., a Dutch legal entity having its registered office at Stationsplein 45 Unit D, 3013AK in Rotterdam («Jedlix»), will act as joint data controller of personal data processing in connection with the Services. CKW and Jedlix are collectively referred to in this statement as 'we' or 'us'.

1.2 Jedlix is responsible for the technical and organizational aspects of the provision of the App and the Services, as well as for keeping the App operational. CKW provides the Services and App in its own name and determines (together with Jedlix) the specifications of the App. In addition, CKW provides guidance by, among other things, providing support services (such as customer support services) when the App or Services are used. CKW and Jedlix may both use your personal data for further purposes as described below. CKW will be the contact for any request from data subjects regarding the processing of personal data in connection with the App and Services. However, the data subject retains the right to exercise his or her rights under the DSGVO and national data protection laws against each of the data controllers.

CKW and Jedlix have entered into a separate joint controller agreement regarding the processing of personal data and their respective roles and responsibilities in this regard. Upon request, the CKW will provide the user with information on the essence of this joint controller agreement.

If you have any questions about or in connection with this Privacy Statement or the exercise of any of your rights, please contact CKW's Data Protection Officer at smartcharging(at)ckw.ch.

In connection with the App/Services, we collect and process your personal data only to the extent that the collection and processing is:

• necessary for the conclusion or performance of the Services, including preparatory measures related thereto (Art. 6 (1) b) of the European General Data Protection Regulation, hereinafter: "DSGVO"),
• if required by law (Art. 6 (1) c) DSGVO),
• if based on your consent (Art. 6 (1) a) DSGVO), or
• when necessary for the legitimate interests of us or third parties (Art. 6 (1) f) DSGVO). We make a consideration in this respect. Please contact us if you would like to know how we arrived at this consideration in a particular case.

The (personal) data as described in Sections 4.1-4.3 and the associated sub-sections are:

• collected directly from your vehicle (i.e., the sensors and related applications as accessed by the main unit); or
• are made available by you through the CKW Smart Charging App

and are processed in connection with the Services.

We will further analyze and improve the App and Services to develop new mobility and energy-related products and/or services, to secure our products and/or improve our App/Services. For example, we may send you tips and tricks based on your use of the App/Services. You can unsubscribe from these. For the aforementioned purposes, we automatically analyze data collected when Services are provided based on statistical and mathematical models to determine whether there is potential for improvements. More information about this can be found in Section 4.2. The legal basis for such processing is Art. 6 (1) f) DSGVO (the legitimate interest of CKW and Jedlix to process personal data in order to develop and improve our App/Services).

In this context, we may process your personal data for the purpose of monitoring our products, providing sufficient IT security standards and to defend ourselves or third parties against product liability and other legal claims related to our products and services. Insofar as such processing is not already required by law (Art. 6 (1) c) DSGVO), the legal basis for such processing is Art. 6 (1) f) DSGVO (legitimate interest).

We process your personal data for other purposes only if it is mandatory to do so on the basis of legal requirements (Art. 6 (1) c) DSGVO; for example, transfer to courts or authorities for criminal prosecution, to provide certain functionalities in the, if you have consented to the relevant processing (Art. 6 (1) a) DSGVO) or if the processing is otherwise lawful under applicable law. If processing for other purposes takes place, CKW and/or the Jedlix may provide you with additional information if appropriate.

CKW or Jedlix does not engage in automated decision making, or profiling in connection therewith, that produces legal effects on you or otherwise significantly affects you, unless you have otherwise been expressly notified thereof.

3.1 CKW Smart Charging App

The Services and the App provide the User with access to the following functions/activities:

• Calculate and implement an optimal charging plan for the electric vehicle(s) associated with your account,
• Customer verification with automotive and energy partners,
• Providing proof of delivered smart charging services towards energy partners for settlement and revenue calculation,
• Calculation and payment of smart charging revenues, if this right arises according to the agreement between the CKW and user.
• Würde ich einmal drinnen lassen. Evtl. wegen regionalen Partnerschaften in CH-IT bzw. CH-FR

3.2 Categories of personal data and legal basis

In connection with the functions listed in 4.1, we process the following personal data for the purposes listed below:

• Identity data, which are used to identify you. These include first name, last name, nickname, email address and an encrypted version of your self-selected password;
• Address data, which is used to determine your smart charging location and to verify your energy contract with your energy supplier. These include country, address, zip code and house number;
• Profile Data, which is used to provide a service in accordance with the customer's preferences, and includes energy supplier name, electric vehicle model, charging preferences and settings in the App, customer feedback and survey responses, as well as usage data added to one's personal account during the course of using the App/Services (think charging duration);
• Electric Vehicle Data, which is used to calculate an optimal charging plan and monitor the performance of our services.  These include vehicle status, battery status (when charging), telemetry data and GPS location of the vehicle;
• Payment information, which is used to disburse revenue directly to you (possibly through our partners). These include initials, last name, IBAN, the amount of revenue to be disbursed, charging data, and energy supplier contract number.
• Energy data, used for validation of the energy supplier and (financial) settlement with the energy partner. These data include the contract number of the energy supplier, EAN code of the electricity meter of the charge point (known as MPAN or PDL in some countries), smart electricity meter allocation approval, tariff information, energy consumption.

We process the above personal data, unless otherwise specified, in order to perform the Services (Art. 6 (1) b) DSGVO).

• Technical data, which is used to improve our Services and includes mobile device type and application version, time zone setting and location, browser types and versions, operating system and platform, and other technology on the devices you use to access the Services;
• Tracking Data, which is used to improve our Service and includes information we or others collect about you through cookies and similar tracking technologies, such as web beacons, pixels and mobile identifiers;
• Marketing and Communications Data, which is used to communicate with you and includes your preferences in receiving direct marketing from us and third parties engaged by us and your communication preferences.

We process the above personal data based on your consent (Art. 6 (1) a) DSGVO).

If you have consented to the processing of personal data, you may withdraw your consent at any time with future effect. Such withdrawal does not affect the legality of the processing prior to the withdrawal of consent (Art. 7 (3) DSGVO).

Pursuant to data protection legislation, you have the right to: request access to your personal data (Art. 15 DSGVO), request rectification of your personal data (Art. 16 DSGVO), request erasure of your personal data (Art. 17 DSGVO), request restriction of the processing of your personal data (Art. 18 DSGVO), request data portability (Art. 20 DSGVO) and object to the processing of your personal data (Art. 21 DSGVO).

You also have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77).

Please note that the aforementioned rights may be limited in accordance with applicable national data protection legislation.

4.1 Right of access (Art. 15 DSGVO): you may have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, and, if so, to request access to the personal data. This information includes - among other things - the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may limit your right to access.

You may have the right to receive a copy of the personal data being processed (the data; not the data media). For further copies requested by you, we may charge you a reasonable fee based on administrative costs.

4.2 Right to rectification (Art. 16 DSGVO): You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by providing a supplementary statement.

4.3 Right to erasure of data («right to oblivion») (Art. 17 DSGVO): Under certain circumstances, you have the right to have personal data concerning you erased by us, and we may be obliged to erase such personal data.

4.4 Right to restriction of processing (Art. 18 DSGVO): Under certain circumstances, you have the right to have us restrict the processing of your personal data. In this case, the data in question will be flagged and may only be processed by us for certain purposes.

4.5 Right to data portability («right to data portability») (Art. 20 DSGVO): Under certain circumstances, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable form, and you may have the right to transfer this data to another entity without hindrance on our part.

4.6 Right to object (Art. 21 DSGVO): Under certain circumstances, when we process data on the basis of a legitimate interest, you may have the right to object to the processing of your personal data for reasons related to your specific situation, and we may be required to stop processing your personal data. Furthermore, if your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, including profiling insofar as it relates to such direct marketing activities. In this case, your personal data will no longer be processed by us for those purposes.

4.7 Right to make arrangements for the storage and communication of data after someone's death: you have a right to make specific arrangements for the storage and communication of your personal data after your death, and we will act accordingly. You may also make general arrangements with a third party, who will notify us of your instructions in due course.

Because of our role as joint controllers in providing the App and Services, both CKW and Jedlix will receive personal data. All access to your personal data at CKW and Jedlix is limited to those who need it to perform their functions. CKW and Jedlix may transfer your personal data for the relevant purposes to the recipients and categories of recipients listed below.

Other private third parties - certain companies that assist us in providing the App/Smart Charging services and receive personal data for that reason.

To verify that you have a contract with your selected energy supplier and for the (financial) settlement of the Service revenues with the energy partner, we share Address and Energy Data with our energy partners, which include the following parties:

• The Balancing Responsible Party (BRP) that your Energy Supplier uses to purchase energy in the energy markets (the larger energy suppliers often also act as BRP).
• The Distribution System Operator (DSO or DNO) responsible for operating the local electricity grid in your area
• The Transmission System Operator or Electricity System Operator (TSO or ESO) who is responsible for maintaining the frequency of the high-voltage grid in your country, province or state.
• The Balancing Service Provider (BSP), often called "aggregators," who combine energy resources (large batteries, wind turbines, etc.) to provide balancing services to the Transmission System Operator.  Jedlix works with some of these BSPs to offer electric vehicle battery flexibility as a service, so you can get the benefits of smart charging even if your energy provider does not support smart charging through Jedlix.

When revenue disbursement is processed by one of our energy or automotive partners, we share Payment Data with that partner.  

Processors - Certain third parties, whether affiliated with us or not, may receive your personal data to process it on our behalf according to appropriate instructions (in accordance with the relevant processing purposes). Processors are subject to contractual obligations to implement appropriate technical and organizational security measures to protect personal data, and to process your personal data only in accordance with instructions.

The data processor for the Smart Charging App/Services is Jedlix B.V., Stationsplein 45 Unit D, 3013AK Rotterdam

Government agencies, courts, external advisors and similar third parties that are public bodies, as required or permitted by applicable law.

Your personal data will be stored by us and/or our service providers only to the extent necessary for the performance of our obligations and only for the time necessary to achieve the purposes for which the personal data are collected, in accordance with applicable data protection legislation.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of your personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve those purposes by other means.

Details of your payments will be retained for as long as we need to keep that data to comply with our legal obligations.  This is usually 7 years, unless a different period is required by law.

The security of personal data is of great importance to us. Taking into account the nature of personal data and the risks associated with processing such personal data, we take all appropriate technical and organizational measures to ensure the security of your personal data. Security measures include (for example) the storage of personal data on secure servers of one of our suppliers.