Plugit Privacy Policy 

Applicable in Finland and Sweden 

1. Data controller 

Plugit Finland Oy (Business ID: 2513960-7) Ruutanakorventie 7 33960 Pirkkala, Finland 

2. Contact person for data protection matters 

Plugit Finland Oy Phone: +358 207 350 330 (local network charge / mobile call charge / international rates); email: gdpr@plugit.fi

3. Personal data processed 

Plugit processes the following personal data of its users, customers, and the representatives of its corporate customers. 

Basic information, such as: 

• first name and last name 

• year of birth 

• contact details (postal address, telephone numbers, email addresses) 

• information concerning the profession or role of the contact persons of a corporate customer 

Information relating to the customer or user relationship, as well as use of services and content, such as: 

• registration data for the service (e.g. user IDs and passwords for the online service and backend system) 

• data concerning the user’s vehicle and other possible profiling data and information of interest provided by the user 

• purchasing data, such as products and services purchased, including information on product guarantees, as well as information necessary for payment, billing, and debt collection, such as payment card data 

• information necessary for delivery of products or services, such as the electricity company the customer uses 

• information relating to use of products, such as charging frequencies and capacities, as well as data relating to charging rights 

• location information (for example, coordinates calculated by GPS in the backend system, where the user has given specific permission for this) 

• information relating to customer and user communication, including recordings of telephone conversations 

• feedback and complaints, including information relating to liability for defects and products 

• browsing and other data concerning use of the service’s electronic interfaces and content, including technical data sent to the service provider’s server from the user’s browser (IP address, browser software, browser version, and operating system), as well as cookies and related data where personal data is connected to those cookies (please see our cookie policy for further information) 

• data relating to marketing and sales promotion, such as marketing activities targeted to the user or customer, their utilisation, data provided in that connection, and direct marketing permissions and refusals 

• data used for profiling, such as charging history and website usage data, to enable relevant communications (e.g. informing users of nearby charging points) and to improve our services; no solely automated decisions with legal or similarly significant effects are made on the basis of this profiling 

Note on mandatory data: Where personal data is required to enter into or perform a contract (e.g. registration data and payment information), failure to provide it will mean that the service cannot be provided. Where data is optional, this is indicated at the point of collection. 

4. Purpose of processing personal data 

Personal data may be processed for the following purposes: 

• the upkeep, management, analysis, and development of a customer or user relationship, including:  

• installation, survey, maintenance, or other service 

• product delivery or implementation of another agreement 

• provision of the backend system service 

• contact with the customer or user, including electronic communication 

• delivery of Plugit’s own newsletter and the Green Lane service newsletter 

• analysis and statistics 

• business planning, analysis, and development of Plugit’s business and that of the companies in the same group 

• marketing by Plugit and the companies in the same group, including direct marketing and targeting of relevant material, for example with the aid of a profile created on the basis of the customer’s or user’s purchase history or other data 

• opinion polls and market research 

• other purposes that are not in conflict with those described above 

5. Legal bases for processing personal data 

5.1 Contract 

Where the user is also the customer (e.g. a private individual who has registered and uses the service directly): we process your personal data for the performance of a contract to which you are directly a party, or for the implementation of pre-contractual measures taken at your request. A contract is formed when we notify you of the binding conditions of our service on our website and when you register on the service. 

Where the user is not the customer (e.g. an employee or representative whose use of the service is arranged or paid for by their employer or organisation): we process the user’s personal data as necessary to deliver the service to the customer. The contractual basis rests between the service provider and the customer; the user’s data is processed to the extent required to provide the service under that contract. 

5.2 Legitimate interest 

Plugit’s right to process personal data is based partly on the legitimate interest generated by the customer or user relationship. We process personal data on the basis of legitimate interest when a user represents their employer and registers on the service, or when a user or customer otherwise discloses their personal data to us. Legitimate interest also applies to data analysis, compiling statistics, and implementing marketing and communications. Profiling and targeted marketing are also connected to this processing; profiling helps us, for example, to inform users of their nearest charging point. 

We have carried out a balancing test in accordance with the GDPR, on the basis of which we have established that the fundamental rights and freedoms of data subjects do not override Plugit’s right to process personal data on the basis of the customer or user relationship. You have the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. In that case we will assess whether there are sufficiently important and justified grounds for continued processing that override your rights and interests. You can read more about your rights in section 9 of this privacy policy. 

5.3 Consent 

We process personal data on the basis of consent where you have given consent for direct electronic marketing, in which case we may send you Plugit’s newsletter or other direct marketing material. We also process personal data collected via cookies on the basis of consent to the placing of those cookies (please see our cookie policy for further information). We process location information where the user has given specific consent for this. 

You are entitled to withdraw your consent at any time. Consent to direct electronic marketing can be withdrawn by contacting our contact person or by clicking the unsubscribe link in any direct marketing message. 

6. Recipients or categories of recipient of personal data 

Personal data is disclosed within the limits of permissions and obligations under applicable legislation. Data is disclosed in accordance with regulations to the appropriate authorities, such as the tax authorities. Data is also communicated to charging point service providers so that they can identify our users when they use a charging point. 

Plugit may disclose personal data to carefully selected cooperation partners for marketing purposes, unless you have refused permission for this. 

Personal data is not regularly disclosed for purposes other than those described above. However, Plugit may, to the extent permitted by law, disclose and/or transfer personal data to relevant parties such as prospective or actual purchasers and their advisers in connection with mergers, acquisitions, sales, reorganisations, or other transactions or transfers or changes of control involving Plugit and/or its group companies, services, applications, digital services, or businesses. We may also receive personal data from relevant parties such as sellers and their advisers for the purposes of such transactions. Plugit may also disclose data for statistics and analysis purposes in a form that cannot be associated with an individual person (e.g. data on charging frequencies and amounts). 

Personal data processing is outsourced to the following service providers, which process personal data on Plugit’s behalf: 

• IT systems suppliers 

• providers of accounting services 

7. Transfer of personal data to third countries 

Personal data may be transferred to Plugit’s cooperation partners and service providers outside the EU and EEA. Personal data will not be transferred to recipients that do not offer the same or an equivalent level of data protection as Plugit. 

All transfers are carried out in compliance with applicable data protection legislation. Compatible transfer mechanisms are applied, such as contracts incorporating the European Commission’s standard contractual clauses and applicable supplementary privacy measures, to guarantee the level of data protection when personal data is processed outside the EU. 

8. Retention periods of personal data 

Personal data is retained for as long as necessary for the purposes of processing, or for Plugit’s compliance with legal obligations. 

• Consumer customers (user = customer): personal data is retained for the duration of the customer relationship and for two further years after the end of that relationship, unless Plugit has other grounds for processing, such as accounting requirements or direct marketing. 

• Corporate customers and their users (user ≠ customer): personal data relating to a representative or user is retained for as long as that person represents or is linked to the corporate customer. 

• Direct marketing data: retained until the data subject disallows direct marketing. After that, Plugit retains only the record of the marketing ban, unless the data subject objects to this. 

• Accounting data: retained for 6 years from the end of the calendar year of the relevant accounting period. 

9. Data subject rights 

You may exercise your data subject rights in accordance with the GDPR and applicable national data protection legislation by contacting our contact person. Please note that we may ask for additional information to confirm your identity. 

9.1 Right to access data 

You are entitled to receive confirmation from Plugit on whether we are processing your personal data, and to access the personal data we hold about you, together with information on how it is processed. 

We will not provide access to Plugit’s business secrets, confidential information, or information that could violate another person’s privacy. 

When you exercise this right, we will supply you with a copy of the personal data we have processed concerning you. If you request several copies, we may charge a reasonable fee to cover administration costs. If your request is made electronically, we will send the information in a commonly used electronic format, unless you request it verbally or on paper. 

9.2 Right to rectification of data 

You have the right to request that we rectify or supplement inaccurate or incomplete data concerning you without unnecessary delay. We may ask for further clarification if needed, for example to confirm your identity or verify the accuracy of new data. Requests for correction can be sent to gdpr@plugit.fi. You may also rectify your own data by logging in to the service. 

9.3 Right to erasure 

You are entitled to request that Plugit erase your personal data without unnecessary delay if: 

• the data is no longer needed for the purposes for which it was collected or otherwise processed 

• you object to processing based on your particular personal situation and there is no justified reason for continued processing, or you object to processing for direct marketing purposes 

• Plugit has processed your personal data unlawfully 

• the data must be erased to comply with a legal obligation applying to Plugit 

We assess each erasure request individually and endeavour to respect your rights within the limits of applicable law. 

9.4 Right to restriction of processing 

You have the right to request that we restrict processing of your personal data — meaning the data will only be retained and not otherwise processed except with your consent, for legal claims, or to protect another person’s rights — if: 

• you contest the accuracy of your personal data, pending verification 

• we have processed your personal data unlawfully and you request restriction rather than erasure 

• Plugit no longer needs the data for processing purposes but you require it for the establishment, exercise, or defence of a legal claim 

• you have objected to processing on grounds of your personal situation and are awaiting a determination on whether Plugit’s legitimate interests override your objection 

9.5 Right to data portability 

Where you have provided your personal data to us directly (for example by registering on the service), you have the right to receive that data in a structured, commonly used, and machine-readable format, and to transfer it to another controller, provided that: 

• we process the data automatically; and 

• the processing is based on your consent or is required for the performance of a contract (e.g. the contract for the backend system service) 

This right is limited to data portability that does not interfere with another individual’s rights or freedoms. We will not deliver another individual’s personal data to you or to another controller, nor transfer material that may qualify as Plugit business secrets. 

The right to data portability does not apply where processing is based on Plugit’s legitimate interest. 

9.6 Right to object to processing 

You have the right to object to the processing of your personal data on grounds relating to your particular situation, where processing is based on legitimate interest and there is insufficient justification that overrides your rights and freedoms. 

You also have the right to object to your personal data being processed for direct marketing purposes, including related profiling. After you exercise this right, we will no longer send you direct marketing or process your data for that purpose. 

10. Right to lodge a complaint with the supervisory authority 

You have the right to lodge a complaint with the relevant data protection supervisory authority if you consider that Plugit has infringed applicable data protection legislation or that your rights under the GDPR and/or applicable national data protection legislation have been violated. 

Finland — Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Lintulahdenkuja 4, 00530 Helsinki, Finland Email: tietosuoja@om.fi Website: tietosuoja.fi 

Sweden — Swedish Authority for Privacy Protection (IMY, Integritetsskyddsmyndigheten) Box 8114, 104 20 Stockholm, Sweden Email: imy@imy.se Website: imy.se/en 

You may lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work. 

11. Sources of personal data 

Personal data is collected primarily from the data subject themselves. Additional sources include cooperation partners and car showrooms. Personal data may also be collected from the organisation the data subject represents, and from systems Plugit uses to collect data relating to the data subject. 

12. Security of processing 

Personal data in electronic form is protected by technical measures generally accepted within the data security sector, such as firewalls and passwords. Access to the electronic register is restricted to the identified data controller and to employees of cooperating companies who have been designated by the controller and granted personal user rights. Physical material containing personal data is protected by physical and organisational security measures, including restricting access to the material. 

13. User tracking 

In addition to cookie-based tracking (please see our cookie policy for further information), we use user tracking provided by Leadoo to understand how users interact with our website. We combine such usage data with data collected through our website’s chat function when a visitor interacts with us via chat. Leadoo uses so-called etag tracking, which is technically different from cookie-based tracking but is subject to the same principles as cookies. 

For further information on Leadoo tracking, please refer to the privacy policy of Leadoo Marketing Technologies Oy (leadoo.com/privacy-policy/). From a GDPR perspective, Plugit acts as the data controller and Leadoo acts as the data processor. 

User tracking on our website is based on voluntary consent, which you can give when visiting our website for the first time. You can withdraw your consent at any time and manage cookies, etags, and other website tracking through your browser settings, or by contacting us at gdpr@plugit.fi. We recommend that you also clear your browser’s cache memory if you disable website tracking based on cookies and similar technologies.