1. Data Controller Information
This Privacy Policy explains how The Charge Grid, commercially operated by C&H EUROPE BV (registered in Belgium under CBE/KBO number 0729.731.988, with registered offices at Spoorwegstraat 51, 2600 Antwerp, Belgium, VAT: BE 0729.731.988), collects, stores, processes, and safeguards personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR") and the Belgian Data Protection Act of 30 July 2018.
For any privacy inquiries or to exercise statutory data protection rights, you can reach our designated Data Protection Officer (DPO) at privacy@thechargegrid.com.
2. Scope & Categories of Data Subjects
This policy applies to all personal data collected in connection with:
- Electric vehicle drivers utilizing The Charge Grid mobile application or RFID charging cards;
- Charge Point Operators (CPO), property managers, and fleet managers managing charging infrastructure;
- Employees utilizing employer-sponsored split-billing domestic charging reimbursement;
- Visitors to our official websites, web portals, and configurator tools.
3. Categories of Personal Data Collected
3.1 User Identity & Contact Information
Name, title, physical billing address, installation site address, telephone number, email address, corporate entity name, and VAT registration number.
3.2 eMSP Mobility & Charging Detail Records (CDRs)
RFID token unique identifiers (UIDs), virtual card tokens, station ID, connector ID, charging session start and stop timestamps, total energy delivered (kWh), instantaneous power curves, raw meter readings, applied tariff rates, and financial transaction IDs.
3.3 CPO Infrastructure & Telemetry Data
Charge point serial numbers, internal device identifiers, IP addresses connecting via OCPP 1.6J or 2.0.1, firmware execution logs, error codes, and vehicle-side telemetry (such as battery State of Charge - SoC % and battery temperature where supported via ISO 15118 protocols).
3.4 Split-Billing & Employee Fleet Reimbursement
For corporate charging programs: employee residential charging station ID, linked employer code, vehicle registration plate, and employee bank account number (IBAN / BIC) strictly utilized to disburse monthly domestic electricity cost reimbursements.
3.5 Mobile Application & Geolocation Data
Device model, mobile operating system version, push notification tokens, IP address, and ephemeral GPS coordinates (only processed when searching for nearby chargers or utilizing turn-by-turn navigation, strictly subject to explicit operating system location permissions).
3.6 Payment & Transaction Data
Payment tokens and SEPA Core/B2B mandate references. Note: Credit card transactions are processed directly by certified PCI-DSS Level 1 payment service providers (such as Stripe); full payment card numbers are never stored on The Charge Grid servers.
3.7 Smart Energy Management (GRID-EMS / GEMS), Solar & Battery Telemetry
Digital utility meter P1 port readings, 15-minute rolling grid capacity peaks, photovoltaic (PV) solar inverter generation curves, battery State of Charge (SoC) and State of Health (SoH) diagnostics, and automated day-ahead tariff optimization schedules processed locally on the GRID-EMS edge controller and synchronized with the GRID-EMS-SERVER cloud portal.
3.8 E-Commerce Storefront, B2B Portal, Serial Number Registry & Field Installation Records
Online storefront (/shop) and B2B purchase order histories, warehouse hardware serial number allocations (for manufacturer warranty validation and RMA traceability), tokenized quotation proposals (/quote/proposal/{token}), customer helpdesk support tickets and attachments (/tickets), and technician field run-sheet records (including earthing dispersion resistance Ω measurements, installation compliance photos, and digital customer completion signatures).
4. Purposes of Processing & Legal Bases (Art. 6 GDPR)
| Processing Purpose | Categories of Data | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Execution of EV charging sessions, RFID authentication & payment settlement | Identity, RFID UID, CDRs, payment tokens | Performance of a Contract (Art. 6(1)(b)) |
| Automated employer split-billing reimbursement calculations | Employee IBAN, kWh telemetry, employer billing code | Performance of a Contract (Art. 6(1)(b)) |
| Tax, fiscal accounting, and legal invoicing obligations | Invoices, VAT records, transaction receipts (kept 7-10 years) | Legal Obligation (Art. 6(1)(c)) |
| Compliance with EU AFIR Regulation (EU) 2023/1804 reporting | Aggregated charging session logs & availability metrics | Legal Obligation (Art. 6(1)(c)) |
| Smart charging, Dynamic Load Balancing & OCPP network security | OCPP logs, IP addresses, meter values, load telemetry | Legitimate Interests (Art. 6(1)(f)) |
| Marketing newsletters, product updates, and non-essential cookies | Email address, web browsing preferences | Consent (Art. 6(1)(a)) |
| GRID-EMS peak shaving, solar/battery optimization & DSO grid compliance | P1 meter telemetry, inverter/BESS SoC, 15-min capacity peaks | Performance of a Contract (Art. 6(1)(b)) & Legitimate Interests (Art. 6(1)(f)) |
| Storefront/B2B order fulfillment, hardware serial warranty registry & AREI certification | Order details, hardware serial numbers, technician run-sheets & earthing records | Performance of a Contract (Art. 6(1)(b)) & Legal Obligation (Art. 6(1)(c)) |
5. Data Sharing & European Roaming Interoperability
We do not sell personal data to third parties. We share data only with authorized recipients under strict data processing agreements (DPAs):
- Roaming Hubs & Clearinghouses (OCPI): When charging at roaming partner stations, token IDs and CDRs are exchanged via OCPI protocols with clearing networks (e.g., Hubject, Gireve, e-clearing.net) to authorize and clear transactions.
- Employers & Fleet Managers: For fleet drivers, charging session summaries (kWh, timestamps, location, costs) are transmitted to the employer's portal for split-billing verification.
- Distribution System Operators (DSOs): Aggregated and pseudonymized load telemetry may be shared with grid operators for local grid congestion management and flexibility markets.
- Accredited Technical Subcontractors: Certified electricians and inspection bodies (e.g., Vinçotte, BTV) for physical installation and statutory AREI certification.
- Cloud & IT Infrastructure Providers: European data center hosts, database management platforms, and transactional communication gateways (SMS/email).
6. International Data Transfers
All primary databases and processing operations are hosted within data centers situated in the European Economic Area (EEA). Where ancillary technical service providers (such as communication tools) process data outside the EEA, transfers are governed by standard contractual clauses (SCCs) approved by the European Commission, ensuring equivalent GDPR data protection.
7. Data Retention Periods
- Fiscal & Invoicing Records (including CDRs): Retained for seven (7) to ten (10) years in compliance with Belgian accounting, tax, and VAT statutory limitation periods.
- User Account Profiles: Retained for the duration of the active customer relationship plus two (2) years following account closure.
- Technical Telemetry & OCPP Logs: Retained for twelve (12) to twenty-four (24) months for network stability, diagnostic analytics, and load profile optimization.
- Mobile App Geolocation: Ephemeral; processed in memory during search/routing and discarded immediately without persistent trajectory logging.
8. Technical & Organizational Security Measures
The Charge Grid enforces robust cybersecurity controls:
- Full TLS 1.3 encryption in transit for all web, app, and OCPP communication;
- AES-256 bit encryption at rest for sensitive data and payment tokens;
- Role-Based Access Control (RBAC) and mandatory multi-factor authentication (MFA) for administrative access;
- Continuous vulnerability monitoring, automated threat detection, and periodic penetration audits.
9. Your Statutory Data Subject Rights
Under Chapter III of the GDPR, you possess the following enforceable rights:
- Right of Access (Art. 15): Request confirmation and a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Update or correct inaccurate or incomplete data.
- Right to Erasure / "To be Forgotten" (Art. 17): Request deletion of data no longer required for contractual or statutory compliance.
- Right to Restriction (Art. 18): Restrict processing under contested circumstances.
- Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format (e.g., JSON/CSV).
- Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.
To exercise any of these rights, email privacy@thechargegrid.com. We will respond within thirty (30) days.
10. Right to Lodge a Complaint with a Supervisory Authority
If you believe that The Charge Grid has processed your data in violation of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority:
Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD)
Drukpersstraat 35, 1000 Brussels, Belgium
Email: contact@apd-gba.be
Website: www.gegevensbeschermingsautoriteit.be
11. Automated Decision-Making & AI Transparency (GDPR Art. 22 & EU AI Act)
The Charge Grid does not subject users or customers to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them within the meaning of Article 22 of the GDPR. In accordance with the transparency obligations of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), where our platform provides optional AI-assisted features (such as automated knowledge-base article suggestions in our support helpdesk or indicative executive summaries in solar and battery configuration proposals), such outputs are strictly informational and remain subject to human review and verification.