Privacy policy
What we do with personal data, why we are allowed to, how long we keep it, and how to make us stop. Written to be read rather than to be survived.
Last updated 17 August 2026
Draft — not yet reviewed
This document describes what the site and the platform actually do, in the structure the law requires, but it has not been through legal review and 10 items are still to be completed. Those are marked in place below. The page is served noindex until it is reviewed and signed off.
This policy covers two different things, and it is worth knowing which one applies to you. The first is this website — a marketing site with a contact form on it. The second is the WattWisely charging platform: the operator dashboard, the driver app, and the chargers connected to them.
If you have only visited this website, the answer is short: one cookie that keeps the contact form working, and whatever you typed into that form if you sent it. Nothing else. There is no analytics, no tracking pixel, no advertising network, and no request to any third-party server from any page on this site.
1 Who is responsible
The controller for the processing described here, in the sense of Article 4(7) GDPR, is:
Still to be completed
Registered company name and legal form, registered address, managing director, email, and telephone number. These are the same details the Impressum needs — fill both in together, from the commercial register entry rather than from memory.
General enquiries and data-protection requests can both be sent to the contact address on the imprint page. A request about your own data is dealt with as a data-protection request regardless of which address it arrives at.
Still to be completed
Whether a Data Protection Officer must be appointed. Under §38 BDSG one is required if at least twenty people are constantly engaged in automated processing of personal data, or if the core activity involves regular and systematic monitoring on a large scale. If one is appointed, their contact details belong in this section and in the Impressum.
2 What this website does
Three things, and that is the complete list.
| What happens | Data involved | Legal basis | Kept for |
|---|---|---|---|
| You send the contact form | Name, email address, and your message. Company, telephone number, what you are interested in, and an approximate number of ports if you chose to give them. | Art. 6(1)(b) — steps taken at your request before entering into a contract. Where an enquiry is not about a possible contract, Art. 6(1)(f), our legitimate interest in answering people who write to us. | As long as the enquiry is live, and then for as long as it is reasonable to keep the thread. |
| The form is protected against abuse | A session cookie holding a security token, the time the form was opened, and a count of recent submissions. | Art. 6(1)(f) — our legitimate interest in not having the form used to send spam. Strictly necessary under §25(2) TTDSG, so no consent banner is required for it. | Until you close the browser. |
| The site is served to you | Standard web server access logs kept by our hosting provider, which include IP address, time, the page requested, and the browser's user agent. | Art. 6(1)(f) — our legitimate interest in operating and securing the service. | Set by the hosting provider, not by us. |
Still to be completed
The two retention periods above marked as vague. Pick a real number for contact enquiries — twelve or twenty-four months after the last contact is a defensible answer — and get the actual log retention period out of the hosting provider, in writing, along with the signed data processing agreement under Art. 28 GDPR.
What this website does not do
- No analytics of any kind, first-party or otherwise. Nothing counts your visit.
- No advertising, no remarketing, no tracking pixels, no social media buttons that phone home.
- No third-party requests at all. Fonts are served from our own domain, and the site's Content-Security-Policy blocks any request to another host outright.
- No cookies other than the session cookie described above, and it is not set until you interact with the contact form.
- No profiling and no automated decision-making within the meaning of Article 22.
3 What the charging platform does
The platform is a different matter, because running a charging network means recording who charged where. This section applies if you hold a driver account, use an RFID card on a network we operate, or administer sites on the dashboard.
If you are a driver
| What happens | Data involved | Legal basis | Kept for |
|---|---|---|---|
| You hold an account | Name, email address, a password stored only as a cryptographic hash, and any RFID card identifiers linked to the account. | Art. 6(1)(b) — performance of the contract with you. | For as long as the account exists. |
| You charge | Which port, at which site, start and stop time, energy delivered, and the amount payable. | Art. 6(1)(b) — we cannot bill for a session without recording it. | See the note on billing records below. |
| You pay | Card details are entered into and held by the payment provider. We hold a reference to the payment, not the card. | Art. 6(1)(b). | As long as the payment record is needed. |
| You ask for help | Whatever you tell us, plus enough account context to answer. | Art. 6(1)(b), and Art. 6(1)(f) for general enquiries. | As long as the conversation is useful. |
If you charge on somebody else's site
When you charge at a site run by an operator — an employer, a landlord, a fleet, a business open to the public — that operator can see the sessions on their own site: which account or card started them, when, how much energy, and what was paid. They cannot see your activity anywhere else. That separation is enforced by the platform, not by policy.
For their own site, that operator is a controller in their own right and decides their own retention and their own purposes. For the platform itself we are the controller; where we run the platform on their behalf we act as their processor under Article 28. Which of the two applies to a given site depends on the contract with that operator.
Still to be completed
The controller / processor split needs stating precisely and consistently with the actual customer contract, because it decides who a driver goes to with a request. Get this one confirmed in writing — it is the single most common thing to get wrong on a multi-tenant platform, and the one a supervisory authority asks about first.
Still to be completed
Confirm the exact statutory retention period that applies to charging invoices, and the deletion schedule for everything else — session records that are not invoices, support threads, closed accounts, and RFID card links.
4 Who else sees it
We do not sell personal data, and we do not share it for anyone else's marketing. It is disclosed only where one of the following applies:
- Service providers acting on our instructions — hosting, email delivery, and payment processing — each under a data processing agreement that permits them to use the data only to provide that service.
- The site operator whose charger you used, as described above.
- Roaming partners, where you started a session using another network's app or card, and only the session data needed to settle that session between the two platforms.
- Public authorities, where we are legally obliged to disclose.
Still to be completed
Name the actual processors: hosting provider, outbound mail provider, payment gateway, and any roaming hub. Each needs a signed Art. 28 agreement on file, and each needs to be listed here by name — "service providers" in the abstract is not an Article 13 disclosure.
Transfers outside the EU
Still to be completed
Confirm where data is actually hosted and whether any processor stores or accesses it outside the EU or EEA. If any does, this section must name the country, the safeguard relied on (normally the Standard Contractual Clauses under Art. 46(2)(c)), and how to get a copy. Nothing is asserted here until it has been checked — an unverified "all data stays in the EU" is exactly the kind of claim that is expensive to be wrong about.
5 How it is protected
- Passwords are stored as cryptographic hashes. They are never held in plain form, and nobody at WattWisely can read yours.
- Card details are entered into and held by the payment provider. They do not pass through, and are not stored on, our systems.
- Traffic is encrypted in transit throughout.
- Operators are isolated from one another: one operator cannot see, or affect, another operator's sites or drivers.
- Every charging session is written as an auditable record, so a bill can always be reconstructed from the log rather than from memory.
Still to be completed
Access control and breach procedure. Who inside the company can reach production data, how that access is granted and removed, and the process for meeting the 72-hour notification deadline under Art. 33. This does not have to be described in detail on a public page, but it does have to exist before the page claims the data is protected.
6 Your rights, and how to use them
Under the GDPR you have all of the following. They are free to exercise, and asking does not affect your service in any way.
- Access (Art. 15) — a copy of the personal data we hold about you, and an explanation of what we do with it.
- Rectification (Art. 16) — correction of anything inaccurate or incomplete.
- Erasure (Art. 17) — deletion, except where we are legally required to keep a record.
- Restriction (Art. 18) — a freeze on processing while something is disputed.
- Portability (Art. 20) — your data in a structured, machine-readable format, or sent directly to another provider.
- Objection (Art. 21) — to processing based on legitimate interest, including profiling. There is no direct marketing here to object to.
- Withdrawal of consent (Art. 7(3)) — at any time, where processing rests on consent. Withdrawing does not affect what was lawful before you withdrew.
How to make a request
Write to the contact address on the imprint page. Say what you want and give us enough to identify your records. We answer within one month, as Article 12(3) requires; if a request is genuinely complex we may extend that and will tell you why before the month is out.
Still to be completed
The in-app self-service route. The account holder intends to add data download and deletion in the driver app, which is the right answer — a working export button satisfies Articles 15 and 20 far better than an email queue does. Add the link and describe the route here once it ships. Until then this section deliberately promises only the email route, because promising a button that does not exist is itself a compliance failure.
If you are not satisfied
You can complain to a supervisory authority, in the EU member state where you live, where you work, or where the alleged infringement took place. You do not have to come to us first, though we would rather you did.
Still to be completed
Name the competent lead supervisory authority for the registered seat and give its address. For a company seated in North Rhine-Westphalia that is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen — confirm against the actual registered seat rather than the office address before publishing it.
7 Whether you have to give us anything
No, and nothing here is a statutory requirement to provide data. On the contact form, a name, an email address, and a message are needed for the simple reason that we cannot reply otherwise; everything else on that form is optional and marked as such. For a charging account, the data listed above is what the contract cannot be performed without — without it there is no way to bill a session or to let you back in to your own account.
8 Changes to this policy
When what we do changes, this page changes with it, and the date at the top moves. Where a change materially affects how your data is handled we will tell account holders directly rather than relying on you to re-read the page.
Something here not clear?
If any of this affects a decision you are about to make, ask us rather than guessing. A question about your own data is answered as a data-protection request whichever address it arrives at.