Data Privacy Notice CCTV

1. Subject of this data protection notice

The protection of your personal data is a major and very important concern for us and is taken into account in all our business processes. Personal data means any information relating to an identified or identifiable natural person.

In the following, we would therefore like to inform you with a detailed overview of the processing of your personal data collected via Closed Circuit Television (CCTV) on IONITY charging sites.

^{Please note: Some of our sites are surveilled by the property owner (e.g. the nearby petrol station). IONITY is not in charge of those camera systems. This notice is therefore not applicable for those CCTV.}

Furthermore, we would like to inform you about the rights you are entitled to and the technical and organisational protective measures we have taken with regard to the processing of your data.

2. Name and address of the data controller and service provider

Responsible data controller according to Art. 4 (7) General Data Protection Regulation (“GDPR”) and at the same time service provider in terms of Section 5 the of the German Digital Services Act (“Digitale-Dienste-Gesetz” -DDG) is

IONITY GmbH
Moosacher Strasse 84
80809 Munich
Germany
info@ionity.eu

See our imprint for further details.

If you have any questions or comments about this protection policy or about data protection in general you can contact our data protection officer as follows:

IONITY GmbH
Data Protection Officer
Moosacher Strasse 84
80809 Munich
Germany
dataprotection@ionity.eu

3. Collection and use of data

Our CCTV is used to capture and monitor images of events that take place on specific charging sites in real time. The images are also recorded on a hard drive for a defined retention period. We use different types of cameras: some cameras are focussed on a fixed location, in exceptional cases we may also use a camera with dynamic angle settings and a zoom functionality that may be operated and set remotely.

The cameras record any movement within the surveilled area together with time, date and location. All cameras operate 24 hours a day, seven days a week. The image quality in most cases identification of those in the camera's area of coverage.

The cameras will capture all environmental data of the camera's area of coverage, including persons, vehicle number plates and drivers located within the area of coverage.

4. Purpose and legal basis of the data processing

We operate CCTV because it is necessary to protect legitimate interests of IONITY or a third party (Article 6 (1) (f) GDPR). In detail:

• Protecting the health and safety of our customers
• Protecting property and infrastructure on our charging sites
• Ensuring the efficient operation of our charging sites
• The exercise or defence of legal claims
• Prevention and detecting criminal acts.

5. Protection and safeguards

We as well as our contractually bound processors are utilising the most up to date technical and organisational security measures to protect your data from accidental or deliberate manipulation, loss, deletion or unauthorised access. Those security measures will be continuously improved upon in line with technological developments.

6. Service providers and data transfer to third parties

In order to fulfil the aforementioned purposes, your personal data is passed on to service providers supporting us in maintenance services and efficient operation of our camera systems. All service providers are carefully selected and commissioned in writing according to the requirements of the General Data Protection Regulation. These service providers are bound by our instructions and are regularly monitored by us. Other recipients are competent authorities for the purpose of law enforcement (e.g. law enforcement agencies).

Your data will otherwise only be passed on to other third parties if this data protection notice expressly refers to this or if we are legally obliged to transfer personal data.

7. Data transfers to third countries

Our CCTV is stored on servers hosted within the European Union and in accordance with the requirements of the General Data Protection Regulation.

8. Automated decision-making

No automated decision-making takes place.

9. Deletion of personal data

The images and videos are retained for a maximum of 72 hours. Thereafter, all images and videos are deleted. If any image or video needs to be stored to further investigations or as evidence, they may be retained as necessary.

10. Your rights

a. Your rights

You have the right to ask us to confirm whether personal data concerning you is being processed; if this is the case, you have the right to obtain information about this personal data and the information specified in Art. 15 of the GDPR.

You have the right to demand that we correct incorrect personal data relating to you without delay and, if necessary, complete incomplete personal data (Art. 16 GDPR).

You have the right to demand from us that personal data concerning you be deleted immediately if one of the reasons listed in Art. 17 GDPR applies in detail, e.g. if the data is no longer required for the purposes pursued (right to deletion).

You have the right to request us to restrict processing if one of the conditions listed in Art. 18 GDPR is met, e.g. if you have lodged an objection to processing, for the duration of the examination by us.

You have the right to object at any time to the processing of personal data concerning you for the purposes of direct marketing. You also have the right to object at any time to processing operations carried out pursuant to Article 6 (1) (e) or (f) GDPR for reasons arising from your particular situation (Article 21 GDPR). We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

You have the right to revoke any consent you have given us at any time with effect for the future (right of revocation).

You have the right to receive from us the data concerning you which you have provided us with in a structured, common and machine-readable format. You may also transmit this data to other bodies or have it transmitted by us (right to data transferability).

To exercise your rights, please contact: support@ionity.eu.

b. Complaint with the data protection authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you is in breach of the GDPR (Art. 77 DPA).

In Bavaria the competent supervisory authority is Bavarian State Office for Data Protection Supervision, Postfach 606, 91511 Ansbach, www.lda.bayern.de.

10. Version and updates of this data protection statement

We will update our data privacy policy from time to time as our data processing is subject to changes. You will find the most up to date data privacy policy in our privacy information page www.ionity.eu/policies . You can also contact us (dataprotection@ionity.eu) to ask for the latest version.

Last update: November 2023