We are Gridio 2.0 OÜ, a private limited company registered in Estonia (registry code 14494626, registered address Peetri 11, 10414 Tallinn, email support@gridio.io) (“Gridio”, “we”, “us” or “our”). We operate the website https://www.gridio.io/ and the Gridio platform, which may be made available to you either directly (e.g. through our website or application) or through third-party partners, including energy providers (“Partner”).
The purpose of this privacy policy (“Privacy Policy”) is to provide clear and transparent information on how we may process your personal data when you are using our Platform. If you have questions about how we process your Personal Data, or if you wish to submit requests for exercising your rights involved in the processing of your Personal Data, please contact us using the contact details provided in this Privacy Policy.
In this Privacy Policy the following terms have the following meanings:
“Device” means any connected device, including electric vehicles (“EVs”), used with the Services.
“Partner” means any energy supplier, charge point operator or other business through whose application or services you may access the Platform.
“User” or “you” means any natural person who accesses or uses the Platform.
“Data Subject” means a natural person whose personal data is processed by Gridio.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Applicable Law” means all valid European Union legal acts and all valid legal acts of the Republic of Estonia, including, but not limited to, the national implementation acts for the GDPR which are applicable during the validity of these terms and conditions or shall be applicable after the terms and conditions enter into force.
“OEM” means the manufacturer of a Device or provider of connected vehicle services.
“Privacy Policy” means this document on personal data processing.
“Services” means the services provided by Gridio.
“Terms” means the terms of service concluded between Gridio and you, available on the Website.
“Data Controller” means a natural or legal person, public sector authority, agency or other body who, alone or jointly with others, determines the purposes and means of the personal data processing. The allocation of roles is set out in Section 2.
“Data Processor” means a natural or legal person, public sector authority, agency or other body who processes the personal data on behalf of the controller.
2.1 When you use our Services, Gridio processes Personal Data to enable you to create and manage an account, connect your Device, and use the functionalities of the Platform.
2.2 Where you use the Platform directly, Gridio acts as an independent Data Controller for Personal Data processed for the purposes described in this Privacy Policy.
2.3 Where the Services are provided through a Partner's application, such third party may act as an independent controller for data processed within their environment. In certain cases, Gridio may act as a Data Processor on behalf of such third party in relation to specific processing activities required to provide the Services. Where you use a partner-branded version of SmartCharge+ or the Gridio connection flow inside a Partner's product, the Partner is the controller of the personal data you provide to use its smart charging service: your account and contact details, energy contract details, registered charging location, charging preferences and settings, usage data generated in the application, and support requests. Gridio processes that data on the Partner's behalf and the Partner's privacy notice applies to it. Gridio remains an independent controller of the vehicle and device data it obtains from the car or device maker, and of the crash reports and error logs needed to keep the applications running. Where you sign in through the Partner, the identifier the Partner provides is likewise processed on the Partner's behalf.
2.4 This Privacy Policy applies to the Gridio application, to SmartCharge+ including partner-branded versions of it, and to the Gridio connection flow made available inside a Partner's product. The Partner's own service is governed by the Partner's terms and privacy notice.
2.5 When using our Services, we may process the following categories of Personal Data. Data marked as required in the application is necessary to provide the Services; without it the relevant functionality is not available.
2.5.1 Account and contact data, including name (first and last name), e-mail address, phone number, the energy contract details you enter (country, electricity supplier, tariff type, prices and time blocks), and the charging location you register (address or postal code);
2.5.2 Account and authentication data, including login credentials and authentication data (including third-party login providers such as Apple or Google or, where you sign in through a Partner, the login data the Partner provides);
2.5.3 Device and vehicle data, including EV model, EV name, EV VIN, for some vehicle makers the licence plate, EV consumption and charging data, energy device data such as solar production or battery state, verification data an OEM requires such as an odometer reading, device account data required to enable connection with OEM systems, and vehicle location, which Gridio uses only to check whether the vehicle is at your registered charging location (at home or away) and only where the OEM provides it and you have allowed it;
2.5.4 Technical and usage data, including application usage data, device and operating system information, push notification tokens, IP address, error logs and diagnostic data;
2.5.5 Purchase data, including subscription or purchase status and receipts as provided by Apple or Google.
3.1 Data processing for contract performance. Gridio processes Personal Data primarily for the purposes of performing the contract with the User and providing the Services. This includes enabling the User to register and manage an account, authenticate access (including through third-party identity providers), connect and manage Devices, and use the functionalities of the Platform, including smart charging and energy optimisation features. Smart charging means that Gridio schedules when your vehicle charges, using electricity prices, your ready-by time and charge settings and, where connected, your solar production; you can override it at any time by starting or pausing charging in the application.
3.2 Processing also includes the exchange of data with connected Devices and OEM systems, as well as the use of technical tools necessary to ensure the proper functioning, reliability and performance of the Services, including diagnostics, error monitoring and service-related analytics. Gridio also processes usage and diagnostic data to improve the Services (Article 6(1)(f) GDPR).
3.3 The legal basis for such processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract). Where a Partner is the controller, the legal basis is the Partner's contract with you.
3.4 Data processing for the performance of a legal obligation. Gridio processes Personal Data also where it is required to perform legal obligations applicable to Gridio. For example, if a court requests Personal Data from Gridio under an applicable court order or court judgement, or if a law enforcement agency requests Personal Data under an applicable regulation. Also, if Gridio is obliged to retain Personal Data, for example under the Accounting Act or other applicable legal acts. In case of such processing, the legal basis is Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the Data Controller is subject).
3.5 Data processing on the basis of legitimate interest. Gridio may process Personal Data on the basis of legitimate interest in situations where such processing is necessary for Gridio's operations and where these interests are not outweighed by the rights and freedoms of the Data Subject. For example, where processing is necessary to prepare, submit or defend legal claims (for example, claims related to a breach of the Terms). In such case, the legal basis is Article 6(1)(f) of the GDPR.
Gridio may also have a legitimate interest in processing personal data if this is necessary to ensure the technical functionality of the Platform (please see Section 7 (Cookies) below). The data processed on the basis of legitimate interest shall be retained in compliance with the general statutory limitation period for claims. More details on the retention periods can be found in Section 4 (Overview of processed personal data) below.
The Personal Data processed may vary depending on how the Services are accessed and the relationship between the parties (for example, whether Gridio acts as an independent controller). Where a Partner is the controller, retention follows the Partner's instructions. Gridio processes the following Personal Data to provide the Services:
Providing the Services
Collected personal data: Email address, phone number, country of residence, Device identifiers, EV model, EV name, VIN, EV consumption data, charging preferences, registered charging location, technical usage data.
Legal basis: GDPR Article 6(1)(b); after termination of the contract, GDPR Article 6(1)(f).
Retention period: For the duration of the provision of the Services and the existence of the User account. After termination or deletion of the account, only such Personal Data is retained for up to 3 years as is necessary for the establishment, exercise or defence of legal claims.
Account management
Collected personal data: Email address, login credentials, authentication data, account settings, account status, session and login logs.
Legal basis: GDPR Article 6(1)(b); after termination of the contract, GDPR Article 6(1)(f).
Retention period: For the duration of the account and until deletion of the account.
Device connection and charging optimisation
Collected personal data: EV status data (e.g. battery level, charging state), EV consumption data, charging schedules, limited location data (charging location verification), Device identifiers, technical connection data (e.g. tokens).
Legal basis: GDPR Article 6(1)(b); after termination of the contract, GDPR Article 6(1)(f).
Retention period: Detailed Device status data is deleted or anonymised within 90 days after it has served its purpose. Aggregated charging sessions and savings are kept for the duration of the use of the Services.
User support
Collected personal data: Email address, communication content, support requests, any additional information voluntarily provided by the User.
Legal basis: GDPR Article 6(1)(f).
Retention period: Up to 3 years from the last interaction or resolution of the request.
Accounting documents
Collected personal data: Documents required for the performance of a legal obligation.
Legal basis: GDPR Article 6(1)(c).
Retention period: As required by applicable law (e.g. up to 7 years under accounting laws).
Data collected with cookies See Section 7 (Cookies).
5.1 Gridio shares Personal Data only where necessary for the Services or required by law, with the following categories of recipients:
5.1.1 OEMs and connected-vehicle service providers: to connect your Device, Gridio sends identifiers and charging commands to the OEM and receives Device data in return. The OEM and its brands process this data under their own privacy policies. Vehicle makers require that the vehicle's primary user informs other drivers and passengers that vehicle data is collected while the primary user is logged in;
5.1.2 your Partner, where you access the Platform through one: Gridio makes the data the Partner controls (see Section 2) available to the Partner on its instructions and, as an independent controller, shares device and vehicle data (including charging data and the charging-location check) with the Partner under a data sharing agreement. Login credentials and access tokens are never shared. The Partner is responsible for its own use of this data, which is described in its own privacy notice;
5.1.3 Apple and Google, as providers of app distribution, sign-in and in-app purchases; in our applications used directly, providers of subscription management and app install measurement;
5.1.4 service providers acting as Gridio's processors for hosting, document and email storage, customer support, error monitoring, analytics and messaging;
5.1.5 public authorities, courts and law enforcement where required by law.
5.2 Gridio primarily stores and processes Personal Data in the European Economic Area (EEA).
5.3 Where Gridio transfers Personal Data outside the EEA, Gridio does so on the basis of a European Commission adequacy decision (Article 45 GDPR, including the EU-U.S. Data Privacy Framework) or ensures appropriate safeguards (Article 46 GDPR), such as Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by technical and organisational measures where required.
5.4 Gridio may use Data Processors for Personal Data processing. Data Processors assigned by Gridio who in limited circumstances may process the Personal Data are IT service providers or other providers of services required for the functioning of the Platform.
5.5 Gridio uses as Data Processors only such partners whose reliability Gridio has verified and who have committed to processing Personal Data in compliance with the Applicable Law.
6.1 Gridio sends you service messages that are part of the Services, for example charging status, connection problems and changes to the Terms, by push notification or email (legal basis: performance of the contract).
6.2 Where you use the Gridio application directly, Gridio may send you news about its own similar products by email as an existing customer. You can opt out at any time in the application settings and via the unsubscribe link in each email.
6.3 Where you access the Platform through a Partner, Gridio does not send you marketing. Any marketing by the Partner is governed by the Partner's own privacy notice and the choices you made with the Partner.
7.1 Our Website uses cookies and similar tools. The cookie banner lists each of them with its purpose and duration, and lets you accept or refuse every tool that is not strictly necessary; you can change your choice at any time through the banner. Advertising platforms receive website visit data only with your consent. Our connection flow stores in your browser only what is needed to run the flow; its analytics run only with your consent.
7.2 You have the right to delete or block (disable) cookies at any time by changing your browser settings. However, some cookies might be necessary for the functionality of the Platform. Cookies can be disabled by following the instructions under the browser's “help” section. More information on how cookies operate or how to disable cookies is also available at www.allaboutcookies.org.
8.1 Our applications include third-party software for crash reporting, push notifications and error monitoring, which is necessary for their operation (legal basis: legitimate interest, or performance of the contract for push notifications), and usage analytics, which runs only with your consent, which you can withdraw in the application settings. Usage analytics is provided by Google and processed in the United States under the EU-U.S. Data Privacy Framework. The current providers are listed in the legal section of the application.
8.2 Our connection flow uses usage analytics, which runs only with your consent, and error monitoring.
9.1 Gridio shall ensure all the rights of the data subject arising from the Applicable Law.
9.2 In particular, the Data Subject shall inter alia have the following rights:
9.2.1 right to access: the right to ask at any time whether Gridio holds any personal data about them or not, and to receive information about which Personal Data Gridio is processing about them;
9.2.2 right to rectification: the right to request from Gridio the supplementation or rectification of their personal data if these are insufficient, incomplete or inaccurate;
9.2.3 right to object: the right to submit objections to Gridio concerning the processing of one's Personal Data, for example if the personal data is processed on the basis of the legitimate interests of Gridio;
9.2.4 right to erasure: the right to request the erasure of Personal Data, for example if the Personal Data are processed based on the Data Subject's consent and the Data Subject has withdrawn their consent;
9.2.5 right to restriction of processing: the right to request from Gridio the restriction of processing of Personal Data under the Applicable Law, for example where Gridio no longer needs the Personal Data for the purposes of the processing or where the Data Subject has objected to processing;
9.2.6 right to withdraw consent: if the processing of Personal Data is based on the Data Subject's consent, the Data Subject has the right to withdraw the consent given to Gridio at any time. Withdrawal does not affect the lawfulness of processing carried out before it;
9.2.7 right to data portability: the right to receive from Gridio the Personal Data that the Data Subject has provided and which are processed on the basis of the Data Subject's consent or for the performance of a contract concluded with the Data Subject, in a structured, commonly used and machine-readable format and, if technically possible, to request that Gridio transfers these data to another Data Controller;
9.2.8 right to lodge a complaint: if you believe the processing of your Personal Data violates your rights, you may complain to the Estonian Data Protection Inspectorate (Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee) or to the supervisory authority of the EU member state where you live or work or where the alleged infringement took place. A list of national authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.
9.3 The rights of the Data Subject listed in this Section regarding the processing of their Personal Data are not absolute rights. In certain cases, the rights of other Data Subjects or the legal obligations of Gridio may limit the rights of the data subject.
9.4 In order to exercise the rights pertaining to the processing of Personal Data, or to submit requests concerning the processing of personal data, please contact us using the contact details provided in Section 12 (Contact) below.
10.1 Gridio shall ensure the security of Personal Data processing, for the purposes of protecting Personal Data from accidental or unauthorised processing, disclosure or destruction.
10.2 Considering the state of the art and costs of implementation, and the nature, scope, context and purposes of the personal data processing as well as the risk to the rights and freedoms of data subjects, of varying likelihood and severity, that may result from personal data processing, Gridio shall apply appropriate technical and organisational measures upon personal data processing to ensure the protection of personal data.
11.1 Upon changes in legal acts or practice, Gridio has the right to make amendments to the Privacy Policy, which shall be immediately published on our Website.
11.2 In case of questions concerning the processing of Personal Data, or to submit requests concerning the processing of Personal Data, please contact Gridio using the details in Section 12 (Contact).
12.1 Gridio 2.0 OÜ, Peetri 11, 10414 Tallinn, Estonia. For privacy questions and to exercise your rights: privacy@gridio.io. If you access the Platform through a Partner, you may also contact the Partner; Gridio and the Partner forward requests to each other where the other party is the controller.
