PERSONAL DATA PROCESSING POLICY

1. Data Controller and Contact

The controller of your personal data for end consumers (B2C on ev-pie.com) and business partners (B2B on ev-pie.biz) is the aforementioned company Jomatec Engineering s.r.o.

If you have any questions regarding privacy or wish to exercise your rights, you can contact us at the following e-mail addresses:

• For the consumer platform (B2C): info@ev-pie.com
• For the corporate platform (B2B): info@ev-pie.biz

2. What Personal Data Do We Process?

We only process data that is necessary for the proper provision of our Services (software diagnostics of vehicle batteries) and the delivery of hardware:

• Registration and profile data: E-mail address and your chosen password (in encrypted form).
• Identification and address data (for the delivery of the EVP-1 device): First and last name, delivery address. For entrepreneurs (B2B) additionally: company name, company ID, VAT ID, and billing address (if different from delivery).
• Technical vehicle data (read during the Dynamic Test): Vehicle identification number (VIN code), battery state of health (SOH), individual cell voltages, operating currents, component temperatures, and other operational and system parameters of the vehicle at the time of the test.
• Location data (GPS): The mobile application may require access to your mobile device's location for the purpose of validation and proper evaluation of the test drive during the test being performed. The app only accesses location data during active testing and never tracks location outside this process.
• Payment data: Data on completed payments and purchased credits. Note: We do not process your payment card data ourselves; this is done directly by a certified payment gateway provider (Stripe). We only pass basic details (e-mail, name, order ID) to Stripe, Inc. to process and match the payment. You enter the actual payment card details into Stripe’s secure interface, which ensures encrypted and safe card transactions. In connection with using this payment gateway, personal data may be transferred to the USA. The transfer takes place based on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework.

3. Cookies and Similar Technologies

Our websites use cookies and similar technologies for the following purposes:

• Technical (necessary) cookies: These cookies are essential for the proper functioning of the website, logging into your user account, secure communication with the server, proper page loading, and completing an order. Technical cookies are stored automatically and cannot be turned off.
• Analytical cookies: We use these only based on your consent via the cookie banner. They help us understand how users interact with the website, measure traffic, and improve functionality and the user experience. If you grant consent, your data may be shared with analytical tool providers (e.g., Google Analytics).
• Marketing cookies: We use these only based on your consent. They allow us to display relevant content, measure advertising campaign performance, and potentially collaborate with third-party advertising platforms. Marketing cookies are not stored without your consent.
• Retention period: The retention period for individual cookies varies depending on their type and purpose. Specific durations are listed in the cookie banner settings.

Detailed information on individual types of cookies, their purpose, retention periods, and involved third parties is provided in the "Cookie Settings" section, accessible from the website footer.

4. Legal Basis and Purpose of Processing

We process your data based on the following legal grounds:

1. Performance of a contract (Art. 6(1)(b) GDPR):
   • Creating and managing your user account on our websites or within the app.
   • Dispatch and delivery of the EVP-1 hardware dongle to your address.
   • Performing the Dynamic Test software diagnostics, and generating and delivering the Battery test report document.
2. Compliance with a legal obligation (Art. 6(1)(c) GDPR):
   • Issuing tax documents (invoices) and maintaining accounting records in accordance with valid Czech laws (particularly the VAT Act and the Accounting Act).
3. Legitimate interest (Art. 6(1)(f) GDPR):
   • Improving our diagnostic algorithm and software based on technical vehicle data.
   • Protecting our systems and hardware against misuse, fraud, reverse engineering, and cyber attacks.
   • Sending operational e-mails (e.g., mandatory warnings regarding the impending deletion of a long-inactive account).
   • Sending commercial communications (newsletters) to our customers with offers of our related products and services. You can unsubscribe from these e-mails at any time, free of charge, using the link in the footer of every e-mail.

5. Who Do We Share Your Data With? (Data Recipients)

We do not sell or provide personal data to third parties for marketing purposes. However, to ensure the operation of our Services, we use vetted subcontractors (processors) with whom we have proper data processing agreements in place:

• Server and cloud infrastructure provider: Websupport s.r.o. (data is securely stored on servers within the European Union – Slovakia).
• Payment processing: Stripe, Inc. (we pass order identification data to them for payment authorization; the actual payment card data is processed by Stripe directly, outside our systems).
• Delivery services: Courier, parcel, and postal companies (exclusively for delivering the package with the EVP-1 Device to your address).

6. How Long Do We Keep the Data?

• We retain data necessary for account management and test execution for the entire existence of your user account.
• In accordance with our GTC, we reserve the right to delete a user account that has been inactive for more than 12 months (i.e., no login occurred, and no credit was used). Before deleting the account and user data, we provide a 30-day advance warning via e-mail.
• We keep accounting documents, invoices, and related identification data for 10 years from the end of the tax period, as required by Czech financial and tax regulations.
• Technical data read from vehicles may be fully anonymized after your account is deleted and further used for statistical purposes and the development of the EVpie diagnostic algorithm. It is no longer possible to identify any specific person from this data.

7. What Are Your Rights Under GDPR?

As a data subject, you have the following statutory rights, which you can exercise via the contact e-mails listed above:

• Right of access: You have the right to know what data we process about you and to obtain a copy of it.
• Right to rectification: If your data (e.g., delivery address) is inaccurate or incomplete, you have the right to its immediate correction.
• Right to erasure ("right to be forgotten"): You may request the deletion of your account and personal data if it is no longer necessary for the performance of a contract and if we do not have a legal obligation to further archive it (e.g., for tax purposes).
• Right to restriction of processing: In legally defined cases, you can request that we temporarily lock your data and cease working with it.
• Right to data portability: You can ask us to export your registration data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to processing that is based on our legitimate interest (Art. 21 GDPR).
• No automated decision-making: We declare that no automated decision-making or profiling with legal effects for you takes place within our Services. Diagnostic results are for informational purposes only and do not constitute an automated decision with legal effects.

If you believe that we are handling your personal data in violation of legislation, you have the right to file a complaint with the supervisory authority, which in the Czech Republic is the: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7 (web: www.uoou.cz).

8. Data Security

We have implemented modern technical, systemic, and organizational measures to protect your personal data against loss, misuse, leakage, or unauthorized access. All communication between the EVpie mobile application, web interface, and our servers (including payments via the Stripe gateway) takes place exclusively in encrypted form using HTTPS / SSL protocols. Access to databases is subject to strict access rights management. Only authorized persons bound by confidentiality have access to personal data.