PRIVACY POLICY

Jomatec Engineering s.r.o., with its registered office at Kratochvílova 779/3, 750 02 Přerov, Czech Republic, Company ID (IČO): 06380808, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, Insert 101763 (hereinafter referred to as the “Controller” or “we”), takes the protection of your personal data very seriously.

This Privacy Policy describes how we collect, process, and protect the personal data of users of the websites ev-pie.com and ev-pie.biz and the EVpie mobile application (hereinafter collectively referred to as the “Services”), in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the “GDPR”) and Czech data protection laws, in particular Act No. 110/2019 Coll., on the Processing of Personal Data, as amended.

1. Personal Data Controller and Contact Details

The controller of your personal data for both end consumers (B2C on ev-pie.com) and business partners (B2B on ev-pie.biz) is the above-mentioned company Jomatec Engineering s.r.o.

If you have any questions regarding privacy protection or wish to exercise your rights, you can contact us at the following email addresses:

• For the consumer platform (B2C): info@ev-pie.com

• For the business platform (B2B): info@ev-pie.biz

2. What Personal Data Do We Process?

We only process data that are strictly necessary for the proper provision of our Service (vehicle battery software diagnostics) and hardware delivery:

• Registration and profile data: Email address and your chosen password (stored in a securely hashed/encrypted form).

• Identification and address data (for delivery of the EVP-1 device): First name and surname, delivery address, and optionally a telephone number for the courier. For business users (B2B) additionally: company name, Company ID (IČO), Tax/VAT ID (DIČ), and billing address (if different from the delivery address).

• Technical vehicle data (read during the Dynamic Test): Vehicle Identification Number (VIN code), battery State of Health (SOH), individual cell voltages, operating currents, component temperatures, and other operating and system parameters of the vehicle at the moment of the test.

• Location data (GPS): The mobile application may request access to the location of your mobile device for the purpose of validating and properly evaluating the test drive as part of the performed test. The application accesses location data only during the active execution of a test and never tracks your location outside of this process.

• Payment data: Data on completed payments and purchased credits. Note: Your payment card details are not processed by us, but directly by the certified payment gateway provider (Stripe). For the purpose of processing and matching the payment, we only transmit basic data (email, name, order ID) to Stripe, Inc. You enter the payment card details themselves directly into the secure Stripe interface, which ensures encrypted and secure card transactions. In connection with the use of this payment gateway, personal data may be transferred to the USA. Such transfers take place on the basis of the European Commission’s adequacy decision under the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses (SCCs) of the European Commission pursuant to Article 46 of the GDPR.

3. Cookies and Similar Technologies

Our websites use cookies and similar technologies that serve the following purposes:

• Technical (strictly necessary) cookies: These cookies are necessary for the proper functioning of the website, logging into the user account, secure communication with the server, proper page loading, and completing an order. Technical cookies are stored automatically and cannot be disabled.

• Analytical cookies: We use these only on the basis of your prior consent given via the cookie banner. They help us understand how users use the website, measure traffic, and improve functionality and user experience. If you grant consent, your data may be transferred to providers of analytical tools (e.g., Google Analytics).

• Marketing cookies: We use these only on the basis of your prior consent. They allow us to display relevant content, measure the performance of advertising campaigns, and potentially cooperate with third-party advertising platforms. Without your consent, marketing cookies are not stored.

• Retention period: The retention period of individual cookies varies depending on their type and purpose. Specific periods are listed in the cookie banner settings.

Detailed information about the individual types of cookies, their purpose, retention period, and involved third parties is provided in the “Cookie Settings” section accessible from the website footer, where you can change or withdraw your consent at any time.

4. Legal Basis and Purpose of Processing

We process your data on the basis of the following legal grounds:

1. Performance of a contract (Article 6(1)(b) GDPR):

   • Creation and administration of your user account on our websites or in the application.

   • Dispatch and delivery of the EVP-1 hardware dongle to your address.

   • Execution of the Dynamic Test software diagnostics, generation, and delivery of the Battery test report document.

2. Compliance with a legal obligation (Article 6(1)(c) GDPR):

   • Issuing tax documents (invoices), handling warranty claims or exercised consumer rights, and maintaining accounting records in accordance with applicable laws of the Czech Republic (in particular the VAT Act, the Accounting Act, and the Consumer Protection Act).

3. Legitimate interest (Article 6(1)(f) GDPR):

   • Improving our diagnostic algorithm and software based on technical data from vehicles.

   • Protecting our systems and hardware against abuse, fraud, reverse engineering, and cyberattacks.

   • Verifying the authenticity and integrity of generated Reports (via the original QR code or Report number), preventing their falsification, and establishing, exercising, or defending our legal claims (in particular dispute resolution, debt recovery, and contractual penalties).

   • Sending operational emails (e.g., mandatory notice of upcoming deletion of a long-term inactive account).

   • Sending commercial communications (newsletters) to our existing customers offering our related products and services in accordance with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services. You may refuse the sending of these emails at the time of purchase or unsubscribe at any time free of charge using the link in the footer of every email.

4. Consent to processing (Article 6(1)(a) GDPR):

   • Storing and using analytical and marketing cookies, or sending marketing communications where you are not our customer. You may withdraw your granted consent at any time (in the cookie settings on the website or by sending a request to our contact email), without affecting the lawfulness of processing based on consent before its withdrawal.

5. With Whom Do We Share Your Data? (Data Recipients)

We do not sell or provide personal data to third parties for their own marketing purposes. However, to ensure the operation of the Services and fulfill statutory obligations, we use vetted subcontractors (processors) and recipients with whom we have concluded proper data processing agreements:

• Server and cloud infrastructure provider: Websupport s.r.o. (data are securely stored on servers within the European Union – Slovakia).

• Payment processing: Stripe, Inc. (we transmit order identification details for payment authorization; payment card data themselves are processed directly by Stripe outside of our systems).

• Delivery services: Courier, parcel, and postal companies (exclusively for the purpose of delivering the parcel containing the EVP-1 Device to your address).

• Analytical tool providers and professional advisors: Providers of analytical and marketing platforms (e.g., Google Ireland Limited – exclusively if you have granted cookie consent) and external accounting, tax, or legal advisors bound by a statutory or contractual duty of confidentiality. Where data are transferred outside the EU/EEA (e.g., to the USA), such transfers take place exclusively on the basis of an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or Standard Contractual Clauses (SCCs) pursuant to Article 46 of the GDPR.

6. How Long Do We Retain Data?

• We retain data necessary for account administration and performing tests for the entire duration of your user account.

• In accordance with our GTC, we have the right to delete a user account that has been inactive for more than 12 consecutive months, under the conditions set out in the applicable B2C GTC or B2B GTC (for B2C consumer accounts, where the user has not logged in for more than 12 months and the credit balance is zero; for B2B partner accounts, where the Partner has not logged into the account for more than 12 months). Prior to deleting the account and user data, we always warn the user by email at least 30 days in advance.

• We retain accounting documents, invoices, and related identification data for a period of 10 years from the end of the tax period in which the transaction took place, as required by Czech financial and tax regulations (in particular the VAT Act and the Accounting Act). Data necessary for verifying the authenticity of generated Reports and for establishing, exercising, or defending legal claims are retained for the duration of statutory limitation periods (generally 3 years, or for the duration of complaint or judicial proceedings).

• Upon cancellation of your account, technical data read from vehicles may be fully anonymized and further used for statistical purposes and the development of the EVpie diagnostic algorithm, whereby no specific individual can be retroactively identified from such data.

7. What Are Your Rights Under the GDPR?

As a data subject, you have the following statutory rights, which you may exercise via the contact email addresses listed above (we will handle your request without undue delay, no later than within 1 month of its receipt):

• Right of access: You have the right to know what data we process about you and to obtain a copy thereof.

• Right to rectification: If your data (e.g., delivery address) are inaccurate or incomplete, you have the right to have them rectified immediately.

• Right to erasure (“right to be forgotten”): You may request the deletion of your account and personal data if they are no longer needed for the performance of the contract and if we have no legal obligation or overriding legitimate interest to continue archiving them (e.g., for tax purposes or the defense of legal claims).

• Right to restriction of processing: In cases provided for by law (Article 18 GDPR), you may request that we temporarily lock your data and refrain from further processing them.

• Right to data portability: You may ask us to export the data that you have provided to us and that we process on the basis of a contract or consent, in a structured, commonly used, and machine-readable format.

• Right to withdraw consent: Where the processing of your data is based on consent, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing prior to its withdrawal.

• Right to object: You have the right to object at any time to processing that is based on our legitimate interest (Article 21 GDPR). If you object to processing for direct marketing purposes (sending commercial communications), your personal data will no longer be processed for these purposes.

• No automated decision-making: We declare that within our Services there is no automated individual decision-making or profiling within the meaning of Article 22 GDPR that would produce legal effects concerning you or similarly significantly affect you. Diagnostic results are intended for informational purposes only and do not constitute an automated decision with legal effects.

If you believe that we are handling your personal data in breach of applicable legislation, you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), which in the Czech Republic is: The Office for Personal Data Protection — Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic (website: www.uoou.cz), or with the competent data protection supervisory authority in the European Union Member State of your habitual residence, place of work, or place of the alleged infringement.

8. Data Security and Final Provisions

We have implemented modern technical, system, and organizational measures to protect your personal data against loss, misuse, leakage, or unauthorized access. All communication between the EVpie mobile application, the web interface, and our servers (including payments via the Stripe gateway) takes place exclusively in encrypted form using HTTPS / TLS protocols. Database access is subject to strict access rights management. Only authorized persons bound by confidentiality have access to personal data.

We may update this Privacy Policy as necessary; the current version is always published on the websites ev-pie.com and ev-pie.biz. This Privacy Policy is executed in the Czech language. Where translated into other languages for the convenience of users, the Czech version shall always prevail in the event of any discrepancies or ambiguities.