Privacy Policy

1. Introduction

ZCE Group (Zero Carbon Emission), a simplified joint-stock company registered in France, is committed to protecting the privacy of users of the e-WattelZCE application.

This privacy policy describes how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and French data protection laws.

2. Data Controller

The data controller is:

• Company name: ZCE Group (Zero Carbon Emission)
• Address: France
• Email: privacy@zerocarbonemission.com
• Support: support@zerocarbonemission.com

3. Data Collected

We collect the following categories of data:

3.1 Identification Data

• First and last name
• Email address
• Phone number (optional)
• Profile picture (optional)

3.2 Location Data

• GPS position to display nearby charging stations
• History of visited stations

3.3 Payment Data

• Credit card information (processed by Stripe, we do not store card numbers)
• Transaction history

3.4 Technical Data

• Device identifier
• Device type and operating system
• Application usage logs
• Push notification token

3.5 Identity Verification Data (KYC)

• Identity document (processed by Veriff)
• Facial verification photo

Data Type	Purpose	Legal Basis
Identification	Account creation and management	Contract performance
Location	Display nearby charging stations	Consent
Payment	Billing for charging sessions	Contract performance
KYC	Regulatory identity verification	Legal obligation
Notifications	End-of-charge alerts	Consent

4. Use of Data

Your data is used to:

• ✅ Provide electric vehicle charging services
• ✅ Locate nearby charging stations
• ✅ Process payments and generate invoices
• ✅ Send notifications about your charging status
• ✅ Provide customer support
• ✅ Improve our services and user experience
• ✅ Comply with legal and regulatory obligations

5. Data Sharing

Your data may be shared with:

5.1 Service Providers

• Stripe (Ireland/USA) - Payment processing
• Veriff (Estonia) - Identity verification
• Firebase/Google (USA) - Push notifications and authentication
• Google Maps (USA) - Mapping services

5.2 Safeguards for Transfers Outside the EU

Transfers to the United States are governed by the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

6. Data Retention

Data Type	Retention Period
Account data	Duration of registration + 3 years
Transaction data	10 years (accounting requirement)
Location data	12 months
KYC documents	5 years after end of relationship
Technical logs	12 months

7. Data Security

We implement appropriate security measures:

• 🔐 Encryption of data in transit (TLS 1.3)
• 🔐 Encryption of sensitive data at rest (AES-256)
• 🔐 Secure authentication (OAuth 2.0, Face ID, Touch ID)
• 🔐 Secure token storage (iOS Keychain, Android Keystore)
• 🔐 Limited data access based on the principle of least privilege
• 🔐 Regular security audits

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access: Obtain a copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request deletion of your data
• Right to portability: Receive your data in a standard format
• Right to object: Object to certain processing
• Right to restriction: Limit processing of your data
• Right to withdraw consent: Withdraw your consent at any time

You may also file a complaint with the CNIL (French Data Protection Authority): www.cnil.fr

9. App Permissions

The application may request the following permissions:

Permission	Usage	Required
📍 Location	Display nearby charging stations	Yes
📷 Camera	Identity verification (KYC), QR codes	Optional
🖼️ Photos	Profile picture, support	Optional
🔔 Notifications	Charging alerts	Optional
📶 Bluetooth	Charger configuration	Optional
📡 WiFi	Charger configuration	Optional

10. Cookies and Similar Technologies

The mobile application does not use cookies. However, we use similar technologies for the proper functioning of the application:

• Secure local storage: To maintain your session and preferences
• Firebase: For push notifications (no advertising tracking)

11. Children

The e-WattelZCE application is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors.

12. Policy Changes

We may update this privacy policy. In case of substantial changes, we will notify you via an in-app notification or by email.

The date of the last update is indicated at the top of this document.