Privacy Policy of da emobil GmbH

Last updated: April 2026

1. Introduction and scope

The protection of your personal data is of utmost importance to us, da emobil GmbH. We therefore process your data exclusively on the basis of the applicable legal provisions, in particular the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Telecommunications Act 2021 (TKG 2021).

This Privacy Policy provides comprehensive information on the nature, scope, and purpose of the collection and use of your personal data in connection with the use of our services, the visit of our website, and the use of related applications and services.

2. Controller and contact

The controller responsible for data processing within the meaning of the GDPR is
da emobil GmbH
Josef-Wilberger-Straße 53
6020 Innsbruck
Austria
Company register number: 518707 f
Email: support@da-emobil.com

For all data protection matters, in particular regarding the exercise of your rights, please contact our data protection officer:
Stephanie Moser
Email: info@da-emobil.com
Phone: +43 50 2277 2277

3. Data processing in detail

Below we explain in detail which data we process, for what purposes, and on which legal basis.

3.1 Contract Performance for Charging Services

Purpose
If you conclude a contract with us for the use of charging infrastructure, we process your personal data to provide the agreed services. This includes authentication at charging stations, execution and documentation of charging sessions (including roaming in partner networks for public charging), billing, and customer management.

Categories of data

• Identification data: customer number, first and last name, address, gender, date of birth, academic titles
• Company data: company register number, VAT ID
• Contact details: email address, telephone number
• Payment and billing data: bank details (IBAN, BIC), payment method, invoice data
• Usage and charging data: RFID card ID, charging station location and ID, start and end of charging (date/time), energy charged (kWh), charging history, costs

Legal basis
The processing is necessary for the performance of the contract with you and for the implementation of pre-contractual measures (Article 6 (1) (b) of the GDPR). We also process data to comply with legal obligations, in particular tax and company law retention requirements (e. g. Section 132 of the Austrian Federal Tax Code), in accordance with Article 6 (1) (c) of the GDPR. Finally, processing may be carried out to safeguard our legitimate interests (e. g. asserting or defending legal claims, preventing misuse) on the basis of Article 6 (1) (f) of the GDPR.

Retention period
Data is stored for the duration of the contractual relationship. After termination, data is retained:

• For legal claims: typically 3 years
• For statutory retention (e. g. invoices): typically 7 years

3.2 Ad-hoc Charging

Purpose
We offer charging without prior registration. Processing is required to handle the individual transaction and provide payment receipts.

Categories of data

• Contact details: Email address
• Payment data (e. g. credit card details)
• Charging data (location, time, energy, duration)
  

Legal basis
The processing is necessary for the performance of the individual contract relating to the charging process in accordance with Article 6 (1) (b) of the GDPR. Invoice and transaction data are retained in order to comply with legal obligations in accordance with Article 6 (1) (c) of the GDPR.

Retention period
Transaction data is retained in accordance with statutory obligations (generally 7 years).

Recipients
Your payment details will be passed on to the relevant payment service provider (e.g. credit card acquirer) for the purpose of processing the transaction.

3.3 Website Use and Server Logs

Purpose
Every time you visit our website, our web server automatically records technical information in server log files in order to ensure the functionality, stability and security of our online presence and to be able to defend against attacks.

Categories of data

• IP address of the requesting device
• Date and time of access
• Name and URL of the file accessed
• Website from which access is made (referrer URL)
• Browser used and its version, as well as your computer’s operating system

Legal basis
Data processing is carried out on the basis of our legitimate interest pursuant to Article 6 (1) (f) of the GDPR, which consists of ensuring the smooth operation and security of our website.

Retention period
Server log files are generally deleted automatically after 30 days, unless security incidents require them to be retained for a longer period for the purposes of analysis and legal proceedings.

Recipients
The recipient is our hosting provider, who acts as a data processor on our behalf.

3.4 Contact Requests (contact forms, EMail)

Purpose
If you contact us via the contact form or by email, we will store the information you provide so that we can process your enquiry and in case we need to follow up with further questions.

Categories of data

• Name, email, phone (if provided)
• Message content and attachments

Legal basis
Data processing is carried out to take steps prior to entering into a contract at your request (e. g. preparing a quotation) in accordance with Article 6 (1) (b) of the GDPR, or on the basis of our legitimate interest in the efficient handling and response to general enquiries in accordance with Article 6 (1) (f) of the GDPR.

Retention period
Enquiries that lead to a contractual relationship become part of the contract documentation and are subject to the retention periods set out therein. Other enquiries are stored for a period of three years following the last contact, so that we can respond to any queries that may arise.

Recipients
Your enquiry will be forwarded internally to the relevant staff members. Our CRM system (Bitrix24 Limited) may be used as a data processor for administrative purposes.

3.5 Cookies and Web Analytics

Purpose
Our website uses cookies. These are small text files that are stored on your device. We use technically necessary cookies to ensure the basic functions of the website. In addition, we use cookies for analytical and marketing purposes (e. g. Google Maps) to improve our service and make it more user-friendly. These are only set with your express consent.

Google Maps
We embed maps from Google Maps on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.
The map will only load once you have given your explicit consent via our cookie banner. The map will not be displayed until you have given your consent; at this point, a message will appear offering you the option to enable the map. You can withdraw your consent at any time with future effect via the cookie settings.
If you consent and the map is loaded, Google will process your IP address in particular. This may involve data being transferred to the USA. For data protection purposes, the USA is considered a third country. Google is certified under the EU-US Data Privacy Framework, meaning that an adequacy decision by the European Commission can serve as the basis for the transfer. In addition, Google bases transfers on standard contractual clauses.
We have no control over the type and scope of the data processed by Google. For further information, please refer to Google’s privacy policy at https://policies.google.com/privacy

Google Tag Manager
Google Tag Manager is a solution that allows us to manage our website tags via a single interface and implement them. The tool simply triggers other tags, such as Google Analytics, and controls when they are triggered. Google Tag Manager does not access this data itself. If deactivation has been carried out at domain or cookie level, this setting applies to all tracking tags implemented using Google Tag Manager. The data processor for Google Tag Manager is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, Ireland.

Google Analytics
Google Analytics is a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics enables us to analyse your use of our website. Certain information regarding your use of this website is transmitted to a server operated by Google LLC in the USA and stored there. Google LLC uses the information we provide to analyse website usage, to compile reports on website activity for website operators, and to provide other services relating to website and internet usage. The data processor for Google Analytics is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Ads
We use Google Ads, an online advertising programme provided by Google Ireland Limited, which enables us to create web advertisements. Google Ads then displays our advertisements across various Google products. To this end, a wide range of statistics and analyses regarding interactions with these advertisements are compiled in anonymised form. The data processor for Google Ads is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, Ireland.

Meta Ads
We use Meta Ads, an online advertising programme provided by Meta Platforms Inc, 1601 Willow Rd, Menlo Park, CA 94025, USA, which enables us to create web advertisements. Meta Ads then displays our adverts on various Meta Platforms products. To this end, a wide range of statistics and analyses regarding interactions with these adverts are compiled in anonymised form. The data processor for Meta Ads is Meta Platforms Inc, 1601 Willow Rd, Menlo Park, CA 94025, USA.

Legal basis
The processing of data by cookies that are not technically necessary is carried out solely on the basis of your consent in accordance with Article 6 (1) (a) of the GDPR in conjunction with Section 165 (3) of the TKG 2021, which you provide via our cookie consent banner.

Withdrawal and management
You may withdraw your consent at any time, with future effect and without giving any reason, by adjusting the cookie settings on our website. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Retention period and recipients
The retention period for each cookie and the recipients of the data (e. g. Google Ireland Limited for Google Maps) are displayed in detail and transparently in our cookie consent banner.

3.6 Newsletter

Purpose
You can subscribe to our newsletter via our website to receive information about our products, offers and news from the world of electric mobility. Registration is carried out via a so-called double opt-in procedure. After registering, you will receive an email asking you to confirm your registration. This is to prevent misuse of your email address. You must provide your email address in order to receive the newsletter.

3.7 Location Partnerships (Lease and Licence Agreements/Cooperation Agreements)

Purpose
If you contact us as a landowner or authorised representative to offer a site for charging infrastructure, we will process your data for the purposes of evaluating the site, initiating contract negotiations and fulfilling the terms of the agreement. The provision of this data is necessary for the conclusion of the contract.

Categories of data

• Identification data: name, company name, address
• Contact details: email address, telephone number
• Property details: address, land registry details (e. g. plot number, cadastral district)
• Contract and payment details: contract details, bank details for fee payments

Legal basis
The processing is necessary for the purposes of entering into and performing the contract (Article 6 (1) (b) of the GDPR), for compliance with legal obligations (Article 6 (1) (c) of the GDPR), and for the purposes of safeguarding our legitimate interests in expanding our operations and pursuing legal claims (Article 6 (1) (f) of the GDPR).

Retention period
Data is stored for the duration of the contractual relationship and subsequently for the duration of the statutory limitation periods (usually three years) and retention periods (usually seven years). If no contract is concluded, the data will be deleted after three years.

3.8 Purchase of Hardware (e. g. Wallboxes)

Purpose
When you purchase hardware (e.g. wall boxes), we process your data for the purpose of fulfilling the purchase contract, including order processing, delivery, invoicing and the handling of warranty claims. The provision of this data is necessary for the performance of the contract.

Categories of data

• Identification data: customer number, name, address
• Contact details: email address, telephone number
• Order and payment details: order details, delivery and billing addresses, payment information
• Installation details (optional): address and technical details of the installation site

Legal basis
The processing is necessary for the performance of the sales contract (Article 6 (1) (b) of the GDPR), to comply with statutory retention obligations (Article 6 (1) (c) of the GDPR), and to safeguard our legitimate interests in defending against warranty claims (Article 6 (1) (f) of the GDPR).

Retention period
Your data will be stored for the duration of the contract and, thereafter, for the duration of the statutory warranty period (two years), limitation period (three years) and retention period (seven years).

3.9 GHG quota transfer

Purpose
If you instruct us to transfer your GHG quota, we will process the data you provide in the registration form. This processing is necessary to verify your eligibility, to process the quota transfer and to pay out the bonus.

Categories of data

• Identification and contact details: name, address, email address, telephone number
• Vehicle details: in particular, the details from the registration certificate used to identify the electric vehicle
• Location details: location of the main charging point
• Bank details: bank account details (IBAN) for the payment of the bonus

Legal basis
The processing is necessary for the performance of the contract relating to the transfer of GHG quota (Article 6 (1) (b) of the GDPR). Our legitimate interest (Article 6 (1) (f) of the GDPR) also lies in contacting you should we have any queries and in informing you in the following year about the possibility of participating again.

Recipients
Your data will be transferred to our partners for the purpose of processing the GHG quota transfer. This includes sharing your data with partners to verify eligibility criteria and pool quotas, as well as with those partners responsible for paying out the premium. These partners act as separate data controllers.

Retention period
Your data will be retained for the duration of the statutory retention period following completion of the transfer, in accordance with specific documentation and retention requirements relating to the transfer of GHG quota, and will then be deleted.

4. Recipients and processors

In order to provide the services listed above, we engage specialist service providers who act on our behalf as data processors and are bound by our instructions. Your data will only be disclosed to the extent necessary for the performance of the contract, and we always ensure the highest possible level of security when transferring data. This includes, amongst other things:

• ChargePoint Austria GmbH: Operation of the central billing and management software (be.ENERGISED)
• Hubject GmbH: Technical processing of roaming charging transactions in partner networks
• wherever SIM GmbH: Ensuring data communication (OCPP) between charging stations and our backend system
• DGR Datenverarbeitungs GmbH: Operation of the ERP system for master data management and materials management
• Bitrix24 Limited: Operation of our CRM system for managing customer relationships and enquiries
• Fiegl Spielberger GmbH / IGS Systemmanagement GmbH & Co KG: Support with bookkeeping, accounting and reporting
• GUTMANN GmbH: Dispatch and management of charging cards
• Energie AG Oberösterreich Vertrieb GmbH:
• ASSIST Notfallservice GmbH: Provision of mobility services in the event of an emergency
• Payment service providers: For the processing of payment transactions

Data is transferred exclusively within the EU/EEA or to third countries for which the European Commission has issued an adequacy decision, or on the basis of appropriate safeguards (e. g. standard contractual clauses).

5. Your rights

You have comprehensive rights regarding the data we process about you:

• Right of access (Art. 15 GDPR): You may request information about what data we process about you and receive a copy of that data.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): Under certain conditions, you may request the erasure of your data (‘right to be forgotten’).
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller.
• Right to object (Art. 21 GDPR): Where processing is based on our legitimate interests (Art. 6 (1) (f) GDPR), you may object to the processing at any time on grounds relating to your particular situation.
• Right to withdraw consent (Art. 7 (3) GDPR): You may withdraw your consent at any time with effect for the future.

To exercise these rights, please use the contact details provided in section 2.

Right to complain at the supervisory authority
If you believe that the processing of your data infringes data protection law or that your data protection rights have been infringed in any other way, you have the right to lodge a complaint with the competent supervisory authority. In Austria, this is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Wien
Website: www.dsb.gv.at

6. Changes to this privacy policy

We reserve the right to update this policy as required. The current version is available on our website.

7. Data security

We implement appropriate technical and organisational security measures (TOMs) to protect your data from unauthorised access, loss or destruction. These include, amongst other things, the encryption of data transmissions and databases, access controls, authorisation policies and regular security audits. Please note that you are personally responsible for the safe storage and confidentiality of any user data or passwords that have been provided to you.