Privacy Policy

1. Introduction and Data Controller

This Privacy Policy governs the processing of personal data collected through loopsterhorizn.com and associated charging management hardware, cloud platforms (Loopster GridOS), and EV charging mobile/desktop interfaces. The primary data controller is:

We strictly comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation / GDPR), the Dutch Data Protection Act (Uitvoeringswet AVG), and international data privacy benchmarks.

2. Categories of Data Collected

In operating European EV charging networks, smart wallboxes, and commercial infrastructure, we collect and process the following categories of information:

• Identity & Contact Information: Full name, business email address, phone number, company title, and physical property address provided via contact forms, survey requests, or customer portal logins.
• EV Charging Session Telemetry: Charging station identifier (EVSE ID), timestamp of connection/disconnection, energy consumed (in kilowatt-hours / kWh), instantaneous charging curve telemetry, battery state of charge (SoC where ISO 15118 enabled), RFID card token identifier, and meter counter readings.
• Financial & Payment Transaction Data: Tokenized payment credentials, payment terminal identifiers (NFC transaction tokens), billing addresses, VAT numbers, and invoicing history. Payment card numbers are processed exclusively by PCI-DSS Level 1 certified processors and are never stored on Loopsterhorizn servers.
• Technical & Network Log Data: IP addresses, browser user-agent strings, referring URLs, operating system metadata, crash logs, and localized cookie identifiers.

3. Legal Bases for Processing (GDPR Art. 6)

We process personal data only when an applicable legal ground exists under GDPR:

• Performance of a Contract (Art. 6(1)(b)): To deliver EV charging sessions, process payments, allocate energy across multi-tenant buildings, and maintain operational SLAs.
• Legal Obligation (Art. 6(1)(c)): To fulfill fiscal, tax, and accounting mandates (such as European VAT reporting and AFIR compliance logging) and to comply with legal requests from electrical regulators and law enforcement.
• Legitimate Interests (Art. 6(1)(f)): To maintain grid stability, protect electrical hardware against overloading, detect fraudulent charging transactions, and optimize dynamic load balancing algorithms.
• Consent (Art. 6(1)(a)): For non-essential analytics tracking, marketing communications, and customer preference personalization where explicit opt-in consent is provided.

4. Data Storage, Retention, and International Transfers

All core customer and telemetry databases are hosted within high-security, ISO 27001-certified data centers located inside the European Economic Area (EEA—specifically Frankfurt am Main and Amsterdam). Telemetry data is retained for a maximum duration of 24 months to facilitate grid capacity analytics, after which it is fully anonymized. Billing and contractual records are retained for 7 to 10 years as mandated by European fiscal law.

If any technical service provider processes data outside the EEA, transfers are conducted strictly under the European Commission’s Standard Contractual Clauses (SCCs) and adequacy decisions.

5. Your Rights as a Data Subject

Under Chapter III of the GDPR, you possess extensive statutory rights regarding your personal data:

• Right of Access (Art. 15): Obtain confirmation as to whether your personal data is being processed and receive a free copy of your records.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal records without undue delay.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data where retention is no longer necessary or lawful.
• Right to Restriction of Processing (Art. 18): Restrict the scope of data processing under specific dispute circumstances.
• Right to Data Portability (Art. 20): Receive your structured charging and account data in a standard machine-readable format (JSON/CSV).
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests or direct marketing.

To exercise any of these rights, email our Data Protection Officer at [email protected]. We will process and respond to your request within 30 days free of charge.

6. Supervisory Authority Complaints

If you believe Loopsterhorizn Mobility B.V. has processed your personal data in violation of GDPR provisions, you have the statutory right to lodge a complaint with the relevant lead supervisory authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands, https://autoriteitpersoonsgegevens.nl) or your local European data protection authority.