Articles 12–14 of Regulation (EU) 2016/679

General Data Protection Regulation – GDPR

Qariqa provides this Privacy Notice to explain how we process your personal data in our capacity as a data controller under Regulation (EU) 2016/679 (the "GDPR"). This includes processing carried out to present our products and services to you, enter into contracts and fulfil our contractual obligations.

We want our relationship with you to be based on transparency and trust. Our aim is to provide high-quality services and continually develop new solutions designed to improve your daily life and activities.

For us, transparency means communicating clearly and providing practical information. Where technical terminology is necessary, we aim to explain it so that you understand how your personal data may be used and what rights you have.

What personal data do we collect?

The personal data we process primarily includes information you provide when communicating with us about our products and services, such as your first and last name, residential address, telephone number and payment details, including credit card information.

We also process location and travel data necessary to provide our services.

Some personal data is generated directly or indirectly when you use our services. This includes information relating to your account, the contractual options you have selected and your communications with us.

We also process data generated through your use of the Qariqa App and our digital platform, including:

• Charging sessions, including charging dates and times and the amount of energy consumed.
• Your mobility patterns and driving behaviour, which help us recommend vehicles and solutions best suited to your needs.

We may also process personal data obtained from third parties, such as creditworthiness information from public and private records, or receive information about you through our interactions with property management companies.

We process your personal data for various purposes. Some are directly related to activating and providing our services, while others concern improving and expanding our offering. These purposes are explained below.

1. Providing and improving our services

We use your personal data to activate, deliver and continually improve our services.

For example, we process your data to:

• Manage your requests and provide our services.
• Operate and maintain devices and resolve technical issues.
• Respond to enquiries submitted to our customer support service.
• Send invoices and service-related communications.
• Recommend new solutions that may improve your mobility experience.

We also process personal data to comply with legal obligations, including retaining contracts and invoices, issuing communications required by public authorities and responding to requests from judicial authorities in connection with legal proceedings and the prevention and investigation of criminal offences.

In addition, we may use your personal data to inform you about promotions, discounts and other benefits relating to services you already use.

2. Location and mobility data

To provide our services, we process data relating to your location and movements.

The Qariqa App uses your device's location data, both when the App is actively in use (foreground) and when it is running in the background, together with information from built-in sensors such as the accelerometer and gyroscope.

This enables us to reconstruct your car journeys and provide features associated with our mobility services.

Data collection

Location and movement data is collected only with your prior consent, provided through your device and App settings.

Purpose of processing

Location and movement data is used to reconstruct journeys, generate personalised reports and provide mobility recommendations.

Local processing

Movement data is processed directly on your device. Qariqa does not transmit your individual location data to third parties.

Data sharing

Location data is not disclosed to external parties unless required by law or requested by competent authorities.

Data retention

Location and movement data is stored locally on your device for no longer than is necessary to provide the App's functionality.

Qariqa may use aggregated or anonymised data for statistical analysis and service improvement.

Your controls

You can disable access to your location data at any time through your device or App settings. However, doing so may prevent certain features from functioning.

Legal basis

The legal basis for processing location data is your consent, pursuant to Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

3. Verification, fraud prevention and protection of contractual rights

We may process your personal data to establish and maintain a transparent and trustworthy relationship that protects both you and Qariqa.

This may include consulting public and private databases containing financial information, such as records of adverse financial events or payment defaults, and identity verification systems, including systems designed to prevent identity theft and fraud.

We may also process your data to verify compliance with contractual obligations and, where necessary, establish, exercise or defend Qariqa's legal rights.

4. Service development, communications and personalised offers

We may use your personal data to improve our services and expand our offering, including through market research and statistical analysis conducted by specialised companies.

We may also use your data to inform you about, or invite you to participate in, social, cultural and charitable initiatives.

In addition, we may keep you informed about products, services and special offers provided by Qariqa or our commercial partners.

To make our services and communications more relevant to your needs, we may analyse your preferences, interests and habits.

This analysis may take into account information such as:

• Whether you prefer walking or cycling.
• Where you live and your age.
• Which services and options you have selected.
• How much energy you use for mobility.

This information helps us develop services and offers that better reflect your individual needs.

5. Customer profiling and personalised offers

We may also develop personalised offers using aggregated data relating to groups of Qariqa customers with similar habits and consumption patterns.

This analysis is intended to help us improve our services and tailor our offering to your needs, including by identifying suitable pricing options or technologies used to deliver our services.

Legal bases for processing your personal data

For each of the purposes described above, we identify the applicable legal basis: the grounds under which processing is permitted by law. We also explain which processing activities are necessary and which depend on your choice.

Processing under Section 1

The processing activities described in Section 1 are necessary to enter into and perform contracts and to comply with associated legal obligations.

Providing information about products and services similar to those you have purchased, as well as current promotions, is based on Qariqa's legitimate interest in maintaining our commercial relationship with you.

This allows us to inform you about additional services, innovations and promotions relevant to your existing choices.

Processing under Section 2

The processing activities described in Section 2 are also necessary for Qariqa's legitimate interest in properly establishing and performing contractual relationships, complying with associated obligations and protecting its contractual rights.

The collection of data for the purposes described in Sections 1 and 2 is therefore necessary and constitutes an essential requirement for entering into and performing the contract.

Without this information, we would be unable to activate or provide the services, subject to your right to object to receiving information about similar products and services.

Processing under Sections 3 and 4

The processing activities described in Sections 3 and 4 depend on your consent and your interest in the relevant initiatives.

You may choose whether to grant or withdraw each individual consent at any time.

These processing activities are not necessary to enter into contracts or provide our core services. Instead, they allow us to keep you better informed about developments in our services, products and promotions.

If you refuse or withdraw consent, we may be unable to provide access to certain services or special offers made available to you by our commercial partners or other companies.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Qariqa undertakes to carry out the communications referred to in Sections 3 and 4 only through traditional communication methods, such as telephone calls made by an operator, and not through automated methods, such as calls made without a human operator.

You may exercise your right to object at any time, using the procedures described at the end of this Notice.

Unless you specify otherwise, your objection will apply to both traditional and automated communications.

Who may receive your personal data?

To provide our services, deliver customer support and expand our offering, Qariqa works with companies, organisations and service providers that support our operations.

For example, a technician who installs a wallbox at your home or a customer support representative who responds to your enquiries may be employed by a company working on our behalf. These individuals may need access to your personal data to provide the relevant services.

We explain below who may receive your personal data and under what circumstances.

Some of the terminology is necessarily technical to comply with the GDPR. Our objective remains to provide reliable services, continually improve our offering and ensure that appropriate support is available when you need it.

For the purposes described in Sections 1–5, your personal data may be shared with the following categories of recipients:

• Qariqa's sales network, including agents, call centres, dealers and distributors.
• Service providers and suppliers, including providers of information technology, telecommunications and cloud services; customer support; maintenance and technical assistance; installation; administration; and market research, as well as legal, tax and employment advisers.
• Banks, payment service providers and other organisations involved in payment processing, credit protection, fraud prevention and identity theft prevention.
• Debt collection agencies, where necessary.
• Public bodies responsible for granting subsidies, financial assistance or other forms of support relating to Qariqa's services.
• Government departments, regulatory bodies and other public authorities, where disclosure is required by law.

Personal data may be shared within Italy and internationally, including within and outside the European Union, subject to the rights and safeguards established by applicable data protection legislation.

Where personal data is transferred outside the European Union, such transfers will be limited to countries covered by an adequacy decision issued by the European Commission, such as Switzerland (decision of 26 July 2000) and the United States (Decision No. 2016/1250).

How do we process your personal data and for how long?

Protecting your personal data and ensuring its appropriate retention are fundamental priorities for Qariqa.

We implement appropriate security measures to prevent unauthorised or unlawful processing, accidental loss, destruction or damage.

Personal data is processed in accordance with these safeguards by:

• Qariqa, acting as the data controller.
• External data processors, such as sales agents and service providers.
• Individuals acting under their authority who have received appropriate instructions.
• Other authorised recipients identified above.

Processing may be carried out manually or electronically.

Automated analysis and profiling

For aggregated and individual profiling activities described in Sections 4 and 5, we may use automated data analysis and decision-making processes.

These processes are intended to help us develop new services and tailor commercial offers to your characteristics and consumption preferences, including those identified through comparisons with other customers.

However, Qariqa will never activate a service automatically without first obtaining your agreement.

Data retention

We process your personal data for the period necessary to establish a contractual relationship and throughout the duration of that relationship, beginning when you first contact us about becoming a customer and continuing for as long as you use our services.

After the contract ends, your personal data is retained for a maximum of 10 years, in accordance with applicable statutory limitation periods.

This retention period enables us to:

• Complete any outstanding contractual matters.
• Manage potential disputes and protect the legal interests of both parties.
• Comply with statutory record-keeping obligations.

The retention period may be extended only where necessary to resolve outstanding matters, such as ongoing legal disputes.

Where you have provided consent for the purposes described in Sections 3 and 4, we may process your personal data for those purposes for a maximum of two years, unless a shorter period is required by applicable law or specific circumstances, such as registration with an official opt-out register.

In all cases, including after the contractual relationship has ended, you retain the right to object to further processing by withdrawing your previously granted consent.

Further details of the applicable retention periods for each processing purpose are provided in the accompanying table.

What are your rights?

Under Articles 15–22 of the GDPR, you have the right, subject to the conditions established by applicable law, to:

• Access your personal data and obtain information about how it is processed.
• Request rectification of inaccurate or incomplete personal data.
• Request erasure of your personal data.
• Request restriction of processing in certain circumstances.
• Object to processing, including processing for aggregated profiling purposes as described in Section 5.
• Request data portability, where applicable, allowing you to receive your personal data in a structured, commonly used and machine-readable format.

You also have the right to object to processing based on Qariqa's legitimate interests, including the information and profiling activities described in Sections 1 and 5, and to processing for promotional and commercial purposes described in Sections 3 and 4.

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

You may exercise these rights directly through the Qariqa App or by contacting us using the details provided below.

Right to lodge a complaint

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in accordance with the procedures published on its official website.

How can you contact us?

You can manage your consent preferences and objections through the Qariqa App or by contacting our customer support service.

To exercise any of your data protection rights, you may also contact Qariqa using the details below.

Data controller

Qariqa S.r.l.
Via F. Olgiati, 26
20143 Milan, Italy

For written correspondence concerning data protection rights:

Qariqa – Data Controller
Via F. Olgiati, 26
20143 Milan, Italy

Data Protection Officer (DPO)

In accordance with Article 37 of the GDPR, Qariqa has appointed a Data Protection Officer.

Email: dpo@qariqa.com
Postal address: Via F. Olgiati, 20143 Milan, Italy

Registered office: Via F. Olgiati, 26, 20143 Milan
Italy REA (Economic and Administrative Register) No.: MI-2753392