ELTO HOLDING’s policy on the protection of your personal data

A.1. Definitions

Capitalised terms are defined in section 9 below (see section 9 – USEFUL DEFINITIONS).

A.2. Who is this Policy for?

This Policy is intended for customers (hereinafter referred to as « you » and its derivatives « your », « yours ») of Elto Holding, located in France at 122,122 bis avenue du Général LECLERC – 92100 Boulogne-Billancourt CEDEX, hereinafter referred to as « Elto », « we » and its derivatives « our » and « ours ») processes personal data (hereinafter referred to as « personal data »).

Elto is a Renault subsidiary whose specific activity is the sale of charging solutions and related services in France and Belgium under the brand name « Mobilize Power Solutions ».

A customer within the meaning of this Policy is: (i) a natural person who contacts us to obtain information about Elto Products and Services and/or who has interacted with us to express an interest in Elto Products and Services and who has agreed to be contacted for this purpose, (ii) a non-professional customer who has purchased an Elto Holding Product/Service for private use, (iii) a professional customer who is a natural person (sole traders, craftsmen, traders and self-employed persons) who has purchased an Elto Holding Product/Service.

The Products and/or Services offered by Elto are intended for adults.

A.3. What activities are covered by this Policy?

Elto’s activities that may give rise to the processing of personal data described in this Policy are as follows:

• The sale of Elto Products, namely charging stations and other charging points for electric vehicles;
• The sale of Elto Services associated with these Products, such as installation, warranty and maintenance services for charging solutions or energy optimisation.

The purpose of this Policy is to provide clear, concise and accessible information on the use of your personal data, our commitments and the measures we put in place to ensure the protection of your personal data, your rights and how to exercise them.

Within the framework of this Policy, we will present the processing of personal data carried out by Elto as an independent data controller or, in certain cases, as a joint data controller.

This new version is a complete overhaul of the previous version. It is intended to be more accessible and comprehensive, particularly with regard to its scope, the context in which data is collected, the purposes for which we process data, our commitments, the recipients of your personal data, and the scope of your rights over your data and how to exercise them.

Your personal data is processed by Elto Holding (hereinafter referred to as « Elto »), in its capacity as data controller. Elto Holding is located in France, at 122 – 122 bis avenue du Général Leclerc – 92000 Boulogne Billancourt.

In general, we undertake to collect only personal data that is relevant and appropriate to each of the purposes for which we process it (see section 3 – WHY IS YOUR PERSONAL DATA USED?).
We collect your personal data directly from you, in particular when:

• You visit our website, which may use cookies or other trackers,
• You contact us (*) via an online form, by email, telephone, during a visit to a dealership or by any other means,
• You subscribe to our communications,
• You purchase an Elto Product or Elto Service,
• You respond to one of our satisfaction surveys.

(*) In this regard, the data that is essential for responding to your request or for the purposes of a contract or legal obligation is indicated in the collection forms (in particular with asterisks). If you do not wish to provide the necessary data, we will probably be unable to process your request or provide you with the services concerned. Other information is intended to help us get to know you better, in particular, if you have consented to this, to send you personalised advertising messages. This information is therefore optional.

In any case, we invite you to keep us regularly informed in writing of any changes to your personal data.

The personal data we collect depends on our interaction with you and may include information concerning:

• Your identity and contact details (surname, first name, postal address, email address, telephone number, etc.),
• Data related to your personal and/or professional situation (tenant or owner status, detached house or flat, company registration number, company name, etc.)
• Your payment and transaction data (payment type, payment method, discount granted, date of purchase, invoice, total amount, etc.)
• Data relating to our commercial relationship, in particular our interactions and contracts (order history, after-sales service, interactions with our customer service department, etc.)
• Your vehicle identification data (make, model, registration number, chassis number, etc.)
• Data necessary for carrying out loyalty and prospecting activities,
• Data concerning the use of our website and our communications (number of visits, pages visited, etc.).

We may also obtain information about you indirectly, through Renault subsidiaries or other partners outside the Renault Group. We inform you that we comply with the regulations applicable to such data sharing (for example, if required by applicable regulations, we will inform you when we receive such data, etc.), and that we may therefore act as sole data controller and/or joint data controller.

We provide you with explanations about the context in which your data is collected, the purposes for which we process it and the length of time we keep it.

Within the framework of our relationship, and depending on the context in which your personal data is collected, we may use your data for the following purposes:

• A – Manage our initial interactions
• B – Manage our commercial relationship
• C – Conduct studies and analyses
• D – Manage our marketing operations
• E – Manage our legal activities

If we undertake or participate in a merger, acquisition, restructuring, asset sale or bankruptcy or insolvency proceedings, you will be notified before we transfer, sell or dispose of all or part of our assets (which include, in particular, personal data of customers and/or prospects).

In accordance with regulations, we undertake to retain your personal data only for as long as necessary to achieve the intended purpose, to meet your needs, or to comply with our legal obligations.

In order to determine this period, we take into account the following factors in particular:

• The duration of your contract,
• The time required to process your request or complaint,
• The time required to process your request or complaint,
• Your interest in our brands, as reflected in your interactions with our services,
• The need to keep a certain history of your interactions with us for the proper management of our commercial relationship, this period varying in particular depending on whether you have purchased Elto Products or Services or only interacted with us without entering into any contracts with us,
• Our legal or regulatory obligations.

More specifically, your data is processed for the following periods:

• In the context of managing our initial interactions, one week for a request for information, six months for a quote/estimate, one year for quotes/estimates for co-ownership charging solutions.
• In the context of exercising a right under the GDPR, for 1 to 3 months depending on the complexity of the request.
• In the context of managing our commercial relationship, for the duration of our contractual relationship, until the end of the warranty period associated with your charging station (2 years) and/or installation (from 1 year to 10 years depending on the work carried out). We may also send you occasional satisfaction surveys during the course of our commercial relationship.
• For the purpose of recording calls to improve the quality of our call centers, for a maximum of 6 months.
• For the purpose of conducting our statistical analyses, a maximum of one year.
• As part of our marketing activities, you will be contacted via the channels you have chosen for a maximum of three years from the end of our commercial relationship if you are an Elto customer or, if you have not purchased a charging solution, for three years from the collection of your personal information or your last request for information.

When we no longer need to use your personal data, it is deleted from our systems and records or anonymised so that you can no longer be identified. However, we may need to keep some of your personal data on file in order to be able to respond to any legal action, for the duration of the limitation period provided for by applicable law.

Subject to applicable obligations, some of your personal data may be shared with our parent company, which processes it in accordance with its data protection policy in order to:

• Implement the necessary measures to activate the Mobilize Power bidirectional V2G charging service, if you initiate the steps to activate this service.
• Track the installation of your charging station in the MyRenault app, if you have a MyRenault account.
• Improving customer knowledge.

In general, any sharing of data with our parent company and/or Renault subsidiaries is governed by one or more contracts which provide for: (a) ensuring a level of protection for your personal data equivalent to  the commitments made by the Renault Group, , (b) informing you in accordance with applicable regulations, and (c) processing data only for the purposes listed above.

To find out how you can object to our data sharing, please refer to section 5 below.

4.2 – Entities operating on our behalf

In order to process all or part of your personal data for the purposes we have informed you of above, we use companies acting on our behalf as data processors, acting in accordance with our instructions. These include:

• Expert installers of electric vehicle charging infrastructure who carry out technical diagnostics, provide support to network managers, attend your co-ownership meetings in the case of the installation of a co-ownership charging solution, and conduct physical or virtual visits prior to installation and then during installation, as well as providing training on the use of your charging stations.
• IT service providers responsible for hosting, operating or maintaining our databases, websites and mobile applications.
• Approved service providers operating in the banking sector(*) who provide us with remote payment and/or recurring payment management solutions (e.g. subscriptions, etc.) on our websites and/or applications where required.
• Service providers involved in customer relationship management (call centres, provision of communication tools, etc.).
• Service providers responsible for providing services related to our marketing, in particular the sending of commercial offers.
• Renault Distribution Network or partners outside the Renault Distribution Network: acting as business introducers or, where applicable, commercial agents on behalf of ELTO

These entities are located in your country of residence for installers and in Europe or the European Economic Area (EEA) for other categories. Any transfer of data outside the EEA will be governed by the conditions set out in Article 6 – HOW DO WE SECURE YOUR PERSONAL DATA?

(*) with the exception of processing that these service providers are required to carry out in accordance with their legal obligations in connection with a payment that you initiate on one of our websites and/or applications (in particular, obligations to check funds in accordance with the directive on money laundering, terrorist financing and anti-fraud). For this processing, these Service Providers act in accordance with their own data protection policies. The list of these service providers is available on request (see the terms and conditions for sending us your request in section 5 – WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?).

Finally, you are informed that certain Renault Subsidiaries may act as personal data processors, processing your data in accordance with the instructions we give them. In particular, the following act as personal data processors:

• The Renault Group’s parent company (e.g. management of certain Renault IT tools and applications)
• Certain Renault subsidiaries providing services (e.g. invoicing or IT services)

In any event, we ensure that we only work with trusted partners and that we secure these relationships (contracts, audits, guarantees and security tests, etc.) and that only persons duly authorised to process your personal data in accordance with their duties and tasks are permitted to do so.

4.3 – Entities outside the Renault Group

In certain cases, we may share some of your personal data with third-party partners of the Renault Group. We will inform you of this sharing and ensure that we ask for your consent prior to sharing when required by regulation. We enter into a contract with each of these third parties, which defines our respective obligations and responsibilities in the processing of your personal data, in accordance with the requirements of the applicable regulations.

4.4 – Authorised Third Parties

We may also share certain data about you with Authorised Third Parties (i.e., depending on the case, authorities, administrations and/or bodies authorised by legislative or regulatory provisions to order us to disclose documents or information containing personal data) in order to comply with any legal obligation or administrative or judicial decision.