Privacy Policy
Effective date: September 15, 2026
Version: 2026-09-15
1. Introduction
This Privacy Policy describes how the Voltspot group of companies (hereinafter referred to as the “Company”, “we”) collect, use, store, and protect the personal data of users of the Voltspot service (hereinafter referred to as the “Service”).
We respect your privacy and are committed to protecting your personal data in accordance with applicable legislation, including:
- The General Data Protection Regulation (GDPR) — for EU users
- The Law on Personal Data Protection of the Republic of Serbia — for users in Serbia
2. Data Controllers
Волтспот ООД (Voltspot LTD)
- Country: Bulgaria
- ЕИК: 202648040
- Address: Sofia, 77B Kumata St.
- Email: bg@voltspot.net
Волтспот ДОО (Voltspot DOO)
- Country: Serbia
- Матични број (Company Registration Number): 21985295
- Address: Dimitrovgrad, 23 Desanke Maksimovic St.
- Email: rs@voltspot.net
The controller of your data is the company registered in the country where you primarily use the Service.
3. What Data We Collect
3.1. Data provided by you:
- Registration data: email address, phone number
- Profile data: first name, last name (optional)
- Identification data: EU VAT-ID (if applicable, for legal entities)
- Payment data: bank card details (processed by the payment provider; we store only the token, last 4 digits, brand, and expiration date)
- External service accounts: Google or Apple identifier (when signing in through these services)
- Guest session data: for charging without registration — the email you provide and a temporary bank card token (no account is created)
3.2. Vehicle data:
- Electric vehicle identifiers: VIN (Vehicle Identification Number), MAC address, VID — transmitted by the charging station via the OCPP protocol when the vehicle is connected
- Vehicle make and model: determined automatically based on VIN
- Battery state of charge (SoC): at the start and end of charging, if supported by the station
- Corporate fleet: license plate number, VIN, make, model, year, battery capacity (when registered by an organization)
3.3. Data collected automatically:
- Usage data: charging session history (date, time, station, energy consumed, cost, idle time)
- Geolocation: device location (only with your consent, for finding nearby stations). When GPS is unavailable, approximate location is determined by IP address (accuracy ~10 km)
- Technical data: device type, operating system, application version
- Payment history: transaction history, balance top-ups, and charges
- Error data: anonymized application error reports for quality improvement (via Sentry service)
- Push notification token: for sending charging status notifications (Firebase Cloud Messaging)
4. Legal Bases for Processing
We process your personal data on the following legal bases:
| Processing purpose | Legal basis |
|---|---|
| Providing charging services | Performance of a contract |
| Payment processing | Performance of a contract |
| Maintaining session history | Performance of a contract |
| Vehicle identification (AutoCharge) | Performance of a contract |
| Tax reporting and fiscalization | Legal obligation |
| Invoice issuance | Legal obligation |
| Communication regarding service matters | Legitimate interest |
| Service improvement and error tracking | Legitimate interest |
| Location determination by IP | Legitimate interest |
| Push notifications | Consent |
| Marketing communications | Consent (separate) |
5. How We Use Data
We use your personal data to:
- Provide electric vehicle charging services
- Process payments and issue invoices
- Automatically start charging (AutoCharge) by vehicle identifier
- Send notifications about charging status and payments
- Provide technical support
- Maintain your session and payment history
- Comply with legal requirements (fiscal receipts, tax reporting)
- Prevent fraud
- Improve Service quality and resolve errors
- Linking previously completed guest sessions to an account when the email address matches (history only is transferred)
6. Data Sharing with Third Parties
We share your personal data with the following categories of recipients:
6.1. Payment providers:
- MyPOS — bank card payment processing (tokenization, pre-authorization, charges)
6.2. Technical services:
- Sentry — application error monitoring (anonymized technical data)
- Firebase Cloud Messaging (Google) — push notification delivery
- ipwho.is — approximate location determination by IP address (only the IP address, no personal data)
6.3. Verification services:
- VIES (EU) — EU VAT-ID verification when registering a legal entity
6.4. Fiscal providers:
- Tremol / NRA (Bulgaria) — transmission of transaction data for issuing fiscal receipts in accordance with legislation
6.5. Government authorities:
- Upon official request in accordance with legislation
6.6. Hosting:
- Servers are located in the EU
We do not sell or share your personal data with third parties for marketing purposes.
7. Data Storage Location
Your data is stored on servers located in the European Union.
8. Cross-Border Data Transfers
When data needs to be transferred outside the country of storage, we ensure an appropriate level of protection through:
- EU Standard Contractual Clauses (for transfers from the EU)
- European Commission adequacy decisions
9. Data Retention Periods
| Data type | Retention period |
|---|---|
| Account data | 3 years after last activity |
| Session history | 3 years |
| Vehicle data (AutoCharge) | Until deleted by the user or 3 years after last use |
| Payment history | 7 years (tax legislation requirements) |
| Fiscal receipts | 10 years (tax legislation requirements) |
| Technical analytics and error reports | 1 year |
| Guest session data | 30 days (if not registered) |
After the retention periods expire, data is deleted or anonymized.
10. Your Rights
In accordance with the GDPR and applicable legislation, you have the right to:
10.1. Right of access
Obtain information about what data we hold about you.
10.2. Right to rectification
Request correction of inaccurate or incomplete data.
10.3. Right to erasure (“right to be forgotten”)
Request deletion of your data where there is no legal basis for its retention.
10.4. Right to restriction of processing
Request restriction of the processing of your data in certain circumstances.
10.5. Right to data portability
Receive your data in a machine-readable format or request its transfer to another controller.
10.6. Right to object
Object to the processing of data based on legitimate interest.
10.7. Right to withdraw consent
Withdraw previously given consent to data processing.
10.8. Right to lodge a complaint
Lodge a complaint with a data protection supervisory authority.
11. How to Exercise Your Rights
To exercise your rights, please contact us:
- Bulgaria and other countries: bg@voltspot.net
- Serbia: rs@voltspot.net
We will respond to your request within 30 days. In complex cases, the period may be extended by an additional 60 days with notification.
To verify your identity, we may request additional information.
12. Data Security
We implement the following measures to protect your data:
- Encryption of data in transit (HTTPS/TLS)
- Payment data tokenization (PCI DSS)
- Password hashing (bcrypt)
- Employee access restricted on a need-to-know basis
- Regular backups
- Suspicious activity monitoring
- Filtering of sensitive data before sending to monitoring systems
13. Cookies and Local Storage
Our web application uses only minimally necessary cookies and local storage:
| Data type | Purpose | Retention period |
|---|---|---|
| Authorization token | User authorization | Until logout |
| Language settings | Saving selected language | Indefinitely |
| Cached location | Quick map display | 60 minutes |
We do not use advertising or tracking cookies.
14. Policy Changes
We may update this Privacy Policy. Updates take effect when published, and the current version is always available in the application and on the website. Where the law requires it, you will be informed in advance of material changes to the processing of your personal data.
The current version of the policy is always available in the application and on the website.
15. Contact
For privacy and data protection inquiries, please contact:
- Bulgaria and other countries: bg@voltspot.net
- Serbia: rs@voltspot.net
Supervisory authorities:
- Bulgaria: Commission for Personal Data Protection (CPDP) — https://www.cpdp.bg
- Serbia: Commissioner for Information of Public Importance — https://www.poverenik.rs
© 2020–2026 Voltspot. All rights reserved.