Privacy Policy
Last updated: 2026.09.10. | Effective date: 2026.09.10.
1. Details of the Data Controller
| Name / Operator: | PlugZone Kft. |
| Registered office: | 1108 Budapest, Újhegyi út 14. B épület fsz. 2. ajtó |
| E-mail: | e-mail-cím |
| Phone: | +36 30 447 4819 |
| Data Protection Officer: | e-mail-cím |
2. Scope of this Policy
This Privacy Policy applies to the plugzone.hu website, the PlugZone PWA/web client, and the PlugZone Android and iOS apps (jointly, the "Service"), including guest QR charging without an account. It describes how we collect, use, store, share and protect personal data under EU Regulation 2016/679 (GDPR), Hungarian Act CXII of 2011 (Infotv.), and app-store policies.
3. Categories of data collected
3.1. Registration and account data
- Email address; billing name and address when an invoice is requested
- Phone number (required at registration, for SMS verification and customer service)
- Password (cryptographically hashed, bcrypt)
- User ID (internal identifier)
- Invoicing details (name, address, tax number – when an invoice is requested)
- For company accounts: account type (admin / sub-user), linked company ID, subscription tier
3.2. Charging and transaction data
- Charging history (start/end time, energy in kWh, charge-point ID, price tier)
- Payment transactions (amount, date, method – we do not store full card numbers; Adyen processes them; a tokenised payment-method ID may be stored for later capture)
- Balance, top-up history and subscription status (Alap / Smart / Pro)
- Invoice data (invoice number, PDF, Számlázz.hu ID)
3.3. Device and technical data
- IP address, browser type and version, operating system
- Device identifier (Android / iOS)
- Push notification token (Firebase Cloud Messaging – FCM)
- Application version
3.4. Location data
- Phone or browser GPS – only with the user’s express consent, to find the nearest charger. This location is not stored on our servers; it is used on the client in real time and is not collected in the background.
- If a Tesla account is linked and Fleet Telemetry is registered, the vehicle GPS is cached from Tesla / Teslemetry for the map. We do not start charging from that GPS (there is no geofence Plug & Charge).
- When voting for a charger site we store the coordinates the user marked, and check via OpenStreetMap Nominatim that they are in Hungary.
- Public installation coordinates of charge points (not personal data) are shown on the map.
3.5. RFID / NFC data
- RFID identifier (idTag) for authentication at the charger; the raw tag is not stored, only a salted/peppered hash
- NFC card UID – if the user uses NFC identification in the app
3.6. Vehicle data (optional)
- Vehicle type, licence plate, VIN (provided by the user)
- When a Tesla account is linked: vehicle ID, VIN, charge level, wake state – via the Tesla Fleet API or Teslemetry, with the user’s consent
- The Tesla GPS cache is for the map only; it is not used to start a charge
3.7. Guest QR charging (no account)
- Session token, charge point and connector, payment status, OCPP command ID
- The guest enters card details on Adyen’s page; we do not store the card number
- E-mail and billing details if the guest requests an invoice
3.8. ISO 15118 Plug & Charge
- eMAID contract ID, VIN (if the charger or vehicle provides it), Plug & Charge on/off
- Contract certificate and the associated wrapped/encrypted key, validity, OCSP status
- Chosen PnC payment method (wallet or tokenised card)
3.9. Toilet access (PIN)
- The 6-digit PIN is never stored in the clear: per-row salt plus pepper hash
- Issue time, expiry, user ID, request IP
3.10. Charger-location voting
- Vote, marked coordinates, optional comment
- Nominatim country check (cached, Hungary only)
How we handle bank cards
PlugZone does not store the full card number (PAN), the CVV/CVC, or the cardholder signature. The user enters these only on the PCI DSS-certified payment page of Adyen N.V., a payment institution supervised by the Dutch/EU authorities and used under Hungarian law. Adyen’s privacy notice: adyen.com/privacy-policy.
If a card is stored from the profile (“Add bank card”), at subscription checkout, or during a card charge, Adyen tokenises it. Our database keeps only the following, which are not a card number:
- An Adyen stored payment method ID (token, max. 64 characters) on the user account – for Plug & Charge card billing and/or subscription renewal
- An Adyen shopper reference of the form
user-{user id}– this binds the token to the account at Adyen - The brand, last 4 digits and expiry shown on the profile (e.g. VISA •••• 1234) are not saved in our database: we fetch them from the Adyen API on each page load
- Payment-transaction metadata: amount, time, status, Adyen PSP reference, token ID – for accounting and complaints
- When adding a card, Adyen may place a small pre-authorisation hold (typically HUF 100), which we void rather than capture once the token exists
- A stored card can be removed from the profile: we disable the token at Adyen and delete the token ID from the account. Guest QR charging does not attach the card to an account
With the token the Provider may place a pre-authorisation or charge without asking for the PAN again (Plug & Charge, subscription renewal, card charging). The token cannot be reversed into a full card number. Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and, for accounting records, legal obligation (Art. 6(1)(c)). Retention: the token until the card or account is deleted; payment records for 8 years.
4. Purposes and legal bases of processing
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Creating and managing the user account | Performance of a contract – Art. 6(1)(b) | Until account deletion |
| Providing the charging service | Performance of a contract – Art. 6(1)(b) | Until account deletion + 5 years |
| Processing payment transactions | Legal obligation – Art. 6(1)(c) | 8 years (Accounting Act) |
| Finding the nearest charge point (location data) | Consent – Art. 6(1)(a) | Not stored |
| Sending push notifications | Consent – Art. 6(1)(a) | Until opt-out |
| Handling customer service inquiries | Legitimate interest – Art. 6(1)(f) | 3 years |
| Maintaining system security | Legitimate interest – Art. 6(1)(f) | 90 days |
| Guest QR charging and card pre-authorisation | Performance of a contract – Art. 6(1)(b) | Accounting retention: 8 years |
| ISO 15118 Plug & Charge (eMAID, certificate) | Performance of a contract – Art. 6(1)(b) | Until the feature is turned off / the certificate expires |
| Tesla vehicle position on the map (telemetry cache) | Consent – Art. 6(1)(a) | Until Tesla unlink, overwritten by the next telemetry update |
| Issuing invoices (Számlázz.hu) | Legal obligation – Art. 6(1)(c) | 8 years (Accounting Act) |
| Issuing a toilet PIN | Performance of a contract – Art. 6(1)(b) | Shortly after expiry/use; limited time in the log |
| Managing subscriptions (Smart / Pro) | Performance of a contract – Art. 6(1)(b) | Until the subscription and accounting retention end |
| Charger-location voting | Legitimate interest / consent – Art. 6(1)(f) / (a) | Until the vote is withdrawn or the campaign ends |
| OCPI interoperability (sessions/CDRs to EMSP partners) | Contract / legitimate interest – Art. 6(1)(b) / (f) | Per the partner contract and accounting rules |
5. Mobile application-specific information
The PlugZone Android and iOS apps may request the following device permissions:
| Permission | Purpose | Required? |
|---|---|---|
| 📍 Location access | Finding the nearest charge point | Optional |
| 📷 Camera | Scanning the QR code at the charge point | Optional |
| 📳 NFC | NFC-based authentication | Optional |
| 🔔 Notifications | Charging status notifications | Optional |
| 🌐 Internet | Required for the service to function | Required |
| 🔐 Biometric authentication | Biometric confirmation of payment | Optional |
Important: Optional permissions are only requested when the user first uses the relevant feature. They can be revoked in the Android or iOS system settings. Biometric data stays on the device and is not sent to our servers.
6. Sharing data with third parties
We do not sell personal data to third parties.
We share data with the following providers only to the extent necessary to deliver the service:
| Partner | Purpose | Data shared |
|---|---|---|
| Adyen N.V. | Processing online payments | Payment data (tokenized) |
| Google Firebase (FCM) | Delivering push notifications | FCM token, message content |
| Tesla, Inc. / Teslemetry (optional) | Vehicle integration, telemetry for the map | OAuth token, vehicle ID, VIN, cached GPS |
| KBOSS.hu Kft. (Számlázz.hu) | Electronic invoicing | Billing name, address, tax number, line items, amount |
| OpenStreetMap Nominatim | Address search and Hungary check when voting | Search query / coordinates (not an account ID) |
| OCPI EMSP partners | Roaming: session, CDR, charger status | Session ID, energy, time, token (as required by the protocol) |
| Cloudflare, Inc. | HTTPS termination and proxying to the origin | IP address, request metadata (edge logs, under Cloudflare’s own policy) |
We disclose data to authorities only when legally required to do so (e.g. a valid court order).
Some processors (Adyen, Cloudflare, Google Firebase, Tesla) may have parent companies outside the EEA. In that case transfers take place under the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses (SCCs).
7. Data security
- All data transmission is encrypted with TLS 1.2+ (HTTPS)
- Passwords are stored using bcrypt hashing
- Payment card data is handled by Adyen – no card numbers are stored in our system
- Servers are protected by a firewall, with regular backups
- Access control: only authorized staff can access the data
- Personal data is stored and processed within the European Union (EU/EEA)
- RFID identifiers and toilet PINs are stored hashed (PINs with a per-row salt)
- Plug & Charge contract keys are stored wrapped/encrypted
8. Cookies
The website uses the following cookies:
| Cookie name | Type | Purpose | Lifetime |
|---|---|---|---|
| PHPSESSID | Necessary | Session management | Until end of session |
| csrf_token | Necessary | CSRF protection | Until end of session |
| lang | Necessary | Remember language choice | 1 year |
| plugzone_gst_* | Necessary | Guest QR session identifier | 24 hours |
We do not use marketing or tracking cookies.
Light/dark theme is kept in browser localStorage (`plugzone-theme`); it is not a cookie and is not sent to the server. Biometric login stays on the device; we do not receive fingerprint or face data.
9. Data subject rights (GDPR Art. 15–22)
The user has the right to:
- Right to be informed – On request, we tell you what data of yours we process
- Right of access – You may request a copy of your stored data
- Right to rectification – You may request correction of inaccurate data
- Right to erasure ("right to be forgotten") – You may request deletion of your data
- Right to restriction of processing – You may request that processing be suspended
- Right to data portability – You may request your data in a machine-readable format
- Right to object – You may object to processing based on legitimate interest
- Withdrawal of consent – May be withdrawn at any time, without justification
You may exercise your rights at e-mail-cím. We respond within 30 days.
🗑️ Account and data deletion
You may delete your account and its associated data at any time:
– On the website: Delete account page
– In the app: Profile → Delete account
– E-mail: e-mail-cím
We fulfil deletion requests within 30 days.
10. Protection of children's data
The Service is not intended for persons under 18, and we do not knowingly collect data from minors. If we become aware that we are processing a minor’s data, we take immediate action to delete it.
11. Amendments to this Policy
We reserve the right to amend this Policy. Users will be notified of material changes via the app or by email. The amended Policy takes effect on the date of publication.
12. Remedies
If you believe your personal data has been processed unlawfully, you may file a complaint with:
National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa u. 9-11.
Phone: +36 (1) 391-1400
E-mail: [email protected]
Website: naih.hu
The data subject may also turn to a court in the event of a violation of their rights.
14. Automated decision-making
The Controller does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and does not profile you for that purpose.
13. Contact
For data protection questions or requests, please contact us:
- 📧 E-mail: e-mail-cím
- 📬 PlugZone Kft., 1108 Budapest, Újhegyi út 14. B épület fsz. 2. ajtó