Privacy Statement

Stekker.app B.V., established in Amsterdam and registered with the Chamber of Commerce under number 76476758, together with all of its affiliated companies, attaches great importance to the careful handling of your personal data. We make sure that your personal data is handled and secured with care. In doing so, we comply at all times with applicable laws and regulations. You can find our other contact details here.

Please read this privacy statement carefully before using our services (the Services, which include, among other things: our mobile applications and other software, and our website). By using our Services, you agree to this privacy statement.

In this privacy statement we explain which personal data we collect when you use our Services or contact us, why we collect this personal data, and what we do with it.

Who is who in this statement?

you or your - we mean by this the user of our Services.

we, our, or us - we mean by this Stekker.app B.V. and companies affiliated with Stekker.app B.V. and/or its employees.

What data do we keep and for what reasons?

For our Services we process the personal data listed below for the purposes and on the legal bases also listed below. In doing so, we try to respect and protect your privacy as much as possible. We process your personal data on the basis of the following grounds set out in European privacy law:

1. consent;
2. performance of a contract;
3. legal obligation; and
4. our legitimate interests, by which we mean, among other things, advertising, marketing, security, auditing, fraud detection, crime prevention, market research into and analysis and improvement of our services, internal management, legal affairs and corporate administration.

Below, we indicate at all times which legal basis applies to a specific processing of your personal data.

Creating an account

To create an account you must provide: (i) your contact details (first name, email address, address); and (ii) the password for your account. Depending on the processing, legal basis 2 or 4 applies.

Data for optimal use of our Services

We make sure that our website, our mobile applications and other software work properly so that you can make optimal use of them. To this end, when you visit our website and our mobile applications, we collect your IP address, information about your internet browser, any language settings, and information about the operating system settings of the computer or mobile device you use to visit us. Depending on the processing, legal basis 2 or 4 applies.

Data about your car and charging point

To use our Services you must provide: (i) the make and model of your electric car; (ii) the charge point operator and brand of your charging point; and (iii) if payment is due, your first name, last name, email address and any bank details. Depending on the processing, legal basis 2 or 4 applies.

Support

We receive your personal data as soon as you contact us by phone, email, our contact form or any other means of communication. We then process this data in order to respond to the message you sent us. In this context we may, for example, collect and share internally (telephone) requests received by our customer support and the related responses, together with the other contact details (as described above under "creating an account") and any other data. This allows us to respond better to your questions. Depending on the processing, legal basis 1 or 4 applies.

Information messages

We may use your contact details to send you information messages that are necessary in order to provide our Services. Legal basis 2 applies.

Testing and analysis

We use your personal data to analyse how you use our Services and how we can improve our Services. For example, the time, duration and meter readings of charging at the charging station, linked to the use of the charge cards, the amount of kWh consumed, and location and other charging station information. This also includes using the data to detect and resolve errors and disruptions in the Services. Legal basis 4 applies.

Data on charging costs

Because we believe you have the right to see how charging costs are made up, we list the number of kWh, the time, the duration, the location and other charging station information on the invoice. This data is therefore also stored in our records. Legal basis 2 applies.

Data aggregation

To keep the processing of your personal data to a minimum, we may aggregate or encrypt your personal data to create anonymous data that can no longer be traced back to a natural person. Legal basis 4 applies.

Compliance with local laws

In order to comply with applicable law, we may be required to process your personal data for purposes other than those set out in this privacy statement, for example for law enforcement and in the event of a court order. Legal basis 3 applies.

Marketing

To the extent permitted under applicable law, we may use your contact details for marketing communications, such as newsletters. If you have chosen to receive the newsletter, we use your name and email address to send newsletters by email. You can unsubscribe at any time. The newsletter may also contain information and offers from other parties. Each newsletter contains a link to unsubscribe from our newsletter. Depending on the processing, legal basis 1 or 4 applies.

Other personal data

In addition to the specific categories of personal data listed in this privacy statement, we may also process other personal data that you provide to us in the context of your use of the Services. This includes any information that you, your connected charging station, and your car share with us, but which does not fall under any of the other specific categories. Depending on the processing, legal basis 1 or 4 applies.

How do we secure your data?

Our Services have been carefully developed by us and our partners. However, security can never be guaranteed 100%. If we become aware of a security vulnerability, we will make every effort to take appropriate measures promptly. Our website, for example, uses an SSL certificate and other common techniques to prevent misuse.

If you have the impression that your personal data is not adequately secured, please contact us.

When you use our Services, you may come across references to other websites and/or companies. We accept no responsibility for compliance with privacy legislation by these third parties.

With whom do we share your data?

Within our organisation, employees and software developers involved have access to your personal data.

For any payments and direct debits, we provide your personal data to banks to the extent necessary.

We will never sell, rent or use your personal data for other commercial purposes, unless you have given your consent. We only share your data if:

• it is required by law. In that case we only share data that is legally required;
• we may transfer your personal data to third parties in the event of a merger, acquisition, reorganisation, sale of business units or bankruptcy of our company. In that case we will ask for your prior consent if this is required under applicable law;
• it fits the purposes for which we record and/or process your personal data, to the extent legally permitted, for example because you have given consent for this;
• we may share your personal data for the purposes set out in this privacy statement with external partners who provide certain services for us. These partners may record or use your personal data on our instructions. Examples are Google Mail, banks, our accountant and the connected CPOs that operate your charging station.

If an organisation qualifies as a (sub) processor under European privacy legislation, we will conclude a (sub) processor agreement with that organisation. Processing of your personal data then only takes place on our instruction and under our responsibility.

Our Services are managed and operated from the Netherlands. If, nevertheless, personal data is transferred to a third party abroad, this only takes place to a third party in a country that, according to the European Commission, offers an adequate level of protection for personal data. If such an adequate level of protection is lacking, we will ensure that the legally required safeguards are provided, such as concluding an EU model contract. At the time of drafting this privacy statement, your personal data is only transferred abroad in the context of our legitimate interests: Google Analytics.

Use of cookies

In our Services we make use of cookies. A cookie is a small simple file that a website stores on your hard drive via the browser. A cookie contains stored information. During each visit, various types of cookies may be used.

Which types of cookies are used on the Platform and for what purpose

We use the various types of cookies listed below for the purposes also listed below.

Analytical cookies

Analytical cookies are anonymous cookies that allow us to improve our Services. These cookies collect information on how visitors use our website or our mobile applications, such as information on the most visited pages or the number of error messages displayed. The information collected by these cookies may not be used for marketing purposes and is not passed on to third parties.

Session cookies

Session cookies are deployed during your visit to our website or mobile application and are automatically deleted when you log out. These cookies are necessary to make sure you stay logged in while using our applications.

Other/unforeseen cookies

Due to the way the internet and websites work, we may not always have insight into the cookies that are placed by third parties. This is particularly the case if there are web pages that contain embedded elements.

Specific overview of cookies used

You can find an overview of the cookies used on the Platform via this link.

Adjusting cookie settings or deleting cookies

If you do not want us to place cookies on your (mobile) device, you can refuse the use of cookies via the settings or options of your browser. For each browser and each (mobile) device, you must adjust your settings separately. Please note: it is possible that, after adjusting the cookie setting, some parts of our Services can no longer be used (correctly). When we have placed cookies, you can also delete them. How to do this differs per browser. If necessary, consult the help function of your browser.

If, when using our Services, you come across cookies that we have not mentioned above, we kindly ask you to report this to us.

How long is your data retained?

We do not retain your personal data longer than strictly necessary for the purpose for which we process it.

For example, the Dutch Tax Authority requires us to retain our records for an extended period. The legal term for this is currently 10 years. We comply with this legal requirement.

If you create an account, this data will be retained as long as you use it or are able to use it. After cancellation, we will only delete the data we no longer need. In any case, we still need:

• agreements we have concluded with you;
• information about payments that have been made;
• data of charging transactions that have been carried out, in order to allow charging station operators to verify whether we are paying them correctly for their services, including time, duration, charging station identification, card number, amount of energy and location;
• data of other transactions carried out during our Services that are necessary in order to keep proper records.

If you contact us, we will retain your data for as long as necessary to answer and handle your question. If you have any questions about the retention period of your personal data, please contact us.

What rights do you have when it comes to your privacy?

Under privacy law, you have, among others, the right:

• to obtain access to the personal data we process about you;
• to correct, delete or restrict factually incorrect data;
• to restrict the use of your personal data;
• to have the personal data we hold about you transferred digitally to you or to a third party; and
• to object to the further processing of your personal data.

How do you make use of these rights mentioned above?

Via your user account or account management you can view, modify and/or delete personal data. For access to data that is not in your account, you can contact us directly.

You can unsubscribe from the newsletter via the link or by replying by email.

If the processing of your personal data is based on your consent, you can withdraw this at any time. Via the contact page you will find various ways to contact us in order to exercise your rights. Exercising one of these rights may have the effect that you can no longer use all the functionalities of our services.

Please note: we are entitled to refuse a request if we have a justified and/or compelling interest in doing so or if cooperation with that request can be refused on another legal basis.

What to do in the event of a privacy complaint?

We ask you to first report complaints about the handling of your personal data to us, for example if you suspect that your personal data has been misused or if you suspect a data breach. We will then be happy to look for a suitable solution together with you.

You also always have the right to file a complaint with the Dutch Data Protection Authority.

Data breach notification obligation

Although we process your personal data with the utmost care and your personal data is well secured, a data breach may occur. If a data breach occurs at our company, we will first assess whether and to what extent there may be a high risk to your rights and freedoms. If there is a high risk, we will report this to the Dutch Data Protection Authority.

To the extent that we are required to do so under relevant legislation, we will, in the event of a data breach, inform you about:

• the type of breach in connection with your personal data;
• the likely consequences of the breach;
• the measures we will take and have already taken to limit the consequences of the breach.

If you have the impression that there are indications of a data breach, please contact us.

What happens if this statement changes?

We may amend this privacy statement, but we will announce this well in advance by email or by notice on our website. The most recent version of this privacy statement can be found on our website at any time.

Version

This privacy statement was last amended on: 9 June 2026.