Name of the data  processing

and purpose

Legal basis for data processing

Scope and source of the processed data

Duration of data processing

Recipient of the data transfer

Data processing and related activities

Electronic contracting, use of services, provision of infrastructure for charging electric vehicles via an app, provision of the service (including the sending of push notifications to the user via the application for this purpose), payment of the service fee

billing, contact

Push notifications are displayed only if the User has consented to this during the use of the application.

MOL Plugee User has the opportunity to link his/her MOL Plugee and MOL MOVE User accounts. Accordingly, the MOL Plugee User will earn Loyalty Points for each of his/her travels in accordance with the terms and conditions of the MOL MOVE GTC. This processing is governed by the relevant MOL MOVE documents: GTC (molmove.hu) Privacy Policy (molmove.hu)

Performance of the contract pursuant to Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract)

In addition, this processing is pursuant to Article 13/A (1)-(9) of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services.

In the case of registered users, the Company processes profile pictures and other optional data only with the express, voluntary consent of the user, pursuant to Article 6 (1) (a) of the GDPR. (the data subject has given consent to the processing of their personal data for one or more specific purposes)

Mandatory data for non-registered (occasional) users:

e-mail address, billing: billing name, billing address, tax number, bank card details: name on credit card, credit card number, expiry date, CVC/CVV code.

Optional data:

Surname, first name, telephone number

Mandatory information for registered users:

country, surname, first name, e-mail address, phone number, language, password, billing: billing name, country, address, city, postal codem bank card details: name on bank card, bank card number, expiry date, CVC/CVV code.

Optional data:

gender, profile picture.

In addition to the above, certain personal data generated in the course of the use of the service by Business Users in the context of cooperation with Corporate Clients:

If the Corporate Client is a physical or virtual fuel card partner of MOL, the number of the fuel card used to use the Plugee service, fuel card usage data (e.g. information relating to transactions and their timestamps), the date of registration, communications with the Business User (e.g. statements, complaints, inquiries), and discounts applicable to the Business User

In the case of data processed on the basis of electronic contracting, the use of a service, the provision of a service and the maintenance of contact, for 30 days from the termination of the service contract.

Invoicing data: the Data Controller is obliged to keep the electronic invoices issued in connection with the service in accordance with and for the duration of the provisions of Articles 165-169 of Act C of 2000 on Accounting and in accordance with Articles 77-78 and 202 of Act CL of 2017 on the Rules of Taxation.

In the case of e-roaming, billing data will be stored in accordance with the tax and accounting rules of the invoice issued in the country of the MOL Group.

In the context of the use of the service by Business Users  in cooperation with an Corporate Client:

The scope of the contract between the Corporate Client and MOL shall prevail, subject to the Parties' regular agreement on the list of Business Users. If the Business User's legal relationship with the Corporate Client is terminated, his personal data will be deleted within 15 days of the Corporate Client's notification to this effect at the latest.

When using the internal roaming service within the MOL Group, personal data required for internal payment and billing will be transferred between the MOL Group companies (the CPO) and the e-mobility service provider (EMSP).

In this case, the billing will be carried out by the subsidiary of the MOL Group in the country of the respective billing point.

For the purposes of the above data processing, the members of the MOL Group are considered as joint controllers. The following subsidiaries participate in the e-roaming service:

CZ:

MOL Česká republika, s.r.o.

Moulíkova 3286/1b, 150 00 Praha 5 – Smíchov, Czech Republic

SLO:

MOL & INA, trgovina z nafto in naftnimi derivati d.o.o.Ulica 15 Maja 19, 6000 Koper, Slovenia

RO:

MOL Romania Petroleum Products SRL

Societa cu raspundere limitata

Bd. 21 Decembrie 1989 77, et. 1 cam.C.1.1

400604 Cluj-Napoca, Romania

SK:

SLOVNAFT a.s.

akciová spoločnosť

Vlčie hrdlo 1

82412 Bratislava, Slovakia

HR:

TIFON d.o.o.

 Zadarska 80, 10000 Zagreb, Croatia

In the context of the use of the service by Business Users in cooperation with a Corporate Client: Corporate Client

Driivz Ltd. – provision of ancillary services related to data management in the course of the electromobility service, operation of a telephone application, server services

(seat: Hod Hasharon, 4 HaHarash Street, Israel)

MOL GBS Hungary Ltd. – invoicing (seat: 1117 Budapest, Dombóvári út 28., Hungary) - provision of ancillary services closely related to the data processing, billing

Improve the quality of the service, based on the specific technical characteristics of the vehicle, resulting in the provision by the Data Controller of an appropriate electric charging infrastructure, in line with the technical needs of the users' vehicles.

Pursuant to Article 6(1)(f) of the GDPR, data processing is in the legitimate interest of the Company (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child).

It is in the legitimate interest of the Company to know the characteristics of the vehicles of the users of its service in order to continuously improve the charging infrastructure to meet the needs of the users.

The interest assessment test is available on request.

Data on the user's vehicle: manufacturer, year, type of vehicle

In accordance with the previous data processing purpose.

Driivz Ltd. – provision of ancillary services related to data management in the course of the electromobility service, operation of a telephone application, server services

(seat: Hod Hasharon, 4 HaHarash Street, Israel)

Send marketing messages, offers, coupons via email or app.

Sending invitations to participate in challenges, market research, satisfaction surveys, questionnaires via email, app

Invitations to participate in campaigns, games.

The sending of the above messages will only take place if the data subject has given his/her express consent. The customer can give his consent in the application.

If the Customer has expressly consented to receiving notifications in the mobile application, marketing content may also be displayed to them in the form of push notifications within the application.

Consent of the data subject pursuant to Article 6(1)(a) of the GDPR (the data subject has given consent to the processing of their personal data for one or more specific purposes)

The data subject can withdraw his/her consent in the application or via the customer service at any time.

First name, surname, e-mail address, phone number, if the user has given it: gender

The data will be stored for 30 days from the date of termination of the contract, but will be deleted immediately after withdrawal of consent.

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. – customer service administration, complaints handling

(seat: 1044 Budapest, Óradna street 5., Hungary)

In the case of e-roaming, if the customer subscribes to a newsletter from a foreign subsidiary:

MULTICOM CONTACT Ltd.

seat: 1121 Budapest, Zsigmondy Vilmos street 8/b. - customer service provider in the following countries: SLO, RO, SK, CZ, HR

(customer service tasks, direct communication with customers.)

Complaints handling

Handling and responding to consumer complaints made in writing, electronically, by telephone or in person, and dealing with service-related notifications and service-related complaints

To address consumer complaints: pursuant to Article 17/A (2)-(6) of Act CLV of 1997 on Consumer Protection ("the Consumer Protection Act"), the Company is obliged to investigate complaints from the persons concerned who are consumers and, if the consumer does not agree with the handling of the complaint or if it is not possible to investigate the complaint immediately, the Company shall immediately take a record of the complaint and its position on it and provide or send a copy of the record to the consumer, depending on the nature of the complaint.

If the Customer uses an e-mobility service abroad from a company belonging to the MOL Group, the Customer may choose to.

-     if you are a registered customer, you can also contact the customer service of your electromobility provider or the operator of the electric charging equipment in your country with a complaint.

-     in the case of a case-by-case customer, you can contact the customer service of the charging equipment operator in the Application or, if you start charging from the website.

The user name, surname, first name, address, telephone number, e-mail address of the person concerned, the data contained in the notification, the data necessary for the payment of any compensation (bank account number), in the case of damage to a motor vehicle, data relating to the motor vehicle, in particular the type of vehicle, the year of manufacture, the place and time of the e-charging, the identification number and type of the charging equipment used,

type of charging socket used.

In addition, the record of the (consumer's) complaint shall include the place, time and manner of lodging the complaint, a detailed description of the consumer's complaint, a list of documents and other evidence presented by the consumer, the Company's statement of its position on the consumer's complaint, if an immediate investigation of the complaint is possible, the signature of the person who took the record and, except for oral complaints made by telephone or other electronic communication services, the consumer, the place and time of taking the record.

The Company is obliged to keep the minutes of the complaint and a copy of the Company's response to the complaint for 3 years pursuant to Act CLV of 1997 on Consumer Protection and to present them to the supervisory authority upon request (Article 17/A (7) of the Consumer Protection Act).

In the case of e-roaming, if the customer contacts a local customer service or if the processing or handling of a complaint requires the transfer of the complaint, the civil law or consumer protection laws and regulations of the country concerned shall apply. The occasional user can obtain information from the customer service department of the CPO (the MOL Group subsidiary where the charger is located).

In the event of a request from the Consumer Protection Authority and other competent authorities, to forward the data requested by the authority to the authority.

MOL Hungary Corporate Services Ltd.. – mail management (seat: 1117 Budapest, Dombóvári street 28., Hungary)

MOL GBS  Hungary Ltd. – payment of damages (seat: 1117 Budapest, Dombóvári street 28., Hungary)

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. – customer service administration, complaints handling

(seat: 1044 Budapest, Óradna street 5., Hungary)

for e-roaming:

MULTICOM CONTACT Ltd.

seat: 1121 Budapest, Zsigmondy Vilmos street 8/b., Hungary

customer support service for complaints in the following countries:  SLO, RO, SK, CZ, HR

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. and MULTICOM CONTACT Ltd. perform customer service tasks and responsible for direct communication with customers.

MOL has access to user data in the event that Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. and MULTICOM CONTACT Ltd. are unable to resolve the complaint within their own competence and need technical assistance from MOL

Recording telephone conversations with the Company's Customer Service

Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child).

. The legitimate interest of the Company exists because it is important for the Company to be able to reconstruct events in the case of certain notifications and enquiries from consumers.

The Company will make the interest test available on request.

The audio of calls received and made through the Customer Service call centre (call centre). The recordings include the voice of Customers, non-customer stakeholders and customer service agents. In the case of notifications, the name, telephone number, e-mail address of the data subject, the data contained in the notification, the name of the customer user, if applicable, and the data required for the payment of any compensation (bank account number) are also recorded.

The specific audio recording and the related personal data will be kept by the Company (for 5 years) (in accordance with Act V of 2013 on the Civil Code (Civil Code), § 6:22 (1), for the enforcement of possible civil claims of the Company and the defence against possible civil claims of the data subjects, and in accordance with § 17/B (3) of the Act on the Protection of the Data Subjects' Rights.

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. – customer service administration, complaints handling

(seat: 1044 Budapest, Óradna street 5., Hungary)

for e-roaming:

MULTICOM CONTACT Ltd.

seat: 1121 Budapest, Zsigmondy Vilmos street 8/b., Hungary

customer support service for complaints in the following countries:  SLO, RO, SK, CZ, HR

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. and MULTICOM CONTACT Ltd perform customer service tasks and responsible for direct communication with customers.

MOL has access to user data in case Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. and MULTICOM CONTACT Ltd. are unable to resolve the complaint within their own competence and need technical assistance from MOL.

Communicating with Customers and non-Customer data subjects in writing or by email, answering questions, reconciling data

Article 6(1)(a) of the GDPR – (the voluntary consent of the data subject, whereby the data subject has given consent to the processing of their personal data for one or more specific purposes)

given by the data subject by sending the Company the request and the data contained therein, to the extent necessary to reply to the request and to carry out the activities contained therein (e.g. providing information).

The data subject has

the right to withdraw

his or her consent at

any time. The

withdrawal of consent

shall not affect the

lawfulness of

processing based on

consent prior to its

withdrawal.

In the absence of the

data subject's consent,

the Company will not

be able to respond to

such requests.

Personal data contained in the Customer's request and in written correspondence or e-mail

For data subjects other

than the Customer (may vary depending on the subject matter of the inquiry): the

name, address, e-mail

address of the data subject, the data

contained in the

notification, the data

necessary for the

payment of any

compensation (bank

account number), in the

case of motor vehicle

damage, data relating

to the motor vehicle, in

particular the type of

vehicle, the year of

manufacture, the place

and time of e-charging,

the identification

number and type of the

charging equipment

used,

the type of charging

socket used, other data

contained in the data

subject's request.

It will be kept until the

withdrawal of the data

subject's consent or,

failing this, for 5 years

(in accordance with the

Civil Code. 6:22 (1)), for

the purpose of

enforcing any civil law

claims of the Company

and defending against

any civil law claims of the data subjects.

In the event of

withdrawal of consent,

the Company shall

consider that the data

subject does not wish

to assert any claims in

connection with the

request and the

Company's response to

it, and the

communication and

reconciliation of data

with the Company.

MOL Hungary Corporate Services Ltd. – mail management

(seat: 1117

Budapest, Dombóvári út

28., Hungary)

MOL GBS Hungary Ltd.– compensation for

damages (seat:

1117 Budapest, Dombóvári út 28., Hungary)

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. – - written or

e-mail communication

with non-customer data

subjects, answering

questions, data

reconciliation

(seat: 1044

Budapest, Óradna street 5., Hungary)

For e-roaming

MULTICOM CONTACT Ltd. (seat:1121 Budapest, Zsigmondy Vilmos street8/b., Hungary

communication with non-customer data subjects in

writing or by e-mail,

answering questions,

data reconciliation in:  SLO, RO, SK, CZ, HR

Use of discounts and

promotions based on

cooperation

agreements with other

legal entities

The Company provides

ad hoc discounts and

promotions to a limited

number of Users based

on partnership

agreements with legal

entities related to emobility.

The performance of a

contract with a legal

person or a partner for

a discount pursuant to

Article 6(1)(b) of the

GDPR. The Company processes data only to

the extent necessary to

verify the Customer's

entitlement to the

discount.

The Company does not

transmit personal data

about the customer to

its contractual partners.

In the case of a

company belonging to

the MOL Group:

Business User ID,

Corporate Customer

Name

The data will be stored

for 30 days from the

expiry of the promotion

or discount, or until the

termination of their

contract.

Corporate Client

Driivz Ltd. –  provision of

ancillary services related

to data management in

the course of

electromobility services,

operation of a telephone application, server

services

(seat: Hod Hasharon,

HaHarash u. 4, Israel) -

identification of the data

required for the

customer to receive the

discount, verification of

eligibility.

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Ltd. – customer service and

information related to

actions and services

(seat: 1044

Budapest, Óradna street 5., Hungary)

For e-roaming:

MULTICOM CONTACT Ltd

seat: 1121 Budapest, Zsigmondy Vilmos street 8/b., Hungary

customer support and

information on

promotions and services

in:  SLO, RO, SK, CZ, HR

Enforcement of legal

claims

Data retention by the Customer Service in

relation to

communications with

Customers and other

data subjects for the

purpose of pursuing

legal claims and

successfully defending

a dispute or a legal

proceeding

Article 6(1)(f) GDPR

(processing is necessary

for the purposes of the

Company's legitimate interests). Legitimate

interest: the assertion

of a claim by the

Company and the

successful defence of a

dispute or legal action

brought by the

Customer.

All personal data

covered by this privacy

notice, in particular:

User name, surname, first name, e-mail

address, details in the

notification, bank

account number,

details of the vehicle in

the event of damage to

the vehicle, place and

time of the e-recharge,

identification and type

of the charging

equipment used,

the type of charging

socket used,

the type and year of the

vehicle, other data

necessary for the

exercise of legal claims

and the defence in legal

or administrative

proceedings (for

example: data

voluntarily provided by

the data subject in the

request).

Data source: the

Customer Service.

The Company shall

keep documents (e.g. emails, letters, paper

requests) and other requests related to the

communication made

by the Customer

Service for 5 years after

their receipt by the

Customer Service (in

case of e-mails, their

accessibility, in case of

telephone calls, their

recording) (in

accordance with the

Civil Code. 6:22 (1)),

with regard to the

enforcement of any

civil law claims of the

Company and the

defence against any

civil law claims of the

data subject, as well as

in accordance with

paragraph 17/B § (3) of

the Act on the

Protection of the Data

Subject.

If the processing of

personal data is

necessary for the

defence of a judicial or

administrative

procedure initiated by

the data subject or for

the enforcement of the legitimate interest of

the Company, the

Company is entitled, on

the basis of its own

legitimate interest

(Article 6(1)(f) GDPR),

to process the personal

data concerned until

the final conclusion of

the procedure or until

the enforcement of the

legitimate interest by

other means (e.g. the

conclusion of an out-ofcourt settlement) and,

if it is not necessary to

keep a complete

written or electronic

document containing

the data, to extract the

necessary data from

the document.

Employees of the

Company's Regional

Security, Group

Security, Internal Audit and Legal organisations

have access to the

personal data necessary

for the investigation.

MOL Hungary Corporate Services Ltd. – mail

management (seat: 1117 Budapest,

Dombóvári street 28., Hungary)

MOL GBS Hungary Ltd.– compensation for

damages (seat:

1117 Budapest, Dombóvári út 28., Hungary)

Pandant Távfelügyeleti és Mérő-ellenőrző Szolgáltató Kft. – First round legal action

(seat: 1044

Budapest, Óradna street 5., Hungary)

For e-roaming:

MULTICOM CONTACT Ltd

seat: 1121 Budapest, Zsigmondy Vilmos street 8/b., Hungary

Legal claims in the first

instance

in the following

countries:  SLO, RO, SK, CZ, HR

Céginformáció.hu Korlátolt Felelősségű Társaság - Claims

management

(seat: 1191 Budapest, Üllői út 200.4. em., Hungary)

User data will be

transferred to the

Service Provider in the

event that the Service

Provider has a financial

claim against the user.

Prevent, detect and

investigate fraud and

abuse of the Service

The prevention and

investigation of

fraud and abuse is

governed by the MOL

Group Code of Ethics

and Business Conduct,

Business Partner Code of Ethics, Ethics Council

Code of Conduct ("Code

of Ethics"), which are

available at:

https://mol.hu/hu/molr

ol/etika-esmegfeleles/etika/

Article 6(1)(f) GDPR

(processing is necessary

for the purposes of the

legitimate interests of

the controllers).

Legitimate interest: to

prevent, detect and

prosecute irregularities

that threaten the

assets, trade secrets,

intellectual property and business reputation

of controllers, as well as

an appropriate,

respectful and fearless

and non-retaliatory

working environment.

Name, data generated

during the

investigation. Data

controllers process the

data necessary to carry

out the investigation,

such as the card

number with the "block

data" they otherwise

process (e.g. name,

item number, quantity, price, place and time of

purchase of the Service

purchased, etc.), in

order to detect and

investigate possible

misuse of the card, for

the duration of the

investigation necessary

for this purpose.

If the investigation

reveals that the

notification is

unfounded or that no

further action is

necessary, the data

relating to the

notification shall be

deleted within 60 days

of the end of the

investigation.

If action is taken on the

basis of the

investigation, including

legal proceedings or

disciplinary action

against the reporting

person, the data

relating to the report

may be processed in

the employer reporting

system until the final

conclusion of the

proceedings initiated

on the basis of the

report at the latest.

- If the Company

launches an ethics

investigation, the

members of the Ethics

Board will have access

to the data necessary

for the investigation.

- Where the Company

initiates other

procedures to prevent,

detect and investigate fraud and abuse,

employees of the

Region Security, Group

Security and Internal

Audit organisations will

have access to the data

necessary for the

investigation.

- If the investigation

involves other MOL

Group members and

the company in

question asserts a legal

claim on the basis of the

investigation, the HR

organisation of the

company in question,

the HR organisation of

the Company, the legal

organisation of the

company in question

and the legal

organisation of the

Company will have

access to the data.  

MOL IT & Digital GBS Ltd.

 (seat: 1117 Budapest, Dombóvári street 28., Hungary) - the provision of IT

and server services

closely related to data

management.