Privacy Policy
WE53 (trading name of WE53CY LIMITED) respects your privacy and protects your personal data. This Policy explains how we use, process and store the data we receive from you or about you, what rights you have and how the law protects you.
1. Scope
- This Policy applies when you use:
- the Website https://we53.io/, to the extent described in the Cookie Policy;
- the WE53 Mobile application and the web app at app.we53.io;
- Stations, when you get and return Power Banks, including when you pay by card at a Nayax terminal without registering;
- the Telegram bot for registration, the support chat on the Website and the channels connected to it (WhatsApp, Viber, Telegram, email);
- the “For business” form on the Website, and in business contacts before an agreement with a venue is signed (section 10).
- The Website, the Mobile application and the Stations are not intended for persons under 18.
- Questions: service@we53.io.
- The GDPR gives you the right to access, correct and erase your data, and other rights (section 8).
- The Website does not use analytics. Two settings (we53-country and we53-notice) are stored only in your browser. When the coverage map loads, your IP address is visible to OpenStreetMap (map tiles) and Cloudflare cdnjs (the Leaflet map library). The Crisp support chat sets a technical cookie only when you open it (clause 4.1). See the Cookie Policy for details. The Mobile application does not use third-party analytics services.
- “We”, “us” and “our” mean WE53; “you” means a visitor to the Website or a User of the Mobile application and Stations.
Controller. WE53CY LIMITED (trading as WE53), a company registered in the Republic of Cyprus, registration number HE 416108, address: Irakleous 1, SKY TOWER, 6th floor, office 604, Germasogeia, 4046, Limassol, Cyprus.
Data protection contact. service@we53.io, or by post to the Controller’s address.
Complaints. You may at any time lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy) or with the supervisory authority of the country where you live or work. We ask you to write to us first, and we will try to resolve the matter.
We undertake to keep your data secure, never to sell it, and to let you control marketing emails at any time.
2. What data we collect
- Data you provide: phone number, email (if you entered it in the app or on the Station screen for a receipt), support requests, participation in promotions and surveys.
- Rental data: Station number and address, Power Bank number, time of release and return, Tariff, amounts charged, order status (including buyout), photos of defects sent to support.
- Payment data. You enter your card number directly with the payment provider: Stripe in the Mobile application, Nayax at the Station terminal; we do not see or store it. From the provider we receive and store: the payment method identifier (token), card type, the first 6 and last 4 digits, the issuing bank and country, the card fingerprint, and payment amounts and statuses. Stripe processes data under its own policy (stripe.com/privacy) and complies with the PCI DSS standard.
- Device data: IP address, device model, operating system, app version, language, time zone, crash data; location only with your permission, to show the nearest Stations.
- Analytics. The Mobile application does not use third-party analytics or advertising attribution services and does not request the advertising identifier.
- Website: see the Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis (Article 6 GDPR) |
|---|---|---|
| Registration and phone number verification | phone number, code | performance of the contract |
| Releasing and returning a Power Bank, calculating the cost | rental data | performance of the contract |
| Charging payments and the buyout amount | payment data, rental data | performance of the contract; legitimate interest |
| Responding to disputes and chargebacks | rental data, payment data, correspondence | legitimate interest |
| Accounting and tax records, receipts | payments | legal obligation |
| Support and complaints | correspondence, rental data | performance of the contract; keeping the history of requests: legitimate interest |
| Showing the nearest Stations | location | consent |
| App stability and security | device data, crashes | legitimate interest |
| Marketing emails | consent (tick box in the app or on the Station screen); unsubscribe link in every email |
- Legitimate interest means our interest in running and protecting the WE53 business, balanced against your rights. Performance of the contract means processing without which we cannot provide the service. Consent means processing only after you have agreed; you can withdraw consent at any time without affecting the lawfulness of earlier processing.
- We use data only for the purposes for which it was collected or for compatible purposes, and without your consent only where the law requires or permits it.
4. Who we share data with
- payment providers: Stripe (Mobile application) and Nayax (terminals at Stations; EU representative: Nayax Europe UAB, Lithuania). For card data entered at a terminal, Nayax acts on our behalf;
- the hosting provider Hetzner Online GmbH (Germany), with servers in the EU;
- the phone verification service Twilio;
- Crisp (Crisp IM SAS, France): support chat and marketing emails, see clause 4.1;
- WE53 Holdings Limited (Cyprus), the owner of the Platform software: data is stored and processed in its systems on our behalf;
- accountants, auditors and lawyers;
- public authorities, where the law requires it.
The venues where Stations are installed do not receive Users’ personal data, only revenue totals per Station.
- Support chat (Crisp). We answer your messages in the chat on the Website and in the WhatsApp, Viber, Telegram and email channels connected to it through Crisp (Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France). Crisp processes data on our behalf as a processor under a data processing agreement.
- What data: your messages and files; the name, email or phone number you give; rental details you share (for example, a Station number); technical data: IP address, browser and device type, the page you wrote from.
- Why and on what basis: to answer your request and solve a problem with a rental (performance of the contract, Article 6(1)(b) GDPR); to keep a record of requests (legitimate interest, Article 6(1)(f) GDPR).
- Where: the data is stored on Crisp servers in the EU (the Netherlands and Germany), with encrypted backups in Ireland. Under its data processing agreement, Crisp does not transfer the data outside the EEA.
- How long: we keep support correspondence for 24 months after the last message, unless it is needed longer to handle a claim. Crisp system logs are kept for up to one year.
- Cookies: to keep the conversation across pages and visits, the chat sets technical cookies prefixed crisp-client on the Website for up to 6 months. They are not used for tracking and are set only after you open the chat.
Marketing emails. Through Crisp we also send emails with WE53 news and offers to those who have given consent (see the table of legal bases in section 3). You can unsubscribe using the link in any email; after that, your email is not used for marketing.
When you write to us via WhatsApp, Viber or Telegram, the messenger also processes your messages under its own privacy policy.
AI replies. Some replies in the chat are prepared by the Crisp AI assistant; we show this in the chat. Crisp AI runs on Crisp’s infrastructure in the EU (Scaleway, France) and does not pass conversations to external AI providers.
5. Transfers outside the EEA
Our servers are in the EU, with the hosting provider Hetzner Online GmbH (Germany). Data leaves the EEA only where the service cannot be provided otherwise: Stripe, to accept payment in the Mobile application (the account is held in the EU, but Stripe carries out part of the processing in the United States); Twilio (United States), to call your number with a verification code; Nayax, to accept payment at a terminal: under Nayax’s policy, payment data may be transferred to Israel (covered by a European Commission adequacy decision) and to the United States (EU standard contractual clauses). The WE53 team works with data only from within the EU. Crisp stores data in the EU and, under its data processing agreement, does not transfer it outside the EEA; some of its infrastructure providers are US companies (hosting with servers in the EU, the Cloudflare network), and any access by them is covered by the EU standard contractual clauses. Transfers to the United States are made on the basis of the European Commission adequacy decision (EU-US Data Privacy Framework) or the EU standard contractual clauses.
6. How long we keep data
| Data | Period |
|---|---|
| Account | while the account is active; after it is deleted, we delete the data within 5 days |
| Rental and payment data | 6 years after the end of the year to which the records relate (section 141(3) of the Companies Law, Cap. 113; section 30 of the Assessment and Collection of Taxes Law) |
| Support correspondence | 24 months after the last message, unless it is needed longer for a claim; Crisp system logs for up to 1 year |
| Email for marketing | until you unsubscribe |
7. Security
- Data is stored on secure servers, and transfers are encrypted with TLS.
- No transmission of data over the internet is completely secure, but once we receive your data we apply strict procedures and measures against unauthorised access.
8. Your rights
- access: to receive a copy of your data;
- rectification: to correct inaccurate data or complete incomplete data;
- erasure, including deleting your account in the Mobile application; data the law requires us to keep (section 6) is kept until the end of that period;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability: to receive your data in a structured format or have it sent to another controller;
- withdrawal of consent at any time;
- a complaint to the Cyprus Commissioner for Personal Data Protection.
We reply to a request within one month; in complex cases this may be extended by two further months, and we will tell you if so.
9. Children
The Agreement is concluded only with persons aged 18 or over. We do not check age or collect data about it, so we cannot know who uses a Station, especially when paying at a terminal. If you believe a child has given us data, write to service@we53.io and we will delete it.
10. Business enquiries and contacts
- This section is for representatives of venues and companies who send a request through the “For business” form on the Website, or whom we contact to offer a WE53 Station. Once an agreement with your company is signed, further processing of its representatives’ data (reports, invoices, payouts, the partner portal) is described in that agreement.
- What data. From the form: the name of your venue, your name, email, phone number (optional), your comment, the page language and the date and time of sending. At first contact: the name, job title and business phone number and email of the venue’s representative, obtained from them or from public sources (the venue’s website, Google Maps), and notes of meetings and correspondence.
- Why and on what basis. To reply to your request and prepare an offer or agreement: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). To offer cooperation to a venue we do not yet work with and to keep a record of discussions: legitimate interest (Article 6(1)(f) GDPR). You may object, and we will stop contacting you.
- Who receives it. Requests from the form pass through our server hosted by Hetzner Online GmbH (Germany) and arrive by email in WE53’s Google Workspace mailbox (Google Cloud EMEA Limited, Ireland). Contacts and the history of discussions are kept in the Pipedrive CRM (Pipedrive OÜ, Estonia), with data stored in the EU (Frankfurt data centre, Germany). Only WE53 staff who work with venues have access. Google may process data in the United States on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.
- How long we keep it. If no agreement is signed, for 24 months after the last contact, after which we delete it. If you object, we keep only a “do not contact” note so that we do not write to you again. If an agreement is signed, as set out in that agreement.
- Controller and contact. For venues in Cyprus: WE53CY LIMITED; for Greece and Portugal: the WE53 company in that country, whose policy is on the Website when you select the country. Questions and objections: partners@we53.io. Your rights are described in section 8.
11. Changes to this Policy
New versions are published on the Website and in the Mobile application with their date; we tell you about significant changes in the app or by email.
Η WE53 (διακριτικός τίτλος της WE53GR LTD) σέβεται την ιδιωτικότητά σας και προστατεύει τα προσωπικά σας δεδομένα. Στην παρούσα Πολιτική εξηγούμε πώς χρησιμοποιούμε, επεξεργαζόμαστε και αποθηκεύουμε τα δεδομένα που λαμβάνουμε από εσάς ή για εσάς, ποια δικαιώματα έχετε και πώς σας προστατεύει ο νόμος.
1. Πεδίο εφαρμογής
- Η Πολιτική εφαρμόζεται όταν χρησιμοποιείτε:
- τον Ιστότοπο https://we53.io/, στον βαθμό που περιγράφεται στην Πολιτική Cookies·
- την Εφαρμογή WE53 και τη διαδικτυακή εφαρμογή app.we53.io·
- τους Σταθμούς, κατά την παραλαβή και την επιστροφή Power Banks, μεταξύ άλλων όταν πληρώνετε με κάρτα σε τερματικό Nayax χωρίς εγγραφή·
- το bot του Telegram για την εγγραφή, τη συνομιλία υποστήριξης στον Ιστότοπο και τα κανάλια που συνδέονται με αυτήν (WhatsApp, Viber, Telegram, email)·
- τη φόρμα «For business» στον Ιστότοπο, καθώς και στις επαγγελματικές επαφές πριν από την υπογραφή σύμβασης με κατάστημα (ενότητα 10).
- Ο Ιστότοπος, η Εφαρμογή και οι Σταθμοί δεν απευθύνονται σε πρόσωπα κάτω των 18 ετών.
- Ερωτήσεις: service@we53.io.
- Ο ΓΚΠΔ σάς παρέχει το δικαίωμα πρόσβασης, διόρθωσης και διαγραφής των δεδομένων σας, καθώς και άλλα δικαιώματα (ενότητα 8).
- Ο Ιστότοπος δεν χρησιμοποιεί εργαλεία ανάλυσης. Δύο ρυθμίσεις (we53-country και we53-notice) αποθηκεύονται μόνο στον περιηγητή σας. Όταν φορτώνεται ο χάρτης κάλυψης, η διεύθυνση IP σας είναι ορατή στο OpenStreetMap (υπόβαθρο χάρτη) και στο Cloudflare cdnjs (βιβλιοθήκη χάρτη Leaflet). Η συνομιλία υποστήριξης Crisp τοποθετεί τεχνικό cookie μόνο όταν την ανοίγετε (όρος 4.1). Περισσότερα στην Πολιτική Cookies. Η Εφαρμογή δεν χρησιμοποιεί υπηρεσίες ανάλυσης τρίτων.
- «Εμείς» σημαίνει η WE53· «εσείς» σημαίνει ο επισκέπτης του Ιστοτόπου ή ο Χρήστης της Εφαρμογής και των Σταθμών.
Υπεύθυνος επεξεργασίας. WE53GR LTD (διακριτικός τίτλος WE53), εταιρεία εγγεγραμμένη στην Κυπριακή Δημοκρατία, με αριθμό εγγραφής HE 441198 και διεύθυνση: Irakleous 1, SKY TOWER, 6ος όροφος, γραφείο 604, Γερμασόγεια, 4046, Λεμεσός, Κύπρος· δραστηριοποιείται στην Ελλάδα μέσω του υποκαταστήματός της: Σαλαμίνος 30, 151 24 Μαρούσι, Αττική, ΑΦΜ 996543112, αριθμός Γ.Ε.ΜΗ. 174006101001.
Επικοινωνία για την προστασία δεδομένων. service@we53.io ή ταχυδρομικά στη διεύθυνση του Υπευθύνου επεξεργασίας.
Καταγγελίες. Μπορείτε οποτεδήποτε να υποβάλετε καταγγελία στην Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Κηφισίας 1–3, 115 23 Αθήνα, www.dpa.gr) ή στην εποπτική αρχή της χώρας όπου ζείτε ή εργάζεστε. Επειδή η εταιρεία είναι εγγεγραμμένη στην Κύπρο, μπορείτε επίσης να απευθυνθείτε στον Επίτροπο Προστασίας Δεδομένων Προσωπικού Χαρακτήρα της Κυπριακής Δημοκρατίας (www.dataprotection.gov.cy). Σας παρακαλούμε να μας γράψετε πρώτα, και θα προσπαθήσουμε να επιλύσουμε το ζήτημα.
Δεσμευόμαστε να διατηρούμε τα δεδομένα σας ασφαλή, να μην τα πωλούμε ποτέ και να σας επιτρέπουμε να ελέγχετε τα διαφημιστικά μηνύματα οποτεδήποτε.
2. Ποια δεδομένα συλλέγουμε
- Δεδομένα που μας δίνετε: αριθμός τηλεφώνου, email (αν το δηλώσατε στην εφαρμογή ή στην οθόνη του Σταθμού για απόδειξη), αιτήματα υποστήριξης, συμμετοχή σε προωθητικές ενέργειες και έρευνες.
- Δεδομένα μίσθωσης: αριθμός και διεύθυνση του Σταθμού, αριθμός του Power Bank, ώρα παραλαβής και επιστροφής, Χρέωση, ποσά που χρεώθηκαν, κατάσταση παραγγελίας (μεταξύ άλλων εξαγορά), φωτογραφίες ελαττωμάτων που στάλθηκαν στην υποστήριξη.
- Δεδομένα πληρωμής. Τον αριθμό της κάρτας τον εισάγετε απευθείας στον πάροχο πληρωμών: στη Stripe μέσω της Εφαρμογής και στη Nayax στο τερματικό του Σταθμού· εμείς δεν τον βλέπουμε ούτε τον αποθηκεύουμε. Από τον πάροχο λαμβάνουμε και αποθηκεύουμε: το αναγνωριστικό του τρόπου πληρωμής (token), τον τύπο της κάρτας, τα πρώτα 6 και τα τελευταία 4 ψηφία, την τράπεζα και τη χώρα έκδοσης, το αποτύπωμα της κάρτας, καθώς και τα ποσά και την κατάσταση των πληρωμών. Η Stripe επεξεργάζεται τα δεδομένα σύμφωνα με τη δική της πολιτική (stripe.com/privacy) και συμμορφώνεται με το πρότυπο PCI DSS.
- Δεδομένα συσκευής: διεύθυνση IP, μοντέλο συσκευής, λειτουργικό σύστημα, έκδοση εφαρμογής, γλώσσα, ζώνη ώρας, δεδομένα σφαλμάτων· τοποθεσία μόνο με την άδειά σας, για να εμφανίζονται οι πλησιέστεροι Σταθμοί.
- Ανάλυση. Η Εφαρμογή δεν χρησιμοποιεί υπηρεσίες ανάλυσης ή διαφημιστικής απόδοσης τρίτων και δεν ζητά το διαφημιστικό αναγνωριστικό.
- Ιστότοπος: βλ. Πολιτική Cookies.
3. Σκοποί και νομικές βάσεις
| Σκοπός | Δεδομένα | Νομική βάση (άρθρο 6 ΓΚΠΔ) |
|---|---|---|
| Εγγραφή και επαλήθευση αριθμού τηλεφώνου | τηλέφωνο, κωδικός | εκτέλεση της σύμβασης |
| Διάθεση και επιστροφή Power Bank, υπολογισμός κόστους | δεδομένα μίσθωσης | εκτέλεση της σύμβασης |
| Χρέωση πληρωμών και του ποσού εξαγοράς | δεδομένα πληρωμής, δεδομένα μίσθωσης | εκτέλεση της σύμβασης· έννομο συμφέρον |
| Απάντηση σε αμφισβητήσεις και αντιστροφές χρεώσεων (chargeback) | δεδομένα μίσθωσης, δεδομένα πληρωμής, αλληλογραφία | έννομο συμφέρον |
| Λογιστικά και φορολογικά αρχεία, αποδείξεις | πληρωμές | νομική υποχρέωση |
| Υποστήριξη και παράπονα | αλληλογραφία, δεδομένα μίσθωσης | εκτέλεση της σύμβασης· τήρηση ιστορικού αιτημάτων: έννομο συμφέρον |
| Εμφάνιση των πλησιέστερων Σταθμών | τοποθεσία | συγκατάθεση |
| Σταθερότητα και ασφάλεια της εφαρμογής | δεδομένα συσκευής, σφάλματα | έννομο συμφέρον |
| Διαφημιστικά email | συγκατάθεση (επιλογή στην εφαρμογή ή στην οθόνη του Σταθμού)· σύνδεσμος διαγραφής σε κάθε email |
- Έννομο συμφέρον είναι το συμφέρον μας να λειτουργούμε και να προστατεύουμε την επιχείρηση WE53, σταθμισμένο με τα δικαιώματά σας. Εκτέλεση της σύμβασης είναι η επεξεργασία χωρίς την οποία δεν μπορούμε να παρέχουμε την υπηρεσία. Συγκατάθεση σημαίνει επεξεργασία μόνο αφού συμφωνήσετε· μπορείτε να την ανακαλέσετε οποτεδήποτε, χωρίς να θίγεται η νομιμότητα της προηγούμενης επεξεργασίας.
- Χρησιμοποιούμε τα δεδομένα μόνο για τους σκοπούς για τους οποίους συλλέχθηκαν ή για συμβατούς σκοπούς, και χωρίς τη συγκατάθεσή σας μόνο όταν το απαιτεί ή το επιτρέπει ο νόμος.
4. Σε ποιους διαβιβάζουμε δεδομένα
- στους παρόχους πληρωμών: Stripe (Εφαρμογή) και Nayax (τερματικά στους Σταθμούς· εκπρόσωπος στην ΕΕ: Nayax Europe UAB, Λιθουανία). Για τα στοιχεία κάρτας που εισάγονται σε τερματικό, η Nayax ενεργεί για λογαριασμό μας·
- στον πάροχο φιλοξενίας Hetzner Online GmbH (Γερμανία), με διακομιστές στην ΕΕ·
- στην υπηρεσία επαλήθευσης αριθμού Twilio·
- στην υπηρεσία Crisp (Crisp IM SAS, Γαλλία): συνομιλία υποστήριξης και διαφημιστικά email, βλ. όρο 4.1·
- στη WE53 Holdings Limited (Κύπρος), δικαιούχο του λογισμικού της Πλατφόρμας: τα δεδομένα αποθηκεύονται και υποβάλλονται σε επεξεργασία στα συστήματά της για λογαριασμό μας·
- σε λογιστές, ελεγκτές και δικηγόρους·
- σε δημόσιες αρχές, όταν το απαιτεί ο νόμος.
Τα καταστήματα όπου είναι εγκατεστημένοι οι Σταθμοί δεν λαμβάνουν προσωπικά δεδομένα Χρηστών, μόνο τα συνολικά έσοδα ανά Σταθμό.
- Συνομιλία υποστήριξης (Crisp). Απαντάμε στα μηνύματά σας στη συνομιλία του Ιστοτόπου και στα συνδεδεμένα κανάλια WhatsApp, Viber, Telegram και email μέσω της υπηρεσίας Crisp (Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, Γαλλία). Η Crisp επεξεργάζεται τα δεδομένα για λογαριασμό μας ως εκτελών την επεξεργασία, βάσει σύμβασης επεξεργασίας δεδομένων.
- Ποια δεδομένα: τα μηνύματα και τα αρχεία σας· το όνομα, το email ή το τηλέφωνο που μας δώσατε· στοιχεία μίσθωσης που μοιραστήκατε (για παράδειγμα, αριθμό Σταθμού)· τεχνικά δεδομένα: διεύθυνση IP, τύπος περιηγητή και συσκευής, η σελίδα από την οποία γράψατε.
- Γιατί και με ποια βάση: για να απαντήσουμε στο αίτημά σας και να λύσουμε ένα πρόβλημα με τη μίσθωση (εκτέλεση της σύμβασης, άρθρο 6 παρ. 1 στοιχ. β΄ ΓΚΠΔ)· για να τηρούμε αρχείο αιτημάτων (έννομο συμφέρον, άρθρο 6 παρ. 1 στοιχ. στ΄ ΓΚΠΔ).
- Πού: τα δεδομένα αποθηκεύονται σε διακομιστές της Crisp στην ΕΕ (Ολλανδία και Γερμανία), με κρυπτογραφημένα αντίγραφα ασφαλείας στην Ιρλανδία. Σύμφωνα με τη σύμβαση επεξεργασίας δεδομένων, η Crisp δεν διαβιβάζει τα δεδομένα εκτός ΕΟΧ.
- Για πόσο: διατηρούμε την αλληλογραφία με την υποστήριξη για 24 μήνες μετά το τελευταίο μήνυμα, εκτός αν χρειάζεται για περισσότερο χρόνο για τον χειρισμό αξίωσης. Τα αρχεία συστήματος της Crisp διατηρούνται έως ένα έτος.
- Cookies: για να διατηρείται η συνομιλία μεταξύ σελίδων και επισκέψεων, η συνομιλία τοποθετεί στον Ιστότοπο τεχνικά cookies με πρόθεμα crisp-client, διάρκειας έως 6 μηνών. Δεν χρησιμοποιούνται για παρακολούθηση και τοποθετούνται μόνο αφού ανοίξετε τη συνομιλία.
Διαφημιστικά email. Μέσω της Crisp στέλνουμε επίσης email με νέα και προσφορές της WE53 σε όσους έχουν δώσει συγκατάθεση (βλ. τον πίνακα νομικών βάσεων στην ενότητα 3). Μπορείτε να διαγραφείτε από τον σύνδεσμο σε οποιοδήποτε email· μετά τη διαγραφή, το email σας δεν χρησιμοποιείται για διαφημιστικούς σκοπούς.
Όταν μας γράφετε μέσω WhatsApp, Viber ή Telegram, η αντίστοιχη υπηρεσία μηνυμάτων επεξεργάζεται επίσης τα μηνύματά σας σύμφωνα με τη δική της πολιτική απορρήτου.
Απαντήσεις AI. Ορισμένες απαντήσεις στη συνομιλία συντάσσονται από τον βοηθό AI της Crisp· αυτό εμφανίζεται στη συνομιλία. Το AI της Crisp λειτουργεί στην υποδομή της Crisp στην ΕΕ (Scaleway, Γαλλία) και δεν διαβιβάζει τις συνομιλίες σε εξωτερικούς παρόχους AI.
5. Διαβιβάσεις εκτός ΕΟΧ
Οι διακομιστές μας βρίσκονται στην ΕΕ, στον πάροχο φιλοξενίας Hetzner Online GmbH (Γερμανία). Τα δεδομένα διαβιβάζονται εκτός ΕΟΧ μόνο όταν η υπηρεσία δεν μπορεί να παρασχεθεί διαφορετικά: στη Stripe, για την αποδοχή πληρωμής στην Εφαρμογή (ο λογαριασμός τηρείται στην ΕΕ, αλλά η Stripe πραγματοποιεί μέρος της επεξεργασίας στις Ηνωμένες Πολιτείες)· στην Twilio (Ηνωμένες Πολιτείες), για την κλήση στον αριθμό σας με κωδικό επαλήθευσης· στη Nayax, για την αποδοχή πληρωμής σε τερματικό: σύμφωνα με την πολιτική της Nayax, δεδομένα πληρωμών μπορεί να διαβιβάζονται στο Ισραήλ (ισχύει απόφαση επάρκειας της Ευρωπαϊκής Επιτροπής) και στις Ηνωμένες Πολιτείες (τυποποιημένες συμβατικές ρήτρες της ΕΕ). Η ομάδα της WE53 εργάζεται με τα δεδομένα μόνο εντός της ΕΕ. Η Crisp αποθηκεύει τα δεδομένα στην ΕΕ και, σύμφωνα με τη σύμβαση επεξεργασίας δεδομένων, δεν τα διαβιβάζει εκτός ΕΟΧ· ορισμένοι πάροχοι υποδομής της είναι εταιρείες των ΗΠΑ (φιλοξενία με διακομιστές στην ΕΕ, δίκτυο Cloudflare), και κάθε πρόσβαση από αυτούς καλύπτεται από τις τυποποιημένες συμβατικές ρήτρες της ΕΕ. Οι διαβιβάσεις στις Ηνωμένες Πολιτείες γίνονται βάσει της απόφασης επάρκειας της Ευρωπαϊκής Επιτροπής (Πλαίσιο Προστασίας Δεδομένων ΕΕ-ΗΠΑ) ή των τυποποιημένων συμβατικών ρητρών της ΕΕ.
6. Πόσο καιρό διατηρούμε τα δεδομένα
| Δεδομένα | Διάρκεια |
|---|---|
| Λογαριασμός | όσο ο λογαριασμός είναι ενεργός· μετά τη διαγραφή του, διαγράφουμε τα δεδομένα εντός 5 ημερών |
| Δεδομένα μισθώσεων και πληρωμών | 6 έτη μετά το τέλος του έτους στο οποίο αφορούν οι εγγραφές: η προθεσμία του κυπριακού δικαίου για την εταιρεία (άρθρο 141(3) του περί Εταιρειών Νόμου, Κεφ. 113)· το ελληνικό δίκαιο απαιτεί τη διατήρηση των λογιστικών αρχείων του υποκαταστήματος για τουλάχιστον 5 έτη (ν. 4308/2014) |
| Αλληλογραφία με την υποστήριξη | 24 μήνες μετά το τελευταίο μήνυμα, εκτός αν χρειάζεται για περισσότερο χρόνο για αξίωση· αρχεία συστήματος της Crisp έως 1 έτος |
| Email για διαφημιστικούς σκοπούς | μέχρι τη διαγραφή σας |
7. Ασφάλεια
- Τα δεδομένα αποθηκεύονται σε ασφαλείς διακομιστές και η μεταφορά τους κρυπτογραφείται με TLS.
- Καμία μετάδοση δεδομένων μέσω του διαδικτύου δεν είναι απολύτως ασφαλής, αλλά αφού λάβουμε τα δεδομένα σας εφαρμόζουμε αυστηρές διαδικασίες και μέτρα κατά της μη εξουσιοδοτημένης πρόσβασης.
8. Τα δικαιώματά σας
- πρόσβαση: να λάβετε αντίγραφο των δεδομένων σας·
- διόρθωση: να διορθώσετε ανακριβή ή να συμπληρώσετε ελλιπή δεδομένα·
- διαγραφή, μεταξύ άλλων διαγραφή του λογαριασμού σας στην Εφαρμογή· τα δεδομένα που ο νόμος μας υποχρεώνει να διατηρούμε (ενότητα 6) διατηρούνται μέχρι τη λήξη της σχετικής προθεσμίας·
- περιορισμός της επεξεργασίας·
- εναντίωση στην επεξεργασία που βασίζεται σε έννομο συμφέρον·
- φορητότητα: να λάβετε τα δεδομένα σας σε δομημένο μορφότυπο ή να διαβιβαστούν σε άλλον υπεύθυνο επεξεργασίας·
- ανάκληση της συγκατάθεσης οποτεδήποτε·
- καταγγελία στην Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα ή στον Επίτροπο της Κύπρου.
Απαντάμε σε κάθε αίτημα εντός ενός μήνα· σε σύνθετες περιπτώσεις η προθεσμία μπορεί να παραταθεί κατά δύο ακόμη μήνες, και θα σας ενημερώσουμε σχετικά.
9. Παιδιά
Η Σύμβαση συνάπτεται μόνο με πρόσωπα ηλικίας 18 ετών και άνω. Δεν ελέγχουμε την ηλικία και δεν συλλέγουμε δεδομένα σχετικά με αυτήν, επομένως δεν μπορούμε να γνωρίζουμε ποιος χρησιμοποιεί έναν Σταθμό, ιδίως όταν η πληρωμή γίνεται σε τερματικό. Αν πιστεύετε ότι ένα παιδί μάς έδωσε δεδομένα, γράψτε στο service@we53.io και θα τα διαγράψουμε.
10. Επαγγελματικά αιτήματα και επαφές
- Η ενότητα αυτή αφορά εκπροσώπους καταστημάτων και εταιρειών που υποβάλλουν αίτημα μέσω της φόρμας «For business» στον Ιστότοπο ή με τους οποίους επικοινωνούμε για να προτείνουμε την εγκατάσταση Σταθμού WE53. Αφού υπογραφεί σύμβαση με την εταιρεία σας, η περαιτέρω επεξεργασία των δεδομένων των εκπροσώπων της (αναφορές, τιμολόγια, πληρωμές, πύλη συνεργατών) περιγράφεται στη σύμβαση.
- Ποια δεδομένα. Από τη φόρμα: το όνομα του καταστήματός σας, το όνομά σας, το email, το τηλέφωνο (προαιρετικά), το σχόλιό σας, τη γλώσσα της σελίδας και την ημερομηνία και ώρα αποστολής. Κατά την πρώτη επαφή: το όνομα, τη θέση, το επαγγελματικό τηλέφωνο και το email του εκπροσώπου του καταστήματος, που προέρχονται από τον ίδιο ή από δημόσιες πηγές (ιστότοπος του καταστήματος, Google Maps), καθώς και σημειώσεις από συναντήσεις και αλληλογραφία.
- Γιατί και με ποια βάση. Για να απαντήσουμε στο αίτημά σας και να ετοιμάσουμε πρόταση ή σύμβαση: ενέργειες πριν από τη σύναψη σύμβασης κατόπιν αιτήματός σας (άρθρο 6 παρ. 1 στοιχ. β΄ ΓΚΠΔ). Για να προτείνουμε συνεργασία σε κατάστημα με το οποίο δεν συνεργαζόμαστε ακόμη και να τηρούμε αρχείο των συζητήσεων: έννομο συμφέρον (άρθρο 6 παρ. 1 στοιχ. στ΄ ΓΚΠΔ). Μπορείτε να αντιταχθείτε, και θα σταματήσουμε να επικοινωνούμε μαζί σας.
- Ποιοι τα λαμβάνουν. Τα αιτήματα από τη φόρμα περνούν από τον διακομιστή μας στη Hetzner Online GmbH (Γερμανία) και φτάνουν με email στο γραμματοκιβώτιο της WE53 στο Google Workspace (Google Cloud EMEA Limited, Ιρλανδία). Οι επαφές και το ιστορικό των συζητήσεων τηρούνται στο CRM Pipedrive (Pipedrive OÜ, Εσθονία), με αποθήκευση των δεδομένων στην ΕΕ (κέντρο δεδομένων στη Φρανκφούρτη, Γερμανία). Πρόσβαση έχουν μόνο τα μέλη του προσωπικού της WE53 που συνεργάζονται με καταστήματα. Η Google μπορεί να επεξεργάζεται δεδομένα στις Ηνωμένες Πολιτείες βάσει του Πλαισίου Προστασίας Δεδομένων ΕΕ-ΗΠΑ ή των τυποποιημένων συμβατικών ρητρών της ΕΕ.
- Για πόσο τα διατηρούμε. Αν δεν υπογραφεί σύμβαση, για 24 μήνες μετά την τελευταία επαφή, και στη συνέχεια τα διαγράφουμε. Αν αντιταχθείτε, διατηρούμε μόνο μια σημείωση «χωρίς επικοινωνία», ώστε να μη σας ξαναγράψουμε. Αν υπογραφεί σύμβαση, όπως ορίζεται σε αυτήν.
- Υπεύθυνος επεξεργασίας και επικοινωνία. Για καταστήματα στην Ελλάδα: η WE53GR LTD (υποκατάστημα Ελλάδας)· για την Κύπρο και την Πορτογαλία: η εταιρεία WE53 της αντίστοιχης χώρας, της οποίας η πολιτική βρίσκεται στον Ιστότοπο όταν επιλέξετε τη χώρα. Ερωτήσεις και αντιρρήσεις: partners@we53.io. Τα δικαιώματά σας περιγράφονται στην ενότητα 8.
11. Αλλαγές στην Πολιτική
Οι νέες εκδόσεις δημοσιεύονται στον Ιστότοπο και στην Εφαρμογή με την ημερομηνία τους· για σημαντικές αλλαγές σας ενημερώνουμε στην εφαρμογή ή με email.
WE53 (trading name of WE53GR LTD) respects your privacy and protects your personal data. This Policy explains how we use, process and store the data we receive from you or about you, what rights you have and how the law protects you.
1. Scope
- This Policy applies when you use:
- the Website https://we53.io/, to the extent described in the Cookie Policy;
- the WE53 Mobile application and the web app at app.we53.io;
- Stations, when you get and return Power Banks, including when you pay by card at a Nayax terminal without registering;
- the Telegram bot for registration, the support chat on the Website and the channels connected to it (WhatsApp, Viber, Telegram, email);
- the “For business” form on the Website, and in business contacts before an agreement with a venue is signed (section 10).
- The Website, the Mobile application and the Stations are not intended for persons under 18.
- Questions: service@we53.io.
- The GDPR gives you the right to access, correct and erase your data, and other rights (section 8).
- The Website does not use analytics. Two settings (we53-country and we53-notice) are stored only in your browser. When the coverage map loads, your IP address is visible to OpenStreetMap (map tiles) and Cloudflare cdnjs (the Leaflet map library). The Crisp support chat sets a technical cookie only when you open it (clause 4.1). See the Cookie Policy for details. The Mobile application does not use third-party analytics services.
- “We”, “us” and “our” mean WE53; “you” means a visitor to the Website or a User of the Mobile application and Stations.
Controller. WE53GR LTD (trading as WE53), a company registered in the Republic of Cyprus, registration number HE 441198, address: Irakleous 1, SKY TOWER, 6th floor, office 604, Germasogeia, 4046, Limassol, Cyprus; acting in Greece through its branch: Salaminos 30, 151 24 Marousi, Attica, Greece, Tax ID (ΑΦΜ) 996543112, General Commercial Registry (Γ.Ε.ΜΗ.) number 174006101001.
Data protection contact. service@we53.io, or by post to the Controller’s address.
Complaints. You may at any time lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, Kifisias 1–3, 115 23 Athens, www.dpa.gr) or with the supervisory authority of the country where you live or work. As the company is registered in Cyprus, you may also contact the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). We ask you to write to us first, and we will try to resolve the matter.
We undertake to keep your data secure, never to sell it, and to let you control marketing emails at any time.
2. What data we collect
- Data you provide: phone number, email (if you entered it in the app or on the Station screen for a receipt), support requests, participation in promotions and surveys.
- Rental data: Station number and address, Power Bank number, time of release and return, Tariff, amounts charged, order status (including buyout), photos of defects sent to support.
- Payment data. You enter your card number directly with the payment provider: Stripe in the Mobile application, Nayax at the Station terminal; we do not see or store it. From the provider we receive and store: the payment method identifier (token), card type, the first 6 and last 4 digits, the issuing bank and country, the card fingerprint, and payment amounts and statuses. Stripe processes data under its own policy (stripe.com/privacy) and complies with the PCI DSS standard.
- Device data: IP address, device model, operating system, app version, language, time zone, crash data; location only with your permission, to show the nearest Stations.
- Analytics. The Mobile application does not use third-party analytics or advertising attribution services and does not request the advertising identifier.
- Website: see the Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis (Article 6 GDPR) |
|---|---|---|
| Registration and phone number verification | phone number, code | performance of the contract |
| Releasing and returning a Power Bank, calculating the cost | rental data | performance of the contract |
| Charging payments and the buyout amount | payment data, rental data | performance of the contract; legitimate interest |
| Responding to disputes and chargebacks | rental data, payment data, correspondence | legitimate interest |
| Accounting and tax records, receipts | payments | legal obligation |
| Support and complaints | correspondence, rental data | performance of the contract; keeping the history of requests: legitimate interest |
| Showing the nearest Stations | location | consent |
| App stability and security | device data, crashes | legitimate interest |
| Marketing emails | consent (tick box in the app or on the Station screen); unsubscribe link in every email |
- Legitimate interest means our interest in running and protecting the WE53 business, balanced against your rights. Performance of the contract means processing without which we cannot provide the service. Consent means processing only after you have agreed; you can withdraw consent at any time without affecting the lawfulness of earlier processing.
- We use data only for the purposes for which it was collected or for compatible purposes, and without your consent only where the law requires or permits it.
4. Who we share data with
- payment providers: Stripe (Mobile application) and Nayax (terminals at Stations; EU representative: Nayax Europe UAB, Lithuania). For card data entered at a terminal, Nayax acts on our behalf;
- the hosting provider Hetzner Online GmbH (Germany), with servers in the EU;
- the phone verification service Twilio;
- Crisp (Crisp IM SAS, France): support chat and marketing emails, see clause 4.1;
- WE53 Holdings Limited (Cyprus), the owner of the Platform software: data is stored and processed in its systems on our behalf;
- accountants, auditors and lawyers;
- public authorities, where the law requires it.
The venues where Stations are installed do not receive Users’ personal data, only revenue totals per Station.
- Support chat (Crisp). We answer your messages in the chat on the Website and in the WhatsApp, Viber, Telegram and email channels connected to it through Crisp (Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France). Crisp processes data on our behalf as a processor under a data processing agreement.
- What data: your messages and files; the name, email or phone number you give; rental details you share (for example, a Station number); technical data: IP address, browser and device type, the page you wrote from.
- Why and on what basis: to answer your request and solve a problem with a rental (performance of the contract, Article 6(1)(b) GDPR); to keep a record of requests (legitimate interest, Article 6(1)(f) GDPR).
- Where: the data is stored on Crisp servers in the EU (the Netherlands and Germany), with encrypted backups in Ireland. Under its data processing agreement, Crisp does not transfer the data outside the EEA.
- How long: we keep support correspondence for 24 months after the last message, unless it is needed longer to handle a claim. Crisp system logs are kept for up to one year.
- Cookies: to keep the conversation across pages and visits, the chat sets technical cookies prefixed crisp-client on the Website for up to 6 months. They are not used for tracking and are set only after you open the chat.
Marketing emails. Through Crisp we also send emails with WE53 news and offers to those who have given consent (see the table of legal bases in section 3). You can unsubscribe using the link in any email; after that, your email is not used for marketing.
When you write to us via WhatsApp, Viber or Telegram, the messenger also processes your messages under its own privacy policy.
AI replies. Some replies in the chat are prepared by the Crisp AI assistant; we show this in the chat. Crisp AI runs on Crisp’s infrastructure in the EU (Scaleway, France) and does not pass conversations to external AI providers.
5. Transfers outside the EEA
Our servers are in the EU, with the hosting provider Hetzner Online GmbH (Germany). Data leaves the EEA only where the service cannot be provided otherwise: Stripe, to accept payment in the Mobile application (the account is held in the EU, but Stripe carries out part of the processing in the United States); Twilio (United States), to call your number with a verification code; Nayax, to accept payment at a terminal: under Nayax’s policy, payment data may be transferred to Israel (covered by a European Commission adequacy decision) and to the United States (EU standard contractual clauses). The WE53 team works with data only from within the EU. Crisp stores data in the EU and, under its data processing agreement, does not transfer it outside the EEA; some of its infrastructure providers are US companies (hosting with servers in the EU, the Cloudflare network), and any access by them is covered by the EU standard contractual clauses. Transfers to the United States are made on the basis of the European Commission adequacy decision (EU-US Data Privacy Framework) or the EU standard contractual clauses.
6. How long we keep data
| Data | Period |
|---|---|
| Account | while the account is active; after it is deleted, we delete the data within 5 days |
| Rental and payment data | 6 years after the end of the year to which the records relate: the period under Cyprus law for the company (section 141(3) of the Companies Law, Cap. 113); Greek law requires the branch’s accounting records to be kept for at least 5 years (Law 4308/2014) |
| Support correspondence | 24 months after the last message, unless it is needed longer for a claim; Crisp system logs for up to 1 year |
| Email for marketing | until you unsubscribe |
7. Security
- Data is stored on secure servers, and transfers are encrypted with TLS.
- No transmission of data over the internet is completely secure, but once we receive your data we apply strict procedures and measures against unauthorised access.
8. Your rights
- access: to receive a copy of your data;
- rectification: to correct inaccurate data or complete incomplete data;
- erasure, including deleting your account in the Mobile application; data the law requires us to keep (section 6) is kept until the end of that period;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability: to receive your data in a structured format or have it sent to another controller;
- withdrawal of consent at any time;
- a complaint to the Hellenic Data Protection Authority or the Cyprus Commissioner.
We reply to a request within one month; in complex cases this may be extended by two further months, and we will tell you if so.
9. Children
The Agreement is concluded only with persons aged 18 or over. We do not check age or collect data about it, so we cannot know who uses a Station, especially when paying at a terminal. If you believe a child has given us data, write to service@we53.io and we will delete it.
10. Business enquiries and contacts
- This section is for representatives of venues and companies who send a request through the “For business” form on the Website, or whom we contact to offer a WE53 Station. Once an agreement with your company is signed, further processing of its representatives’ data (reports, invoices, payouts, the partner portal) is described in that agreement.
- What data. From the form: the name of your venue, your name, email, phone number (optional), your comment, the page language and the date and time of sending. At first contact: the name, job title and business phone number and email of the venue’s representative, obtained from them or from public sources (the venue’s website, Google Maps), and notes of meetings and correspondence.
- Why and on what basis. To reply to your request and prepare an offer or agreement: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). To offer cooperation to a venue we do not yet work with and to keep a record of discussions: legitimate interest (Article 6(1)(f) GDPR). You may object, and we will stop contacting you.
- Who receives it. Requests from the form pass through our server hosted by Hetzner Online GmbH (Germany) and arrive by email in WE53’s Google Workspace mailbox (Google Cloud EMEA Limited, Ireland). Contacts and the history of discussions are kept in the Pipedrive CRM (Pipedrive OÜ, Estonia), with data stored in the EU (Frankfurt data centre, Germany). Only WE53 staff who work with venues have access. Google may process data in the United States on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.
- How long we keep it. If no agreement is signed, for 24 months after the last contact, after which we delete it. If you object, we keep only a “do not contact” note so that we do not write to you again. If an agreement is signed, as set out in that agreement.
- Controller and contact. For venues in Greece: WE53GR LTD (Greek branch); for Cyprus and Portugal: the WE53 company in that country, whose policy is on the Website when you select the country. Questions and objections: partners@we53.io. Your rights are described in section 8.
11. Changes to this Policy
New versions are published on the Website and in the Mobile application with their date; we tell you about significant changes in the app or by email.
A WE53 (marca sob a qual a KIT CERVICOS, UNIPESSOAL LDA opera ao abrigo de licença) respeita a sua privacidade e protege os seus dados pessoais. Esta Política explica como utilizamos, tratamos e conservamos os dados que recebemos de si ou sobre si, que direitos tem e como a lei o protege.
1. Âmbito
- Esta Política aplica-se quando utiliza:
- o Sítio Web https://we53.io/, na medida descrita na Política de Cookies;
- a Aplicação WE53 e a aplicação web em app.we53.io;
- as Estações, ao levantar e devolver Power Banks, incluindo quando paga com cartão num terminal Stripe sem registo;
- o bot do Telegram para registo, o chat de apoio no Sítio Web e os canais a ele ligados (WhatsApp, Viber, Telegram, email);
- o formulário «For business» no Sítio Web, bem como os contactos comerciais anteriores à celebração de contrato com um estabelecimento (secção 10).
- O Sítio Web, a Aplicação e as Estações não se destinam a menores de 18 anos.
- Questões: service@we53.io.
- O RGPD confere-lhe o direito de aceder aos seus dados, de os retificar e de os apagar, bem como outros direitos (secção 8).
- O Sítio Web não utiliza ferramentas de análise. Duas definições (we53-country e we53-notice) são guardadas apenas no seu navegador. Quando o mapa de cobertura é carregado, o seu endereço IP fica visível para o OpenStreetMap (fundo do mapa) e para o Cloudflare cdnjs (biblioteca de mapas Leaflet). O chat de apoio Crisp coloca um cookie técnico apenas quando o abre (cláusula 4.1). Mais informações na Política de Cookies. A Aplicação não utiliza serviços de análise de terceiros.
- «Nós» significa a WE53; «você» significa o visitante do Sítio Web ou o Utilizador da Aplicação e das Estações.
Responsável pelo tratamento. KIT CERVICOS, UNIPESSOAL LDA (marca WE53), sociedade registada na República Portuguesa, NIPC 518217566, com sede na Rua Zeca Afonso, n.º 10, Loja Esquerda, 2690-395 Santa Iria de Azóia, Loures, Portugal. A plataforma WE53 (aplicação, servidores, apoio) é assegurada, por conta do Responsável pelo tratamento, pela WE53 Holdings Limited (Chipre), na qualidade de subcontratante.
Contacto para proteção de dados. service@we53.io, ou por correio para a morada do Responsável pelo tratamento.
Reclamações. Pode, a qualquer momento, apresentar reclamação à Comissão Nacional de Proteção de Dados (CNPD, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt) ou à autoridade de controlo do país onde vive ou trabalha. Pedimos-lhe que nos escreva primeiro; procuraremos resolver a questão.
Comprometemo-nos a manter os seus dados seguros, a nunca os vender e a permitir-lhe controlar as comunicações de marketing a qualquer momento.
2. Que dados recolhemos
- Dados que nos fornece: número de telemóvel, email (se o indicou na aplicação ou no ecrã da Estação para receber o comprovativo), pedidos de apoio, participação em promoções e inquéritos.
- Dados do aluguer: número e morada da Estação, número do Power Bank, hora de levantamento e de devolução, Tarifário, valores cobrados, estado do pedido (incluindo aquisição), fotografias de defeitos enviadas ao apoio.
- Dados de pagamento. Introduz o número do cartão diretamente junto do prestador de pagamentos, a Stripe, na Aplicação e no terminal da Estação; não o vemos nem o guardamos. Do prestador recebemos e guardamos: o identificador do meio de pagamento (token), o tipo de cartão, os primeiros 6 e os últimos 4 dígitos, o banco e o país emissor, a impressão digital do cartão, bem como os valores e o estado dos pagamentos. A Stripe trata os dados segundo a sua própria política (stripe.com/privacy) e cumpre a norma PCI DSS.
- Dados do dispositivo: endereço IP, modelo do dispositivo, sistema operativo, versão da aplicação, idioma, fuso horário, dados de falhas; localização apenas com a sua autorização, para mostrar as Estações mais próximas.
- Análise. A Aplicação não utiliza serviços de análise ou de atribuição publicitária de terceiros e não pede o identificador de publicidade.
- Sítio Web: ver a Política de Cookies.
3. Finalidades e fundamentos jurídicos
| Finalidade | Dados | Fundamento (artigo 6.º do RGPD) |
|---|---|---|
| Registo e verificação do número de telemóvel | telemóvel, código | execução do contrato |
| Disponibilização e devolução do Power Bank, cálculo do custo | dados do aluguer | execução do contrato |
| Cobrança dos pagamentos e do valor de aquisição | dados de pagamento, dados do aluguer | execução do contrato; interesse legítimo |
| Resposta a contestações e estornos (chargeback) | dados do aluguer, dados de pagamento, correspondência | interesse legítimo |
| Contabilidade e obrigações fiscais, comprovativos | pagamentos | obrigação jurídica |
| Apoio e reclamações | correspondência, dados do aluguer | execução do contrato; conservação do histórico de pedidos: interesse legítimo |
| Apresentação das Estações mais próximas | localização | consentimento |
| Estabilidade e segurança da aplicação | dados do dispositivo, falhas | interesse legítimo |
| Comunicações de marketing por email | consentimento (caixa de seleção na aplicação ou no ecrã da Estação); ligação para cancelar em cada email |
- Interesse legítimo é o nosso interesse em gerir e proteger a atividade da WE53, ponderado com os seus direitos. Execução do contrato é o tratamento sem o qual não podemos prestar o serviço. Consentimento significa tratamento apenas depois de ter concordado; pode retirá-lo a qualquer momento, sem afetar a licitude do tratamento anterior.
- Utilizamos os dados apenas para as finalidades para que foram recolhidos ou para finalidades compatíveis, e sem o seu consentimento apenas quando a lei o exige ou permite.
4. Com quem partilhamos dados
- o prestador de pagamentos Stripe (Aplicação e terminais nas Estações; a conta Stripe é titulada pela KIT CERVICOS);
- o prestador de alojamento Hetzner Online GmbH (Alemanha), com servidores na UE;
- o serviço de verificação de número Twilio;
- a Crisp (Crisp IM SAS, França): chat de apoio e emails de marketing, ver cláusula 4.1;
- a WE53 Holdings Limited (Chipre), titular do software da Plataforma: os dados são conservados e tratados nos seus sistemas por nossa conta; o apoio, a verificação do número e o chat Crisp também funcionam através dela;
- contabilistas, auditores e advogados;
- autoridades públicas, quando a lei o exija.
Os estabelecimentos onde as Estações estão instaladas não recebem dados pessoais dos Utilizadores, apenas os totais de receita por Estação.
- Chat de apoio (Crisp). Respondemos às suas mensagens no chat do Sítio Web e nos canais WhatsApp, Viber, Telegram e email a ele ligados através da Crisp (Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, França). A Crisp trata os dados na qualidade de subcontratante ulterior da WE53 Holdings, ao abrigo de um contrato de tratamento de dados.
- Que dados: as suas mensagens e ficheiros; o nome, o email ou o telemóvel que nos indicou; dados do aluguer que partilhou (por exemplo, o número da Estação); dados técnicos: endereço IP, tipo de navegador e de dispositivo, a página a partir da qual escreveu.
- Para quê e com que fundamento: responder ao seu pedido e resolver um problema com o aluguer (execução do contrato, artigo 6.º, n.º 1, alínea b), do RGPD); manter registo dos pedidos (interesse legítimo, artigo 6.º, n.º 1, alínea f), do RGPD).
- Onde: os dados são conservados em servidores da Crisp na UE (Países Baixos e Alemanha), com cópias de segurança cifradas na Irlanda. Nos termos do seu contrato de tratamento de dados, a Crisp não transfere os dados para fora do EEE.
- Durante quanto tempo: conservamos a correspondência com o apoio durante 24 meses após a última mensagem, salvo se for necessária durante mais tempo para tratar uma reclamação. Os registos de sistema da Crisp são conservados até um ano.
- Cookies: para manter a conversa entre páginas e visitas, o chat coloca no Sítio Web cookies técnicos com o prefixo crisp-client, com duração até 6 meses. Não são utilizados para seguimento e só são colocados depois de abrir o chat.
Comunicações de marketing. Através da Crisp enviamos também emails com novidades e ofertas da WE53 a quem deu consentimento (ver a tabela de fundamentos na secção 3). Pode cancelar a subscrição através da ligação em qualquer email; depois disso, o seu email deixa de ser utilizado para marketing.
Quando nos escreve através do WhatsApp, do Viber ou do Telegram, o serviço de mensagens também trata as suas mensagens segundo a sua própria política de privacidade.
Respostas de IA. Algumas respostas no chat são preparadas pelo assistente de IA da Crisp; indicamo-lo no chat. A IA da Crisp funciona na infraestrutura da Crisp na UE (Scaleway, França) e não transmite as conversas a prestadores de IA externos.
5. Transferências para fora do EEE
Os nossos servidores estão na UE, no prestador de alojamento Hetzner Online GmbH (Alemanha). Os dados só saem do EEE quando o serviço não pode ser prestado de outra forma: para a Stripe, para aceitar pagamentos na Aplicação e no terminal (a conta está aberta na UE, mas a Stripe realiza parte do tratamento nos Estados Unidos); para a Twilio (Estados Unidos), para ligar para o seu número com o código de verificação. A equipa da WE53 trabalha com os dados apenas a partir da UE. A Crisp conserva os dados na UE e, nos termos do seu contrato de tratamento de dados, não os transfere para fora do EEE; alguns dos seus prestadores de infraestrutura são empresas dos Estados Unidos (alojamento com servidores na UE, rede Cloudflare), e qualquer acesso por parte destes está abrangido pelas cláusulas contratuais-tipo da UE. As transferências para os Estados Unidos baseiam-se na decisão de adequação da Comissão Europeia (Quadro de Privacidade de Dados UE-EUA) ou nas cláusulas contratuais-tipo da UE.
6. Durante quanto tempo conservamos os dados
| Dados | Prazo |
|---|---|
| Conta | enquanto a conta estiver ativa; após a eliminação, apagamos os dados no prazo de 5 dias |
| Dados dos alugueres e dos pagamentos | 10 anos: o prazo durante o qual a lei portuguesa exige a conservação dos registos contabilísticos e respetivos documentos de suporte (artigo 123.º, n.º 4, do Código do IRC) |
| Correspondência com o apoio | 24 meses após a última mensagem, salvo se for necessária durante mais tempo para uma reclamação; registos de sistema da Crisp até 1 ano |
| Email para marketing | até cancelar a subscrição |
7. Segurança
- Os dados são conservados em servidores seguros e a sua transmissão é cifrada com TLS.
- Nenhuma transmissão de dados pela internet é totalmente segura, mas, depois de recebermos os seus dados, aplicamos procedimentos e medidas rigorosos contra o acesso não autorizado.
8. Os seus direitos
- acesso: receber uma cópia dos seus dados;
- retificação: corrigir dados inexatos ou completar dados incompletos;
- apagamento, incluindo a eliminação da sua conta na Aplicação; os dados que a lei nos obriga a conservar (secção 6) são conservados até ao fim desse prazo;
- limitação do tratamento;
- oposição ao tratamento baseado em interesse legítimo;
- portabilidade: receber os seus dados num formato estruturado ou transmiti-los a outro responsável pelo tratamento;
- retirada do consentimento a qualquer momento;
- reclamação à CNPD (Portugal).
Respondemos a cada pedido no prazo de um mês; em casos complexos, o prazo pode ser prorrogado por mais dois meses, e informá-lo-emos disso.
9. Crianças
O Contrato só é celebrado com pessoas com 18 anos ou mais. Não verificamos a idade nem recolhemos dados sobre ela, pelo que não podemos saber quem utiliza uma Estação, sobretudo quando o pagamento é feito num terminal. Se considerar que uma criança nos forneceu dados, escreva para service@we53.io e apagá-los-emos.
10. Pedidos e contactos comerciais
- Esta secção destina-se a representantes de estabelecimentos e empresas que enviam um pedido através do formulário «For business» no Sítio Web, ou que contactamos para propor a instalação de uma Estação WE53. Depois de assinado o contrato com a sua empresa, o tratamento posterior dos dados dos seus representantes (relatórios, faturas, pagamentos, portal de parceiros) é descrito nesse contrato.
- Que dados. Do formulário: o nome do seu estabelecimento, o seu nome, email, telefone (opcional), o seu comentário, o idioma da página e a data e hora de envio. No primeiro contacto: o nome, o cargo, o telefone e o email profissionais do representante do estabelecimento, obtidos junto dele ou de fontes públicas (sítio web do estabelecimento, Google Maps), bem como notas de reuniões e de correspondência.
- Para quê e com que fundamento. Responder ao seu pedido e preparar uma proposta ou um contrato: diligências pré-contratuais a seu pedido (artigo 6.º, n.º 1, alínea b), do RGPD). Propor colaboração a um estabelecimento com o qual ainda não trabalhamos e manter registo das conversações: interesse legítimo (artigo 6.º, n.º 1, alínea f), do RGPD). Pode opor-se, e deixaremos de o contactar.
- Quem os recebe. Os pedidos do formulário passam pelo servidor da WE53 na Hetzner Online GmbH (Alemanha) e chegam por email à caixa de correio da WE53 no Google Workspace (Google Cloud EMEA Limited, Irlanda). A WE53 recebe-os por conta da KIT CERVICOS e transmite-os à sua equipa em Portugal que trabalha com os estabelecimentos. A Google pode tratar dados nos Estados Unidos com base no Quadro de Privacidade de Dados UE-EUA ou nas cláusulas contratuais-tipo da UE.
- Durante quanto tempo os conservamos. Se não for assinado contrato, durante 24 meses após o último contacto, e depois apagamo-los. Se se opuser, conservamos apenas uma nota «não contactar», para não voltarmos a escrever-lhe. Se for assinado contrato, nos termos desse contrato.
- Responsável pelo tratamento e contacto. Para estabelecimentos em Portugal: a KIT CERVICOS, UNIPESSOAL LDA; para Chipre e Grécia: a empresa WE53 desse país, cuja política está no Sítio Web quando seleciona o país. Questões e oposições: partners@we53.io. Os seus direitos estão descritos na secção 8.
11. Alterações a esta Política
As novas versões são publicadas no Sítio Web e na Aplicação com a respetiva data; informamo-lo das alterações significativas na aplicação ou por email.
WE53 (the brand under which KIT CERVICOS, UNIPESSOAL LDA operates under licence) respects your privacy and protects your personal data. This Policy explains how we use, process and store the data we receive from you or about you, what rights you have and how the law protects you.
1. Scope
- This Policy applies when you use:
- the Website https://we53.io/, to the extent described in the Cookie Policy;
- the WE53 Mobile application and the web app at app.we53.io;
- Stations, when you get and return Power Banks, including when you pay by card at a Stripe terminal without registering;
- the Telegram bot for registration, the support chat on the Website and the channels connected to it (WhatsApp, Viber, Telegram, email);
- the “For business” form on the Website, and in business contacts before an agreement with a venue is signed (section 10).
- The Website, the Mobile application and the Stations are not intended for persons under 18.
- Questions: service@we53.io.
- The GDPR gives you the right to access, correct and erase your data, and other rights (section 8).
- The Website does not use analytics. Two settings (we53-country and we53-notice) are stored only in your browser. When the coverage map loads, your IP address is visible to OpenStreetMap (map tiles) and Cloudflare cdnjs (the Leaflet map library). The Crisp support chat sets a technical cookie only when you open it (clause 4.1). See the Cookie Policy for details. The Mobile application does not use third-party analytics services.
- “We”, “us” and “our” mean WE53; “you” means a visitor to the Website or a User of the Mobile application and Stations.
Controller. KIT CERVICOS, UNIPESSOAL LDA (operating as WE53), a company registered in the Portuguese Republic, NIPC 518217566, address: Rua Zeca Afonso, n.º 10, Loja Esquerda, 2690-395 Santa Iria de Azóia, Loures, Portugal. The WE53 platform (app, servers, support) is run on the Controller’s behalf by WE53 Holdings Limited (Cyprus), acting as processor.
Data protection contact. service@we53.io, or by post to the Controller’s address.
Complaints. You may at any time lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt), or with the supervisory authority of the country where you live or work. We ask you to write to us first, and we will try to resolve the matter.
We undertake to keep your data secure, never to sell it, and to let you control marketing emails at any time.
2. What data we collect
- Data you provide: phone number, email (if you entered it in the app or on the Station screen for a receipt), support requests, participation in promotions and surveys.
- Rental data: Station number and address, Power Bank number, time of release and return, Tariff, amounts charged, order status (including buyout), photos of defects sent to support.
- Payment data. You enter your card number directly with the payment provider: Stripe, in the Mobile application and at the Station terminal; we do not see or store it. From the provider we receive and store: the payment method identifier (token), card type, the first 6 and last 4 digits, the issuing bank and country, the card fingerprint, and payment amounts and statuses. Stripe processes data under its own policy (stripe.com/privacy) and complies with the PCI DSS standard.
- Device data: IP address, device model, operating system, app version, language, time zone, crash data; location only with your permission, to show the nearest Stations.
- Analytics. The Mobile application does not use third-party analytics or advertising attribution services and does not request the advertising identifier.
- Website: see the Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis (Article 6 GDPR) |
|---|---|---|
| Registration and phone number verification | phone number, code | performance of the contract |
| Releasing and returning a Power Bank, calculating the cost | rental data | performance of the contract |
| Charging payments and the buyout amount | payment data, rental data | performance of the contract; legitimate interest |
| Responding to disputes and chargebacks | rental data, payment data, correspondence | legitimate interest |
| Accounting and tax records, receipts | payments | legal obligation |
| Support and complaints | correspondence, rental data | performance of the contract; keeping the history of requests: legitimate interest |
| Showing the nearest Stations | location | consent |
| App stability and security | device data, crashes | legitimate interest |
| Marketing emails | consent (tick box in the app or on the Station screen); unsubscribe link in every email |
- Legitimate interest means our interest in running and protecting the WE53 business, balanced against your rights. Performance of the contract means processing without which we cannot provide the service. Consent means processing only after you have agreed; you can withdraw consent at any time without affecting the lawfulness of earlier processing.
- We use data only for the purposes for which it was collected or for compatible purposes, and without your consent only where the law requires or permits it.
4. Who we share data with
- the payment provider Stripe (Mobile application and terminals at Stations; the Stripe account is held by KIT CERVICOS);
- the hosting provider Hetzner Online GmbH (Germany), with servers in the EU;
- the phone verification service Twilio;
- Crisp (Crisp IM SAS, France): support chat and marketing emails, see clause 4.1;
- WE53 Holdings Limited (Cyprus), the owner of the Platform software: data is stored and processed in its systems on our behalf; support, phone verification and the Crisp chat also run through it;
- accountants, auditors and lawyers;
- public authorities, where the law requires it.
The venues where Stations are installed do not receive Users’ personal data, only revenue totals per Station.
- Support chat (Crisp). We answer your messages in the chat on the Website and in the WhatsApp, Viber, Telegram and email channels connected to it through Crisp (Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France). Crisp processes data as a sub-processor of WE53 Holdings under a data processing agreement.
- What data: your messages and files; the name, email or phone number you give; rental details you share (for example, a Station number); technical data: IP address, browser and device type, the page you wrote from.
- Why and on what basis: to answer your request and solve a problem with a rental (performance of the contract, Article 6(1)(b) GDPR); to keep a record of requests (legitimate interest, Article 6(1)(f) GDPR).
- Where: the data is stored on Crisp servers in the EU (the Netherlands and Germany), with encrypted backups in Ireland. Under its data processing agreement, Crisp does not transfer the data outside the EEA.
- How long: we keep support correspondence for 24 months after the last message, unless it is needed longer to handle a claim. Crisp system logs are kept for up to one year.
- Cookies: to keep the conversation across pages and visits, the chat sets technical cookies prefixed crisp-client on the Website for up to 6 months. They are not used for tracking and are set only after you open the chat.
Marketing emails. Through Crisp we also send emails with WE53 news and offers to those who have given consent (see the table of legal bases in section 3). You can unsubscribe using the link in any email; after that, your email is not used for marketing.
When you write to us via WhatsApp, Viber or Telegram, the messenger also processes your messages under its own privacy policy.
AI replies. Some replies in the chat are prepared by the Crisp AI assistant; we show this in the chat. Crisp AI runs on Crisp’s infrastructure in the EU (Scaleway, France) and does not pass conversations to external AI providers.
5. Transfers outside the EEA
Our servers are in the EU, with the hosting provider Hetzner Online GmbH (Germany). Data leaves the EEA only where the service cannot be provided otherwise: Stripe, to accept payment in the Mobile application and at a terminal (the account is held in the EU, but Stripe carries out part of the processing in the United States); Twilio (United States), to call your number with a verification code. The WE53 team works with data only from within the EU. Crisp stores data in the EU and, under its data processing agreement, does not transfer it outside the EEA; some of its infrastructure providers are US companies (hosting with servers in the EU, the Cloudflare network), and any access by them is covered by the EU standard contractual clauses. Transfers to the United States are made on the basis of the European Commission adequacy decision (EU-US Data Privacy Framework) or the EU standard contractual clauses.
6. How long we keep data
| Data | Period |
|---|---|
| Account | while the account is active; after it is deleted, we delete the data within 5 days |
| Rental and payment data | 10 years: the period for which Portuguese law requires accounting records and supporting documents to be kept (Article 123(4) of the Código do IRC) |
| Support correspondence | 24 months after the last message, unless it is needed longer for a claim; Crisp system logs for up to 1 year |
| Email for marketing | until you unsubscribe |
7. Security
- Data is stored on secure servers, and transfers are encrypted with TLS.
- No transmission of data over the internet is completely secure, but once we receive your data we apply strict procedures and measures against unauthorised access.
8. Your rights
- access: to receive a copy of your data;
- rectification: to correct inaccurate data or complete incomplete data;
- erasure, including deleting your account in the Mobile application; data the law requires us to keep (section 6) is kept until the end of that period;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability: to receive your data in a structured format or have it sent to another controller;
- withdrawal of consent at any time;
- a complaint to the CNPD (Portugal).
We reply to a request within one month; in complex cases this may be extended by two further months, and we will tell you if so.
9. Children
The Agreement is concluded only with persons aged 18 or over. We do not check age or collect data about it, so we cannot know who uses a Station, especially when paying at a terminal. If you believe a child has given us data, write to service@we53.io and we will delete it.
10. Business enquiries and contacts
- This section is for representatives of venues and companies who send a request through the “For business” form on the Website, or whom we contact to offer a WE53 Station. Once an agreement with your company is signed, further processing of its representatives’ data (reports, invoices, payouts, the partner portal) is described in that agreement.
- What data. From the form: the name of your venue, your name, email, phone number (optional), your comment, the page language and the date and time of sending. At first contact: the name, job title and business phone number and email of the venue’s representative, obtained from them or from public sources (the venue’s website, Google Maps), and notes of meetings and correspondence.
- Why and on what basis. To reply to your request and prepare an offer or agreement: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). To offer cooperation to a venue we do not yet work with and to keep a record of discussions: legitimate interest (Article 6(1)(f) GDPR). You may object, and we will stop contacting you.
- Who receives it. Requests from the form pass through the WE53 server hosted by Hetzner Online GmbH (Germany) and arrive by email in WE53’s Google Workspace mailbox (Google Cloud EMEA Limited, Ireland). WE53 receives them on behalf of KIT CERVICOS and passes them to its staff in Portugal who work with venues. Google may process data in the United States on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.
- How long we keep it. If no agreement is signed, for 24 months after the last contact, after which we delete it. If you object, we keep only a “do not contact” note so that we do not write to you again. If an agreement is signed, as set out in that agreement.
- Controller and contact. For venues in Portugal: KIT CERVICOS, UNIPESSOAL LDA; for Cyprus and Greece: the WE53 company in that country, whose policy is on the Website when you select the country. Questions and objections: partners@we53.io. Your rights are described in section 8.
11. Changes to this Policy
New versions are published on the Website and in the Mobile application with their date; we tell you about significant changes in the app or by email.