Privacy Policy

ChargeSlot is operated by Dawid Kostka. We are responsible for deciding how and why your personal data is processed when you use the ChargeSlot platform.

• Account & organisation data: name, work email address, organisation name, role information and billing contacts that you provide during registration or onboarding.
• Booking & usage data: charging reservations, station assignments, session timestamps, check-in/check-out information and related audit trails created while using the app.
• Support communication: the contents of support tickets, live chat conversations, feedback forms and any attachments you share with our team.
• Technical metadata: IP address, device and browser information, log files and diagnostic data collected automatically to maintain security and service reliability.

• Provide and maintain the service

  We use your account, booking and technical data to deliver core functionality, ensure fair charging slot allocation and give you access to organisation resources (Art. 6(1)(b) GDPR).

• Customer communication and support

  Your contact details and support history allow us to answer enquiries, send operational emails and manage onboarding (Art. 6(1)(b) and (f) GDPR).

• Product analytics (aggregated)

  We evaluate anonymised and aggregated usage insights to improve planning, detect bottlenecks and develop new features. Wherever possible we use aggregated data and legitimate interest balancing (Art. 6(1)(f) GDPR).

• Security, fraud prevention and compliance

  Technical logs help us secure accounts, investigate incidents, comply with legal obligations and enforce our terms (Art. 6(1)(c) and (f) GDPR).

We rely on carefully selected service providers that process data on our behalf under data processing agreements and Standard Contractual Clauses where required.

• Calendly LLC (USA)

  Used for demo scheduling. We transmit your name, email address and chosen appointment data so you can book a meeting slot. Calendly applies EU Standard Contractual Clauses for international transfers.

• Lettermint B.V. (Netherlands)

  Sends our transactional emails (e.g. verification, booking and onboarding emails). For this, Lettermint processes your email address, the message content and delivery data. Lettermint runs its infrastructure exclusively within the EU; processing is based on a data processing agreement.

• Umami web analytics (self-hosted, netcreators)

  To measure the reach of our website we use a self-hosted instance of the open-source software Umami at stats.netcreators.app. Umami sets no cookies, builds no personal user profiles and does not store IP addresses; it records aggregated data such as the page visited, referrer, browser, device type and country. The analytics script is delivered through Cloudflare's network. The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).

• Application hosting and infrastructure

  Our web application and databases run on EU-based cloud infrastructure. Providers only access data to deliver infrastructure services under contractual confidentiality obligations.

We only set technically necessary cookies, which require no consent (Section 25(2) no. 2 TDDDG):
• chargeslot-session – keeps the sign-in and form input together while the site is used; valid until the session ends.
• XSRF-TOKEN – protects forms against cross-site request forgery; same lifetime as the session.
• remember_web_… – only if "Remember me" is ticked when signing in; keeps the sign-in until sign-out.
Beyond that, the browser's local storage only holds display settings such as light or dark mode and a dismissed install hint. We set no tracking or advertising cookies.
For our own visitor statistics we derive a daily changing, irreversible identifier from the IP address and browser identification (a hash with a random daily key that is deleted after two days at the latest). Nothing is stored on the device for this, and visitors cannot be recognised across days. If someone arrives through a partner link (e.g. with ?ref=…), we keep the partner identifier only within the current session, so that a sign-up can be attributed to the partner. The legal basis is our legitimate interest in improving our service and in settling accounts with partners (Art. 6(1)(f) GDPR).

We retain personal data only for as long as necessary to fulfil the purposes described above. Account and booking records are stored for the duration of the customer relationship plus applicable statutory retention periods. Support conversations are deleted after 24 months unless we must keep them longer to resolve issues or meet legal requirements.

If data is transferred outside the European Economic Area, we rely on EU Standard Contractual Clauses or other safeguards recognised by the GDPR. We continuously monitor the compliance of our processors.

You have the following rights under the GDPR with respect to your personal data:

• Right of access to the personal data we hold about you (Art. 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Right to erasure (‘right to be forgotten’) in line with Art. 17 GDPR.
• Right to restriction of processing where the conditions of Art. 18 GDPR are met.
• Right to object to processing based on legitimate interests (Art. 21 GDPR).
• Right to data portability for information you provided to us (Art. 20 GDPR).
• Right to lodge a complaint with your competent supervisory authority (Art. 77 GDPR).

To exercise these rights, email us at dk@chargeslot.app

How to delete your account: Delete your account

We may update this privacy policy if our processing activities change or legal requirements evolve. We will post the new version on this page and indicate the revision date.