Privacy Policy

Welcome

We provide infrastructure for energy. Individuals use our apps to find and pay for EV charging, and businesses of all sizes use our technology and services to operate charging stations and other energy devices, sell charging and energy services, manage fleets, and participate in energy programs.

This Privacy Policy (“Policy”) describes the Personal Data that we collect, how we use and share it, and how you can reach us with privacy-related inquiries. The Policy also outlines your rights and choices as a data subject, including the right to object to certain uses of your Personal Data. Depending on the activity, Aalto acts as a “data controller” and/or a “data processor” (or “service provider”).

Defined Terms

In this Policy, “Aalto”, “we”, “our”, or “us” refers to Aalto Energy, Inc..

“Personal Data” refers to any information associated with an identified or identifiable individual, which can include data that you provide to us and data that we collect about you during your interaction with our Services (such as device information, IP address, and location data).

“Services” refers to the products, services, and applications that we provide under the Aalto Services Agreement (“Business Services”, including Centro, Aalto Charge, Aalto Fleets, Aalto Vision, and Aalto Roam) or the Aalto Consumer Terms of Service (“End User Services”: the Aalto iOS and Android apps and the Aalto web app, including the charging map); websites like aalto.energy (“Sites”); and other Aalto applications and online services. We provide Business Services to entities (“Business Users”). We provide End User Services directly to individuals for their personal use.

“Financial Partners” are financial institutions, banks, and other partners that we partner with, directly or indirectly, to provide the Services, such as payment processors (including Stripe), banking partners (including Column, N.A.), payment method providers, and card networks.

“Charging Network Partners” are third-party charging networks whose stations are available through the Services via roaming, or that connect their networks to Aalto’s platform.

Depending on the context, “you” might be an End User, an End Customer, a Representative, or a Visitor:

• End Users. When you use an End User Service for personal use (such as using the Aalto app to find a charging station, save a payment method, and start a charging session), we refer to you as an “End User.”
• End Customers. When you are not directly transacting with Aalto, but we receive your Personal Data to provide Services to a Business User (for example, when a charging operator runs its stations on Centro and you charge there through the operator’s own channels, or when a fleet operator connects a vehicle you drive to Aalto Fleets), we refer to you as an “End Customer.”
• Representatives. When you are acting on behalf of an existing or potential Business User (perhaps as a company founder or an account administrator for a Business User), we refer to you as a “Representative.”
• Visitors. When you interact with Aalto by visiting a Site without being logged into an Aalto account, or when your interaction with Aalto does not involve you being an End User, End Customer, or Representative, we refer to you as a “Visitor.” For example, you are a Visitor when you send a message to Aalto asking for more information about our Services.

In this Policy, “Transaction Data” refers to data collected or used by Aalto in relation to charging sessions and other transactions you request. Some Transaction Data is Personal Data and may include: your name, email address, contact number, billing address, payment method information (such as card brand and the last four digits of your card number, or a payment token), the identity and location of the charging station used, session start and end times, energy delivered, amount and date of the transaction, information about payment status, applicable tax amounts, refund or dispute information, and support interactions.

1. Personal Data we collect and how we use and share it

Our collection and use of Personal Data differs based on whether you are an End User, End Customer, Representative, or Visitor, and the specific Service that you are using. For example, if you operate charging stations as a sole proprietor, we may collect your Personal Data to onboard your business; at the same time, you might also be an End User if you use the Aalto app to charge your own vehicle.

1.1 End Users

a. Personal Data we collect about End Users

Creating an Aalto account. When you create an account in the Aalto apps, we collect your email address or mobile phone number (which we verify with a one-time code), your name if you provide it, and your authentication data.

Saving a payment method. To start charging sessions, you save a payment method: a credit or debit card, Apple Pay, or Google Pay. Your full payment credentials are collected and stored by our payment processor; Aalto does not store full card numbers. We receive and store a payment token and limited details (such as card brand, last four digits, and expiration date) so we can display your saved method and charge it for your sessions.

Charging sessions. When you start a charging session, we collect Transaction Data for the session, including the station used, its location, session start and end times, energy delivered, and amounts charged.

Location data. With your permission, we collect your device’s precise geolocation to (i) show charging stations near you, (ii) provide directions and routing to a station you select, (iii) help you start a charging session at the station where you are located, and (iv) improve station data. You can decline or withdraw this permission at any time in your device settings, in which case you can still search for stations manually. We may also derive your approximate location from your IP address.

Vehicle information. If you provide it, we collect information about your vehicle (such as make, model, and connector type) to show you compatible stations.

More. For further information about other types of Personal Data that we may collect about End Users, including about your online activity and your engagement with our End User Services, please see the More ways we collect, use, and share Personal Data section below.

b. How we use and share Personal Data of End Users

Services. We use and share your Personal Data to provide the End User Services to you, which includes starting and completing charging sessions, processing your payments through our Financial Partners, providing receipts and session history, support, personalization (such as language preferences and saved vehicles), and communication about our End User Services (such as session status notifications and Policy updates). Learn more about how we use cookies and similar technologies in our Cookies Policy.

Station Operators and Charging Network Partners. When you charge at a station, we share the information needed to provide and support the session with the business responsible for that station: the Station Operator or, for roaming sessions, the Charging Network Partner. This typically includes session authorization details, session and energy data, and information needed to investigate session failures, disputes, and refunds; it does not include your full payment credentials. Once shared, their use of that data is subject to their own privacy policies.

Fleet operators and employers. If your account or a charging session is linked to, or billed to, a business (for example, your employer or a fleet operator), we share information about that charging activity with the business that pays for or administers it, including session dates and times, station locations, energy delivered, and the associated charges. This sharing is a condition of business-billed charging. Once shared, the business’s use of that data is subject to its own privacy policies.

Fraud detection and loss prevention. We use your Personal Data collected across our Services to detect fraud and prevent financial losses for you, us, and our Business Users, Charging Network Partners, and Financial Partners, including detecting unauthorized payments and account access.

Advertising. Where permitted by applicable law, we may use your Personal Data, including Transaction Data (but not call recordings, call transcripts, or support chat transcripts), to assess your eligibility for, and offer you, other Aalto services or to promote existing services. Subject to applicable law, including any consent requirements, we may use and share End User Personal Data with third-party partners (such as advertising partners and analytics providers) to advertise our Services and measure the efficacy of such ads. We do not transfer your Personal Data to third parties in exchange for payment.

1.2 End Customers

Aalto provides various Business Services to our Business Users, such as operating charging stations and other energy devices on Centro, settling charging revenue, and managing fleet vehicles. When acting as a service provider (also referred to as a data processor) for a Business User, we process End Customer Personal Data in accordance with our agreement with the Business User and the Business User’s lawful instructions. This happens, for example, when we process charging sessions and payments at a Business User’s stations, or when a fleet operator connects a vehicle you drive to Aalto Fleets and we collect vehicle telematics (such as location, state of charge, and charging activity) through OEM and telematics integrations at the fleet operator’s direction.

Business Users are responsible for ensuring that the privacy rights of their End Customers are respected, including obtaining appropriate consents (for example, fleet operators obtaining driver consents for vehicle location data) and making disclosures about their own data collection and use. If you’re an End Customer, please refer to the privacy policy of the Business User you’re doing business with (or whose vehicle you drive) for its privacy practices, choices, and controls.

Where allowed by law and our agreements, we also use End Customer Personal Data for Aalto’s own purposes, such as securing the Services, preventing fraud and loss, and improving our Services, as described in the More ways section below.

1.3 Representatives

a. Personal Data we collect about Representatives

Registration and contact information. When you register for an Aalto account for a Business User, we collect your name, email address or phone number, and login credentials. If you sign up to receive Aalto communications or contact our sales or support teams, we collect your registration, profile, and communication data.

Identification information. As a current or potential Business User, an owner of a Business User, or an officer or director of a Business User, we (and our Financial Partners, who onboard Business Users for payments and payouts) need information such as your name, postal address, telephone number, email address, date of birth, ownership interest, and government-issued identity documents to fulfill financial-partner and regulatory requirements (including “know your customer” and anti-money-laundering requirements), verify your identity, and prevent fraud. We may collect this information directly from you and/or from publicly available sources and third parties such as credit bureaus.

More. For further information about other types of Personal Data that we may collect about Representatives, including your communications with our sales and support teams and our recording and transcription of calls, please see the More ways we collect, use, and share Personal Data section below.

b. How we use and share Personal Data of Representatives

We use Representatives’ Personal Data to provide the Business Services to the corresponding Business Users; to share with parties authorized by the Business User, including Financial Partners that require information about Business Users and their Representatives for onboarding, payment processing, payouts, and dispute handling; to conduct due diligence, sanctions screening, and fraud and risk management; and, subject to applicable law and any consent requirements, to market our Business Services.

1.4 Visitors

When you browse our Sites, we receive your Personal Data, either provided directly by you (for example, when you complete a contact or signup form) or collected through our use of cookies and similar technologies (see our Cookies Policy). We use this data to operate and improve the Sites, measure engagement, customize your experience, respond to your inquiries, and, subject to applicable law and any consent requirements, to advertise and market our Services.

2. More ways we collect, use, and share Personal Data

In addition to the ways described above, we also process your Personal Data as follows:

a. Collection of Personal Data

Online activity. Depending on the Service used, we may collect information related to the devices and browsers you use across our Sites and apps, and usage data associated with those devices and browsers and your engagement with our Services, including IP address, device identifiers, operating system, language preference, time spent, pages visited, links clicked, and the pages that led you to our Sites. We also collect activity indicators to help us detect fraud. See our Cookies Policy.

Communication and engagement information. We collect information you choose to share with us through various channels, such as support tickets, live chat with our support team, emails, in-app problem reports, or social media. If you respond to emails or surveys from Aalto, we collect your email address, name, and any other data you opt to include in your responses. If you request a call from us or otherwise engage with us over the phone, we collect your phone number and any other information you provide during the call, and, where permitted under applicable law, calls with Aalto or Aalto representatives may be recorded, monitored, and transcribed. Where a call is recorded, our telephony provider may automatically generate a written transcript and summary of it. We use call recordings, transcripts, and support chat transcripts only to provide and improve support, for quality assurance and training, to protect against fraud and resolve disputes, and to comply with our legal obligations — not for advertising or to assess your eligibility for other services.

b. Use of Personal Data

Analyzing, improving, and developing our Services. We collect and process Personal Data throughout our various Services to improve our Services, develop new Services, and support our efforts to make our Services more efficient, relevant, and useful to you. We may use Personal Data to generate aggregate and statistical information (for example, station utilization, reliability, and pricing analytics), and we may use data collected across the Services to train models that power our Services (including forecasting, pricing recommendations, and fraud detection) and to improve the accuracy of station information. We also review call recordings, call transcripts, and support chat transcripts for quality assurance, to train our support teams, and for operational purposes such as investigating a charging session or a payment dispute. We do not use call recordings, call transcripts, or support chat transcripts to train the models described above.

Communications. We use the contact information we have about you to deliver our Services. If you provide a mobile phone number, this may include sending you one-time sign-in verification codes and, where you opt in, transactional text messages about your charging sessions (such as session-completion and receipt notifications). Message frequency varies, and message and data rates may apply. You can opt out of these text messages at any time by replying STOP, and reply HELP for help. Mobile information, text messaging originator opt-in data, and consent are not shared with any third parties or affiliates for marketing or promotional purposes. Separately from that text-message program, where permitted under applicable law we may record, monitor, and transcribe calls between you and our support and sales teams in order to provide the Services and resolve your issue, to comply with our legal obligations, and for quality assurance and training purposes. Where we do, we tell you before the recording starts, and where applicable law requires your consent to record, we ask for it; if you would rather not be recorded, you can ask us to continue by email or in-app chat instead. We may also communicate with you to provide information about our Services, invite you to participate in surveys or research, or otherwise communicate for marketing purposes, in compliance with applicable law, including any consent or opt-out requirements.

Promotions. If you opt to submit Personal Data to engage in an offer, program, or promotion, we use the Personal Data you provide to manage the offer, program, or promotion.

Fraud prevention and security. We collect and use Personal Data to help us identify and manage activities that could be fraudulent or harmful across our Services and to secure our Services and transactions against unauthorized access, use, alteration, or misappropriation of Personal Data, information, and funds. As part of these efforts, we may collect information from publicly available sources and third parties, and we may receive details such as IP addresses and other identifying data about potential security threats.

Compliance with legal obligations. We use Personal Data to meet our contractual and legal obligations, including those related to anti-money laundering, sanctions, export control, tax, and financial reporting, and to respond to lawful requests.

Minors. Our Services are not directed to children under the age of 18, and we do not knowingly collect Personal Data from them. If you believe a child has provided us Personal Data, please contact us so we can delete it.

c. Sharing of Personal Data

Aalto affiliates. We share Personal Data with other Aalto-affiliated entities for purposes identified in this Policy.

Service providers. In order to provide, communicate, market, analyze, and advertise our Services, we depend on service providers: for example, providers of cloud infrastructure, payment processing, mapping, SMS and email delivery, analytics, and customer support tooling, including the business telephony provider that carries our support phone line and stores any recording and transcript of those calls. We authorize these service providers to use or disclose the Personal Data we make available to them only to perform services on our behalf and to comply with relevant legal obligations, and we require them to contractually commit to security and confidentiality obligations. See our Sub-processors list.

Financial Partners. We share Personal Data with our Financial Partners to process payments and payouts, verify identities, manage disputes, and provide the Services.

Station Operators and Charging Network Partners. We share Personal Data with the Business Users and Charging Network Partners involved in your transactions, as described in Section 1.

Others with consent. In other situations, we will disclose the identity of the third party and the information to be shared with them, and seek your consent to share the information.

Corporate transactions. If we enter or intend to enter a transaction that modifies the structure of our business, such as a reorganization, merger, sale, joint venture, assignment, transfer, change of control, or other disposition of all or part of our business, assets, or stock, we may share Personal Data with third parties in connection with such transaction. Any other entity that buys us or part of our business will have the right to continue to use your Personal Data, subject to the terms of this Policy.

Compliance and harm prevention. We share Personal Data when we believe it is necessary to comply with applicable law; to abide by rules imposed by Financial Partners; to enforce our contractual rights; to secure and protect the Services, rights, privacy, safety, and property of Aalto, you, Business Users, and others; and to respond to valid legal requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence.

3. Legal bases for processing Personal Data

For purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, we rely on a number of legal bases to process your Personal Data:

a. Contractual and pre-contractual relationships. We process Personal Data to enter into business relationships with prospective Business Users and End Users and fulfill our respective contractual obligations with them, including creating and managing Aalto accounts, processing charging sessions and payments and related activities (including fraud detection, communications about such payments, and customer service), and accounting and billing activities.

b. Legal compliance. We process Personal Data to comply with legal obligations, including those related to fraud monitoring and prevention, anti-money laundering and know-your-customer requirements applicable to us or our Financial Partners, sanctions screening, and tax and financial reporting.

c. Legitimate interests. Where permitted under applicable law, we rely on our legitimate business interests, including: detection, monitoring, and prevention of fraud and unauthorized transactions; mitigation of financial loss or other harm to End Users, End Customers, Business Users, Charging Network Partners, Financial Partners, and Aalto; responding to inquiries and providing support, including reviewing support calls and chats for quality assurance and for training our support teams; promotion, analysis, and improvement of our Services and the development of new products and services (including improving the accuracy of station information); aggregate analysis and business intelligence; sharing Personal Data with service providers and among our affiliates; and enabling network and information security.

d. Consent. We rely on consent where required: for example, to collect your device’s precise geolocation, to record a call with you where applicable law requires your consent to do so, to send certain marketing communications, or to use certain cookies. When we process your Personal Data based on your consent, you have the right to withdraw your consent at any time, and such a withdrawal will not impact the legality of processing performed before its withdrawal.

e. Other valid legal bases. We may process Personal Data further to other valid legal bases as recognized under applicable law in specific jurisdictions. See the Jurisdiction-specific provisions section below.

4. Your rights and choices

a. Opting out of receiving electronic communications from us

If you wish to stop receiving marketing-related communications from us, you can opt out by clicking the unsubscribe link included in such communications, replying STOP to text messages, or managing your preferences in the app. Even if you opt out of marketing communications, we retain the right to communicate with you about the Services you receive (like receipts, session notifications, support, and important legal notices).

b. Your data protection rights

Depending on your location and subject to applicable law, you may have the following rights regarding the Personal Data we process about you as a data controller:

• The right to request confirmation of whether Aalto is processing Personal Data associated with you, the categories of Personal Data processed, and the third parties or categories of third parties with which your Personal Data is shared;
• The right to request access to the Personal Data we process about you;
• The right to request that we rectify or update your Personal Data if it is inaccurate, incomplete, or outdated;
• The right to request that we erase your Personal Data in certain circumstances provided by law;
• The right to request that we restrict the use of your Personal Data in certain circumstances, such as while we are considering another request you have submitted;
• The right to request that we export the Personal Data we hold about you to another company, where technically feasible;
• The right to withdraw your consent where processing is based on consent (including device location permissions);
• The right to object to processing based on our legitimate interests. Unless there are compelling legitimate grounds or the processing is necessary for legal reasons, we will cease processing your Personal Data upon receiving your objection;
• The right not to be discriminated against for exercising these rights; and
• The right to appeal a decision we make relating to your rights by contacting us at privacy@aalto.energy, and/or relevant regulatory agencies.

c. Process for exercising your data protection rights

To exercise your data protection rights related to Personal Data we process as a data controller, contact us as outlined in the Contact us section. We will verify your request by asking you to send it from the email address or phone number associated with your account or by requiring other information necessary to verify your identity. For Personal Data we process as a data processor (for example, telemetry we process on behalf of a charging operator or fleet), please reach out to the relevant data controller (the Business User) to exercise your rights; if you contact us about such data, we will refer you to the relevant data controller to the extent we are able to identify them.

5. Security and retention

We make reasonable efforts to provide a level of security appropriate to the risk associated with the processing of your Personal Data. We maintain organizational, technical, and administrative measures designed to protect the Personal Data covered by this Policy from unauthorized access, destruction, loss, alteration, or misuse. Full payment credentials are handled by our PCI-certified payment processors. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you suspect that your interaction with us is no longer secure (for instance, you believe your account’s security has been compromised), please contact us immediately.

We retain your Personal Data for as long as we continue to provide the Services to you or our Business Users, or for a period in which we reasonably foresee continuing to provide the Services. Even after we stop providing Services directly to you or to a Business User that you’re doing business with, and even after you close your Aalto account, we may continue to retain your Personal Data to:

• Comply with our legal and regulatory obligations;
• Enable fraud monitoring, detection, and prevention activities; and
• Comply with our tax, accounting, and financial reporting obligations, including where retention is required by our agreements with our Financial Partners or mandated by the payment methods you used.

In cases where we keep your Personal Data, we do so in accordance with any limitation periods and record retention obligations imposed by applicable law.

6. International data transfers

We are based in the United States, and it is sometimes necessary for us to transfer your Personal Data to countries other than your own, including the United States. These countries might have data protection regulations that are different from those in your country. When transferring data across borders, we take measures to comply with applicable data protection laws related to such transfers. In certain situations, we may be required to disclose Personal Data in response to lawful requests from officials, such as law enforcement or security authorities.

When a data transfer mechanism is mandated by applicable law, we employ one or more of the following: transfers to countries or recipients recognized as providing an adequate level of protection; the EU Standard Contractual Clauses and the UK International Data Transfer Addendum; or other lawful methods available to us under applicable law. You may request a copy of the relevant Standard Contractual Clauses by contacting us.

7. Updates and notifications

We may change this Policy from time to time to reflect new services or changes in our privacy practices or relevant laws. The “last updated” date of this Policy indicates when it was last materially revised. Any changes are effective the later of when we post the revised Policy on the Services or when we otherwise provide notice of the update as required by law. We may provide you with disclosures and alerts regarding the Policy or Personal Data collected by posting them on our website and, if you are an End User or Representative, by contacting you through the app, your dashboard, or the email address or phone number associated with your account.

8. Jurisdiction-specific provisions

United States. If you are a consumer located in the United States, we process your Personal Data in accordance with US federal and state privacy laws.

• Your rights and choices. As a US consumer and subject to certain limitations under US privacy laws (including the California Consumer Privacy Act), in addition to the rights in Section 4 you may have the right to know the categories of personal information collected, disclosed, or shared, the purposes of collection, the categories of sources, and the categories of third parties with whom we disclosed or shared personal information.
• “Sale” or “sharing.” We do not transfer your Personal Data to third parties in exchange for payment. However, we may provide data to third-party partners, such as advertising partners and analytics providers, who assist us in advertising our Services. Because these third parties may use the data for their own purposes, this may be considered a data “sale” or “sharing” (for behavioral advertising) as those terms are defined under the CCPA and other applicable US privacy laws. You can opt out of targeted advertising and any related “sale” or “sharing” via our cookie settings.
• Do Not Track and Global Privacy Control signals. Some browsers transmit “Do Not Track” (DNT) signals. Because no common industry standard for interpreting DNT signals has been adopted, we do not respond to DNT signals at this time. We do treat Global Privacy Control (GPC) signals as a valid request to opt out of targeted advertising and any related “sale” or “sharing” where required by applicable law.
• Sensitive personal information. We do not sell or share (for behavioral advertising) sensitive personal information as defined by US privacy laws. Note that precise geolocation collected with your permission to show nearby stations is sensitive personal information under some state laws; we use it only to provide and improve the Services.
• Authorized agents; verification; appeals. You may designate an authorized agent to make requests on your behalf. We will verify your request as described in Section 4(c), and you may appeal a decision by contacting us at privacy@aalto.energy.
• Recorded calls. Several US states require the consent of every party to a call before it may be recorded. Where that is the case, we tell you before the recording starts, and you may decline to be recorded and continue by email or in-app chat instead. A recorded call may also be transcribed. We do not use call recordings or transcripts for biometric identification and we do not create voiceprints.

EEA and UK. Where the GDPR or UK GDPR applies, the legal bases in Section 3 apply to our processing. You may exercise your rights by contacting us at privacy@aalto.energy. If you believe our processing of your information contradicts the GDPR, you may direct your questions or complaints to your local supervisory authority; UK residents may contact the UK Information Commissioner’s Office.

Canada. As used in this Policy, “applicable law” includes the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws. “Personal Data” includes “ personal information” as defined under those laws. When we collect Personal Data belonging to Canadian residents, we transfer that data to data centers in the United States, and our service providers may also be located outside of Canada. You have the right to request access to or rectification of the Personal Data we hold about you, or to withdraw consent, by contacting us at privacy@aalto.energy.

Australia. “Personal Data” includes “personal information” as defined under the Privacy Act 1988 (Cth) as amended from time to time. If you are an Australian resident and dissatisfied with our handling of any complaint you raise under this Policy, you may consider contacting the Office of the Australian Information Commissioner.

9. Contact us

If you have any questions or complaints about this Policy, please contact us at privacy@aalto.energy or by mail at Aalto Energy, Inc., 524 Broadway, #02-110, New York, NY 10012, United States. If you are an End Customer (i.e., an individual doing business or transacting with a Business User), please refer to the privacy policy or notice of the Business User for information regarding the Business User’s privacy practices, choices, and controls, or contact the Business User directly.