Data Processing Agreement
Version 2026-2, effective 2026-10-30 for all accounts; for existing accounts it is the Data Processing Agreement named in General Terms 2026-1 clause 10.1; its references to the General Terms are to version 2026-2.
Annex to our General Terms. The Definitions, version 2026-2, at plugchoice.com/legal/definitions, form part of this Data Processing Agreement (DPA).
Parties: the Customer (controller) and we, Volt Time B.V., also trading as Plugchoice (processor), KvK 77488873, De Entree 99, 1101 HE Amsterdam, support@plugchoice.com.
1. Scope and roles
1.1. This DPA applies only where and as far as we process personal data for a Business Customer that determines the purposes, and only to perform that service (General Terms clause 10.1).
1.2. Annex 1 sets out the processing details and security measures.
1.3. Outside this DPA, and whatever the Customer instructs, we are controller under our Privacy Policy: for the accounts of persons with their own account and what they do for themselves in them, for our legal obligations, and for securing and operating the Platform and anonymizing data processed under this DPA (General Terms clause 10.3). Anonymized data and processing whose purposes and means the parties determine jointly (General Terms clause 10.1) fall outside this DPA.
2. Instructions
2.1. We process personal data under this DPA only on the Customer's documented instructions, also for transfers outside the EEA, unless EU or Member State law requires otherwise; we then inform the Customer first, unless that law forbids it. Instructions are the Agreement, including clause 6, the Customer's Platform settings and the connections to Third-Party Services that the Customer or its users authorize. We tell the Customer if we think an instruction infringes data protection law.
3. Confidentiality
3.1. Persons who process the data are bound by confidentiality and get access only as far as they need it.
4. Security
4.1. We take appropriate technical and organizational measures (Annex 1), considering the state of the art, costs and risks, and may change them while they stay appropriate.
5. Subprocessors
5.1. The Customer generally authorizes the subprocessors on our Subprocessor List. We announce an addition or replacement at least 14 days in advance, by email to the Account Holder or in the Platform. The Subprocessor List may name a subprocessor as available on request; we give its name to a Business Customer on request without delay.
5.2. Within those 14 days the Customer may object In Writing, stating a concrete risk to data subjects that the subprocessor's guarantees under article 28(4) GDPR do not address. Without a solution, the Customer may, as its only remedy, end the services concerned from the date the subprocessor starts; prepaid fees are not refunded and a fixed term continues for the other services. Without timely objection, the change is accepted.
5.3. We impose materially equivalent obligations on subprocessors and remain responsible for them.
6. Transfers
6.1. Transfers outside the EEA rely on an EU adequacy decision, including the EU-US Data Privacy Framework, or on Standard Contractual Clauses, as the Subprocessor List states.
7. Assistance
7.1. As far as the nature of the processing reasonably allows, we assist the Customer with data subject requests and its obligations under articles 32 to 36 GDPR, first through the Platform's self-service functions; other assistance we may charge at reasonable rates.
8. Breaches
8.1. We notify the Customer without undue delay after becoming aware of a personal data breach affecting its data, with the information reasonably available to us. A notification is not an admission of fault.
9. Audit
9.1. We provide the information reasonably needed to demonstrate compliance.
9.2. The Customer may audit at most once every 12 months, only where 9.1 does not suffice, on 30 days' notice, on Working Days, under confidentiality, without access to other customers' data and not through an auditor that competes with us. It bears its own costs, reimburses our reasonable costs and shares the findings with us.
10. Return and deletion
10.1. When the processing ends, we delete or return the personal data, at the Customer's choice, within a reasonable wind-down period, returning it through the Platform's standard exports; except data the law requires us to keep and data we process as controller under clause 1.3.
11. Liability and duration
11.1. General Terms clause 12 applies.
11.2. We may amend this DPA in the same way and with the same notice as General Terms clause 14.2.
Annex 1: Processing details and security measures
Subject matter, nature and purposes: operating the Platform for the Customer (hosting, charger connectivity, sessions, billing and reimbursement where activated, support) for purposes it determines, such as its own invoicing, reimbursement of drivers or employees, or access policy.
Duration: the term of the Agreement plus wind-down.
Data: account and contact data of the Customer's users and drivers; charger, location and configuration data; session and meter data; charge card identifiers; payment status; support communications.
Data subjects: the Customer's employees, customers, drivers and other users of its Chargers.
Retention: our standard periods in our Privacy Policy, which the Customer accepts as its instruction. We announce a longer standard period as clause 5.1 provides for a subprocessor; a shorter one needs no notice. At the end, clause 10.1.
Technical and organizational measures: encryption in transit (TLS) for web, app and API traffic and for Chargers connected over wss, not for an unencrypted connection (ws) that the Customer chose for a Charger or a Third-Party Service (General Terms 8.5); role-based access on a need-to-know basis; two-factor authentication available to staff; backups and recovery; monitoring and error logging; vulnerability handling under our Responsible Disclosure policy; staff confidentiality; a documented incident response process.