Privacy Policy

Last updated: 15 September 2026

1. Controller and general data protection principles

We,

JOYA Mobility AG
Aargauerstrasse 182
8048 Zurich
Switzerland

info@joya.ch

(hereinafter also "JOYA")

are an electric mobility service provider with its registered office in Zurich and locations throughout Switzerland, providing various services in the field of electric mobility such as charging services for electric vehicles, the operation of charging stations and charging infrastructure, the provision of a digital platform (app), and white-label and platform solutions for business customers and partners, as well as related services (together the "Services"). In the course of our business activities and the provision of our Services, we collect and process personal data, in particular relating to our customers, affiliated persons, business partners, visitors to our websites, users of the customer portal and the app, job applicants, newsletter recipients and other entities, or their respective contact persons and employees (hereinafter also "you").

When collecting, processing and using your personal data, protecting your privacy and complying with data protection requirements is of particular importance to us. In this privacy policy we inform you how we process your personal data in the course of our business activities and the provision of the Services. We may additionally inform you separately about the processing of your personal data (e.g. in contractual terms, forms or further privacy notices).

2. Collection of your personal data

Personal data is any information relating to an identified or identifiable natural person, such as your name, your address, your telephone number or your email address.

We receive personal data primarily directly from you, for example when you use our Services, visit our websites or contact us. Certain information is also recorded automatically when you use our offerings and Services and is transmitted by the devices you use. We may also obtain data from publicly accessible sources or from third parties.

In principle, you are under no legal obligation to disclose personal data. However, we require certain information in order to conclude contracts, provide our services or handle enquiries. The use of our websites, apps and portals likewise requires the processing of certain personal data.

3. Purposes of processing your personal data

In the course of our business activities we may process various categories of personal data for various purposes. In particular, we process the following personal data relating to you for the following purposes:

a) Operation and improvement of our websites

For the secure and stable operation of our websites we collect and process technical data when you visit our website, in particular:

  • browser type/version and operating system,

  • referrer URL (source of a link to our website),

  • settings of your end device,

  • pages / files accessed,

  • IP address of the requesting computer,

  • region, date and time of the server request.

In order to continuously improve our websites, we collect and process personal data about your user behaviour and your preferences (for example how you navigate through our website).

b) Registration for and use of our apps and customer portals

When you use our apps or customer portals, we process the personal data required for registration, authentication and use of the apps or the portal. This includes in particular master data, contract data, charging data, billing data and communication data. We process this data to provide the app or the customer portal, to manage our customer relationship, for customer support, and to provide and further develop our products and services.

Location data: Insofar as you permit this in the settings of your device, we process your location in order to show you charging stations nearby, to support navigation and to allocate charging sessions. You can revoke location sharing at any time in your device settings.

c) White-label and platform services

We offer business customers and partners white-label and platform services in the field of electric mobility. In doing so, we may act in two different roles:

As controller, we process personal data relating to our own business relationship with the business customer or partner – in particular personal data of contact persons of our business partners as well as master, contact, contract, usage, support, transaction and billing data in connection with the operation of the platform. Processing takes place in order to provide, manage, further develop and safeguard our white-label and platform services, for customer support, for error analysis, to ensure system security, and to fulfil contractual and legal obligations.

Insofar as we process personal data on behalf of a partner (in particular data of its end customers and other persons involved), we act as a processor on the partner's instructions. In such cases the partner is the controller within the meaning of data protection law, and the partner's privacy policy applies to the processing of that data. We process such data solely to provide the agreed service and not for our own purposes.

d) Initiation, preparation and conclusion of contracts

In connection with the initiation, preparation and conclusion of contracts, we process the personal data required for this purpose, in particular master, contact, contract and communication data. We receive this data either directly from you or from publicly accessible sources or from third parties. To support our contract processes we use digital contract and document solutions provided by third parties. Personal data may in this context also be processed or stored by service providers to the extent necessary.

e) Performance and fulfilment of contracts, provision of services

We process your personal data so that we can perform the contract and exercise and enforce our contractual rights and obligations, in particular contractual services. This also includes processing your personal data for the purposes of customer support, business administration and accounting, enforcement of contracts and claims (debt collection, court proceedings, etc.) as well as public communication. For this purpose we process in particular personal data that we receive or collect ourselves in the course of contract initiation, conclusion and performance. In addition, there is data arising in the course of the business relationship, as well as information from publicly accessible sources or from third parties.

In order to handle charging sessions at roaming partners or other connected charging infrastructure, we may transmit the data required for authentication, execution and billing of the charging session to the respective partners. Where possible, this is done using identifiers instead of direct master data.

For payments by credit card or other electronic means of payment, the data required for payment processing is processed by the respective payment service provider. Processing takes place in accordance with the data protection provisions of the respective payment service provider.

f) Communication / marketing

When we are in contact with you, we process personal data in order to communicate with you (e.g. responding to an enquiry, in the context of contract initiation or contract performance). Such personal data includes in particular contact information (e.g. name, email address, telephone number) and communication content as well as information on the type, time and place of the communication. For the purpose of identifying you, we may also process information evidencing your identity. Video/telephone calls may be recorded; we will inform you at the beginning and you may switch to another channel (e.g. email) at any time. The processing purposes also include sending you information about events as well as news about our company or our products or similar (e.g. sending newsletters or otherwise electronically, by post or by telephone).

You may object to such communication at any time or refuse or withdraw your consent to such communication.

For email communication, newsletter distribution and the handling of enquiries we use providers of communication, newsletter and CRM solutions and other third-party services. Data may also be processed abroad in this context.

g) Job applications

We process the application data you send us (e.g. via our application portal, electronically, by post or by telephone) for the purpose of conducting the application procedure (reviewing and assessing the application, carrying out the application process) and, where applicable, for preparing and concluding the employment contract. In addition, we may obtain data from third parties, such as references (if you consent to references being obtained) or publicly accessible information (e.g. LinkedIn and other social media). The personal data is accessible only to the HR team and the responsible managers or the persons you have named.

If your application results in the conclusion of an employment contract, the data you have submitted may be stored by us in your personnel file for the purposes of the customary organisational and administrative process, in compliance with the applicable legal provisions.

If your job application is rejected, the data you have submitted will be deleted automatically 90 days after notification of the rejection. This does not apply where longer storage is necessary due to legal requirements or where you have expressly consented to longer storage in our candidate database.

h) Further data processing and purposes

We may process your personal data for the following further purposes:

Video surveillance: At some of our charging stations we use video surveillance systems. This measure serves to protect our users and our installations in the car parks, as well as the secure and correct handling of charging sessions. The video material may be processed for the investigation of criminal offences and for the traceability of charging sessions and may be made available to third parties (in the case of possible criminal offences, in particular to the competent criminal prosecution authorities). Video surveillance is carried out carefully and in compliance with applicable data protection laws. The recordings are used only for the defined purposes and are deleted as soon as they are no longer required for those purposes.

Compliance with legal requirements / proceedings: Within the scope of legal obligations or powers and in order to comply with internal rules (e.g. reporting, regulatory requirements, compliance, etc.), we may process personal data and disclose it to authorities or relevant external bodies. Insofar as we are involved in legal proceedings (e.g. court or administrative proceedings), we process data concerning, for example, parties to the proceedings and other persons involved such as witnesses or persons providing information, and disclose data to such parties, courts and authorities, potentially also abroad.

IT security: We also process data for the monitoring, control, analysis, protection and review of our IT infrastructure, as well as for backups and the archiving of data.

Further purposes: We process data to the extent necessary for further purposes such as:

  • prevention of criminal offences and other violations (e.g. fraud prevention or internal investigations),

  • training and education,

  • administration (e.g. contract management, accounting),

  • assertion and defence of claims,

  • evaluation and improvement of internal processes,

  • market and opinion research (e.g. contacting you for surveys),

  • media monitoring,

  • product improvement,

  • preparation of anonymous statistics and analyses,

  • acquisition or disposal of receivables, businesses, business units or companies, and

  • safeguarding other legitimate interests.

External service providers may be engaged to conduct surveys. Where this is the case, your personal data is processed exclusively within the framework of processing on our behalf and in compliance with the applicable data protection provisions.

4. Disclosure of your personal data to third parties and abroad

In connection with the purposes set out in section 3, we disclose your personal data in particular to the third parties listed below. Where required, we obtain your consent for this.

Service providers: We use services of third parties in Switzerland and abroad who process your personal data on our behalf, under joint responsibility with us, or under their own responsibility. These include in particular IT service providers, hosting and backend providers, providers of communication, billing and payment solutions, payment service providers and banks, insurers as well as consulting firms and business partners. These service providers may also process personal data to the extent necessary.

Authorities and courts: We may pass on your personal data to courts and authorities in Switzerland and abroad where this is necessary for the purposes described, where we are obliged or entitled to do so, or where this appears necessary to safeguard our interests. These recipients process the personal data under their own responsibility.

Corporate development and corporate transactions: In the context of corporate developments and corporate transactions, we may disclose personal data to the persons involved in the development or transaction.

Exchange within the group: We may pass on personal data within the Energie 360° Group insofar as this is necessary for contract performance, for the provision and further development of our products and services, for group-wide analyses, business management, reporting and other legitimate business purposes. Companies of the Energie 360° Group may also use this data for their own legitimate purposes. Personal data that we process as a processor on behalf of partners is not used by the companies of the Energie 360° Group for their own purposes.

Other persons: We may also disclose your personal data to other third parties where the involvement of third parties follows from the purposes set out in section 3. This concerns, for example, the persons or addressees you have specified. Your personal data may also be exchanged in the context of communication with industry organisations, associations or other bodies.

Recipients of your personal data are located in Switzerland, in states of the EU or the EEA and in the USA, and in individual cases also in other countries worldwide. This concerns in particular, but not exclusively, IT service providers and their sub-processors. If a country does not have adequate data protection, we ensure an appropriate level of protection by means of suitable safeguards – in particular the Standard Contractual Clauses of the European Commission (available here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914(opens in a new tab)) or, in the case of recipients in the USA, by their certification under the Swiss-U.S. Data Privacy Framework. In certain cases we may also transfer data without such safeguards, in particular where you have consented, where the disclosure is necessary for the performance of a contract or for the establishment, exercise or enforcement of legal claims, or where there is an overriding public interest.

All of these categories of third parties to whom we disclose personal data may in turn engage third parties to process your personal data. We can restrict the processing by certain third parties (e.g. IT service providers), but not that of other third parties (e.g. authorities, courts, insurers, etc.).

5. Cookies

Information on the use of cookies and similar technologies can be found in our cookie policy on our website.

There you will find in particular information on the cookies used, their purpose, their storage period and your options for adjusting settings and withdrawing consent.

6. Web analytics and optimisation tools

We use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), in particular Google Analytics 4, Google Tag Manager, Google Search Console, Google Ads and conversion tracking, in order to analyse the use of our website, ensure its functionality and continuously improve our online offering.

Google Analytics 4 enables us to evaluate the use of our website and to produce statistical reports. In this context, information about your usage behaviour, your end device, your browser and your interactions with our website may in particular be processed. The information collected by Google Analytics is used on our behalf to compile reports on website activity and to provide further services connected with website use.

Google Tag Manager serves exclusively to manage and integrate website tags and does not itself process personal data for analytics purposes. However, your IP address may be transmitted to Google in the process.

Google Search Console supports us in the technical monitoring and optimisation of our website in search engines.

Google Ads is an online advertising programme of Google. Within Google Ads we use conversion tracking and, where applicable, remarketing functions in order to measure the success of our advertising activities, to display targeted ads and to re-address users on other websites. In this context, information about the use of our website may be transmitted to Google and processed by Google.

Information on data processing by Google can be found at: https://policies.google.com/privacy(opens in a new tab).

Google may also process personal data in the USA. Although the contracting party is Google Ireland Limited (Ireland), transfer to or processing by Google LLC in the USA cannot be excluded. Insofar as data is transferred to the USA, we base the disclosure on Google's certification under the Swiss-U.S. Data Privacy Framework or – where necessary – on the Standard Contractual Clauses (see also section 4).

Further information on the use of cookies and similar technologies as well as on your options for giving and withdrawing consent can be found in our cookie policy (available on our website).

Social plugins / embedding of third-party tools

Our website, app and charging service may contain plugins from, and links to, social networks (e.g. LinkedIn, Facebook, Instagram, TikTok) and may embed other third-party tools. If you click on such a link or use such a function, you will be redirected to the respective provider or a connection to its servers will be established. In this context, personal data (in particular IP address, technical device data and information about your visit) may be transmitted to the provider, even without an account with the respective service. If you are logged in with the provider, it may associate the visit with your account.

Processing and responsibility lie with the respective provider in accordance with its privacy policy:

Facebook:
https://developers.facebook.com/docs/plugins/(opens in a new tab) | https://www.facebook.com/about/privacy(opens in a new tab)

Instagram:
https://developers.facebook.com/docs/instagram(opens in a new tab) | https://help.instagram.com/155833707900388(opens in a new tab)

LinkedIn: https://www.linkedin.com/legal/privacy-policy(opens in a new tab)

TikTok: https://www.tiktok.com/legal/page/us/privacy-policy/en(opens in a new tab)

Some of these providers process data in the USA or other countries. Where there is no adequate level of data protection, we ensure this by means of suitable safeguards (e.g. Data Privacy Framework or Standard Contractual Clauses, see also section 4).

This privacy policy also applies to our app. To ensure operation, for error and crash analysis and for improvement purposes, we process technical data in the app (e.g. device, usage and crash data). If we use analytics or advertising technologies in the app that enable tracking across apps or websites, we obtain your consent (on iOS via the App Tracking Transparency prompt).

7. Security of your personal data

We take appropriate technical and organisational security measures to protect data against unauthorised access and misuse.

8. Deletion or anonymisation of your personal data

Your personal data is deleted or anonymised as part of our standard processes where the data is no longer required for the purpose for which it was stored and where no statutory retention obligations, legitimate interests of ours (e.g. documentation and evidence purposes, disproportionate effort) or technical reasons (e.g. in the case of backups or document management systems) preclude deletion or anonymisation.

You can request the deletion of your customer account at any time in the app or in the customer portal. You can withdraw any consent given at any time with effect for the future. Personal data that we continue to require – in particular for the performance of outstanding contractual services, for compliance with statutory retention obligations (notably invoicing and accounting data), for the assertion or defence of legal claims and for safeguarding other legitimate interests – is retained for the respective necessary period and subsequently deleted or anonymised.

9. Your rights as a data subject

Within the scope of the data protection law applicable to you, and to the extent provided for therein, you have the right of access, rectification and erasure, the right to the release/portability of your personal data, the right to restriction of processing and the right to object to the processing and use of your data. Please note that we reserve the right to invoke the restrictions and rights provided for by law, for example where we are obliged to retain or process certain data, have an overriding interest in doing so (insofar as we may rely on this) or require the data for the assertion of claims. Exercising these rights generally requires that you clearly prove your identity (e.g. by means of a copy of an identity document, whereby you may redact information that is not required). To exercise your rights, you can contact us at the address given in section 1. Every data subject is furthermore entitled to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch(opens in a new tab)).

10. Applicability of the GDPR

In principle, our processing of your personal data is governed by Swiss data protection law. For individual processing activities, the EU General Data Protection Regulation ("GDPR") may additionally apply. Insofar as and for as long as the GDPR applies to certain processing activities, this section 10 applies additionally to that data processing.

In that case, we base the processing of your personal data in particular on the grounds that

  • it is necessary for the initiation, conclusion and performance of contracts and their administration and enforcement (Art. 6(1)(b) GDPR; see also section 3),

  • it is necessary to safeguard legitimate interests of ours or of third parties (including operation, security and improvement of our offerings, compliance, risk management) (Art. 6(1)(f) GDPR; see also section 3),

  • we are legally obliged or entitled to do so (Art. 6(1)(c) GDPR) or the processing serves to protect vital interests (Art. 6(1)(d) GDPR);

  • you have separately consented to the processing (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

Insofar as we base processing on your consent, you may withdraw such consent at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

The right to object to the processing of your data set out in section 3f) applies in particular to data processing for the purposes of direct marketing.

If you are not satisfied with the way we handle your rights or data protection, please let us know (see contact details in section 1). If you are located in the EEA, you also have the right to lodge a complaint with the data protection supervisory authority of your country. A list of the authorities in the EEA can be found here: https://www.edpb.europa.eu/about-edpb/our-members_en(opens in a new tab).

11. Amendments to this privacy policy

We reserve the right to amend this privacy policy at any time. We always publish the current version on our website and in our app. The version published on our website or in the app at the time of the data processing is authoritative.

12. Language versions

This Privacy Policy was originally drawn up in German. We provide translations for ease of understanding. In the event of any ambiguity, you may refer to the original German version.