Privacy Policy

This privacy policy applies to all personal data processed by Joulo, through www.joulo.nl or other related channels. It applies to everyone who visits our website or has been in contact with us • from a first website visit to active customers collecting ERE credits through Joulo.

Personal data is any data that can be traced back to you as an individual, such as your name, phone number, IP address, customer number or browsing behaviour. For more information, visit the website of the Dutch Data Protection Authority.

Joulo B.V. is responsible for the website www.joulo.nl and is therefore the organisation responsible for the use of your personal data as described in this privacy policy.

We process the personal data of everyone who has been in contact with us or visited our website. This includes visitors, customers and contacts of our partners.

We receive your data directly from you when you:

• visit our website
• create an account on our platform
• connect your charger or kWh meter to Joulo
• enter information on our website
• contact us via email, phone or other means
• give consent for use of your data through one of our partners

Below is a breakdown per category of the data we process and why:

We do not process special categories of personal data, such as data about health, religion or ethnicity.

We only process your personal data when the GDPR provides a legal basis for it. Per purpose:

• Performance of the contract (art. 6(1)(b) GDPR): your account, the connection with your charging station, the registration of EREs with the NEa and paying out your earnings
• Legal obligation (art. 6(1)(c) GDPR): our administration and retention duties towards, among others, the Dutch tax authority and the NEa
• Legitimate interest (art. 6(1)(f) GDPR): securing our platform, preventing misuse and improving our services
• Consent (art. 6(1)(a) GDPR): newsletters and analytics and marketing cookies. Withdrawing consent is always as easy as giving it

We keep your personal data as long as legally required and as long as necessary for the purpose for which it is used. As long as you are a customer, we keep your data in accordance with the legal retention period of seven years. Data about submitted ERE registrations is kept for as long as the NEa requires; we cannot delete it earlier.

After that, we only keep your data for statistical purposes and to handle any complaints or legal matters. Contact us for more information on specific retention periods.

We only share your personal data when necessary for our services or when legally required. Specifically:

• IT providers that run our platform: hosting and security (Cloudflare), database and login (Supabase) and email delivery (Resend)
• The Dutch Emissions Authority (NEa), for the registration of your EREs
• The partner through whom you signed up (for example an installer or energy company): they can see that you became a customer and the data needed to settle the partner fee
• Competent authorities, when we are legally obliged to do so

We sign data processing agreements (art. 28 GDPR) with providers that process data on our behalf. We never sell your data to third parties.

We store your data within the European Economic Area (EEA). Some providers process data (partly) outside the EEA, for example when sending email or • after your consent • for analytics and marketing cookies from US companies such as Google and Meta.

In those cases we ensure appropriate safeguards under Chapter V of the GDPR, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We take the security of your data seriously. A few concrete measures:

• All connections to our platform are encrypted (https)
• Sensitive data such as your IBAN and integration keys is stored encrypted in a separate digital vault
• Access to data is strictly separated per account at database level
• Meter photos are kept in restricted storage and can only be opened via secure links that expire
• We log and monitor our platform to detect misuse early

Only authorised personnel have access to your data. When we work with external parties, they are contractually obliged to treat your data with the same care. Suspect misuse? Report it to us immediately via info@joulo.nl.

This privacy policy complies with:

• The General Data Protection Regulation (GDPR)
• Applicable Dutch privacy legislation

We use three types of cookies. Only the necessary ones are always placed; the rest only after you have given consent via the cookie banner.

You can change your choice at any time via "Cookie settings" at the bottom of every page.

We may update this privacy policy, for example when our services or legislation change. The current version is always available on this page, with the date of the last update at the top.

Can't find your question or want to know more? We'd love to hear from you:

• Email: privacy@joulo.nl
• Website: www.joulo.nl

We're happy to help.