Privacy Policy

This privacy policy applies to all personal data processed by Joulo, through www.joulo.nl or other related channels. It applies to everyone who visits our website or has been in contact with us • from a first website visit to active customers collecting ERE's through Joulo.

Personal data is any data that can be traced back to you as an individual, such as your name, phone number, IP address, customer number or browsing behaviour. For more information, visit the website of the Dutch Data Protection Authority.

Joulo B.V. is responsible for the website www.joulo.nl and is therefore the organisation responsible for the use of your personal data as described in this privacy policy.

We process the personal data of everyone who has been in contact with us or visited our website. This includes visitors, customers and contacts of our partners.

We receive your data directly from you when you:

• visit our website
• create an account on our platform
• connect your charger or kWh meter to Joulo
• enter information on our website
• contact us via email, phone or other means
• give consent for use of your data through one of our partners

We take data about your address from a public register ourselves: the Basisregistratie Adressen en Gebouwen (BAG) of the Kadaster, via PDOK. It covers the home and the building at the address of your connection: the construction year, the intended use, the floor area, the status and the number of homes in the building. We use it to check your statement on whether you already lived at this address on 1 January, and whether the connection belongs to a home, a business or an owners' association. If you request a quote, we take the same data for the address of your request, so the installer knows what to expect on site. The Joulo Assistant also receives it, so it can answer a question about your home, for example whether you need your owners' association's consent for a charging station. We never use it to estimate your income, the value of your home or your consumption. We do not keep the outline of the building. From CBS (Statistics Netherlands) we take the share of rented and owner-occupied homes in your postcode. That is a figure about the postcode, not about your home.

Below is a breakdown per category of the data we process and why:

We do not process special categories of personal data, such as data about health, religion or ethnicity.

We only process your personal data when the GDPR provides a legal basis for it. Per purpose:

• Performance of the contract (art. 6(1)(b) GDPR): your account, the connection with your charging station, the registration of ERE's with the NEa and paying out your earnings
• Your request (art. 6(1)(b) GDPR): passing your quote request on to an installer, with the data about the home and the building from the BAG, so the installer knows what to expect on site
• Performance of the contract (art. 6(1)(b) GDPR): answering your questions, also through the Joulo Assistant. It receives the data from your account that the answer needs, including the BAG data of your home
• Legal obligation (art. 6(1)(c) GDPR): our administration and retention duties towards, among others, the Dutch tax authority and the NEa
• Legal obligation (art. 6(1)(c) GDPR): evidence for the NEa that your charger stands at the address of your connection. For that we use connection data of your charger and, when you confirm the address of your charger, the location you share. We already have your address through your connection. The location only confirms that your charger stands there
• Legitimate interest (art. 6(1)(f) GDPR): securing our platform, preventing misuse and improving our services
• Consent (art. 6(1)(a) GDPR): newsletters and analytics and marketing cookies. Withdrawing consent is always as easy as giving it

In addition, we may use data that we have anonymised or aggregated • so that no individual customer can be identified from it • for research, product development, benchmarking and communication about our service, such as anonymised statistics about charging behaviour. Such data is no longer personal data.

We keep your personal data as long as legally required and as long as necessary for the purpose for which it is used. As long as you are a customer, we keep your data in accordance with the legal retention period of seven years. Data about submitted ERE registrations is kept for at least five years from the calendar year of registration (Dutch Energy for Transport Regulation) and for as long as the NEa requires; we cannot delete it earlier.

An installer sees your contact details until 12 months after your quote request is closed, or until you close your account.

We keep the location you share for at least five years after the year you share it, like the bookings it backs. As long as your charger is active, we keep the latest successful confirmation. We keep connection data of your charger for as long as your charger is connected to us. Only a small number of Joulo staff with the highest admin rights can see this data.

After that, we only keep your data for statistical purposes and to handle any complaints or legal matters. Contact us for more information on specific retention periods.

We only share your personal data when necessary for our services or when legally required. Specifically:

• IT providers that run our platform: hosting and security (Cloudflare), database and login (Supabase) and email delivery (Resend)
• Kapso, when you send us a WhatsApp message: Kapso sends and stores those messages on our behalf and passes them to WhatsApp (Meta)
• Trustpilot A/S (Denmark), for one invitation to write a review: after your charging station is connected and your first charging sessions have come in, we pass your email address and first name to Trustpilot, which sends the invitation on our behalf. Legal basis: our legitimate interest in showing what customers think of Joulo. You can opt out through the link in that invitation or through the unsubscribe link in our own email; we then do not pass on your data. If you write a review, Trustpilot is the controller for it
• A measurement service that retrieves and standardises the metering data of your energy connection on our behalf (Homewise B.V.), so we can use it for ERE registration
• Google, when you upload a photo as evidence of your MID meter: an AI model from Google (Gemini) reads the type label on that photo, so we see faster which charging station you have. We send only the photo. Your name and email address are not included, and we remove the location data from the photo. A Joulo employee always checks it and makes the decision
• Google, when you sign up as a business or VvE: Gemini reads the KvK extract you upload, so we see whether the signatory may represent the organisation. That extract holds public data from the Dutch business register. We do not pass on your energy contract: we search it ourselves, for the EAN code only
• Google, when you upload a power of attorney because you are not listed as a director on the KvK extract: Gemini reads that document, as a pdf or photo, so we see who gives you the authority and for what. We ask the model not to transcribe dates of birth, addresses, citizen service numbers, bank account numbers or signatures. A Joulo employee always checks it and makes the decision
• Apple, when you install the iOS app: the app asks Apple whether you came to us through an ad in the App Store (Apple Ads). For that, the app sends Apple a one-time code that your iPhone creates. If you came through an ad, we store which campaign and which keyword it was. Once you sign in, we link that to your account. If you did not come through an ad, we store nothing. Your name and email address do not go to Apple. Legal basis: our legitimate interest in knowing which ads bring in new customers. You can object at any time via privacy@joulo.nl; we then delete the link
• Google, when you ask the Joulo Assistant a question: an AI model from Google (Gemini) writes the answer. It receives your question and the data from your account that the answer needs, such as your charging sessions, your household and the BAG data of your home
• The Dutch Emissions Authority (NEa), for the registration of your ERE's
• The independent verifier that checks our bookings, when it asks for evidence: for example that your charger stands at the address of your connection
• The installer who takes on your quote request: your name, address, email address, phone number and notes, and from the BAG the type of home, the number of homes in the building, the construction year and the floor area, only for your request. The installer is the controller for that use
• The partner through whom you signed up (for example an installer or energy company): they can see that you became a customer and the data needed to settle the partner fee
• Your installer, if you came to Joulo through an installer or chose one through a quote request: by default they see a customer number, your postcode and town, the status of your registration, and for your charging station the brand, model, serial number, firmware, whether it is online and whether it works properly. That lets them help you when your charging station fails. They see your name and address only if they registered you themselves and you agreed to that when claiming your account, or if you choose full sharing in your account. They see your charging sessions and kWh only with full sharing. They never see amounts. In your account you can also make yourself invisible to your partner: then only your customer number, postcode and town and the status remain, which we need to settle with the partner. Legal basis: our legitimate interest in working with partners (art. 6(1)(f) GDPR)
• The energy company you choose in your account, if it is a Joulo partner: it sees, per connection (EAN code), the status of your registration, how many ERE's you build up and your expected and received payout per quarter. Your name, address, IBAN and charging sessions are not included. Legal basis: our legitimate interest, so your energy company can show you your ERE's, for example in its own app. You turn this off in your account, under your energy supplier. After that the energy company no longer receives this data
• Competent authorities, when we are legally obliged to do so

We sign data processing agreements (art. 28 GDPR) with providers that process data on our behalf. We never sell your data to third parties.

We store your data within the European Economic Area (EEA). Some providers process data (partly) outside the EEA, for example when sending email, for WhatsApp messages you send us, when Google reads an evidence photo, KvK extract or power of attorney or the Joulo Assistant answers your question, or • after your consent • for analytics and marketing cookies from US companies such as Google and Meta.

In those cases we ensure appropriate safeguards under Chapter V of the GDPR, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We take the security of your data seriously. A few concrete measures:

• All connections to our platform are encrypted (https)
• Sensitive data such as your IBAN and integration keys is stored encrypted in a separate digital vault
• Access to data is strictly separated per account at database level
• Meter photos are kept in restricted storage and can only be opened via secure links that expire
• We log and monitor our platform to detect misuse early

Only authorised personnel have access to your data. When we work with external parties, they are contractually obliged to treat your data with the same care. Suspect misuse? Report it to us immediately via info@joulo.nl.

This privacy policy complies with:

• The General Data Protection Regulation (GDPR)
• Applicable Dutch privacy legislation

We use three types of cookies. Only the necessary ones are always placed; the rest only after you have given consent via the cookie banner.

You switch analytics and marketing on or off separately. Your choice holds for twelve months, after which we ask again. You can change it at any time via "Cookie settings" at the bottom of every page.

We may update this privacy policy, for example when our services or legislation change. The current version is always available on this page, with the date of the last update at the top.

Can't find your question or want to know more? We'd love to hear from you:

• Email: privacy@joulo.nl
• Website: www.joulo.nl

We're happy to help.