Privacy

1. Controller

siebenberge gmbh, Toggenburgerstrasse 29, CH-9652 Neu St. Johann, Switzerland. Email: info@ladehase.com. Data protection contact: Ivan Louis.

This policy applies to the website www.ladehase.com, the dashboard dashboard.ladehase.com, the API and MCP server at api.ladehase.com, the payment pages at the instance addresses *.ladehase.com and the terminal app. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Data we process

2.1 Website

When you visit the website, our hosting provider's servers process technical data: IP address, time, page requested, browser and operating system. This data is used for delivery and security and is deleted after 30 days at the latest.

2.2 Forms

If you send us an enquiry or sign up for a notification (for example when a manufacturer becomes available), we store your details (name, email address, message, topic, language) and the time. We use them only for the answer or the requested message.

2.3 Account and dashboard (operators)

For an account we process name, email address, password (hashed) or passkeys, organisation details (name, address, VAT number), locations, charging stations, tariffs, team members and roles, as well as logs of logins and changes. Credentials for manufacturer accounts and payment partners are stored encrypted. We do not store passwords of manufacturer accounts where token-based login is possible.

2.4 Charging sessions and payments (drivers)

For each session we store the charge point, start and end time, meter readings and energy, tariff, amounts, status and stop reason. For the payment we store amount, status, the payment partner's reference and the type of payment method. If you enter an email address for the receipt, we store it. Full card data is processed exclusively by zahls.ch or Freika and never touches our systems.

2.5 Access grants

When operators create access grants (for example for residents), we process name, optionally email address, the RFID card identifier or personal link, and the related sessions and monthly statements.

3. Purposes and legal bases

• Performance of the contract (account, charging, payment, receipt, billing, support).
• Legal obligations (accounting, retention).
• Legitimate interests (security, abuse prevention, improving our services).
• Your consent (for example notifications), revocable at any time.

4. Recipients

We share data only as far as needed for the service, with:

• zahls.ch and Freika, services of siebenberge gmbh, Switzerland: processing payments through the operator's account.
• Manufacturers of charging stations (for example Easee AS, Norway): controlling the station through the manufacturer cloud. Only device data and commands are transmitted, no driver data.
• Vercel Inc., USA (servers in the EU): hosting of website, dashboard and payment page.
• Railway Corp., USA (servers in the EU): database, API and background jobs.
• Cloudflare Inc.: DNS and protection against attacks.
• Email delivery through a Swiss or European provider for receipts, statements and notifications.
• Google LLC: Google Analytics 4 on the website, only if enabled, with truncated IP address and without advertising features (see section 6).

For recipients outside Switzerland and the EEA we ensure an adequate level of data protection, in particular through standard contractual clauses and certification under the Swiss-U.S. Data Privacy Framework.

5. Processing on behalf

We process data of drivers and access grants on behalf of the operator of the respective charging station, who is the controller for this data. Our data processing agreement applies between us.

6. Cookies and analytics

The website uses only technically necessary cookies (for example language, appearance). If enabled, we measure reach with Google Analytics 4 with truncated IP address. Google Signals and advertising features are disabled. You can prevent measurement with a browser add-on. Dashboard and payment page use cookies or local storage for login and the charging flow and do not work without them.

7. Retention

We keep account data until the account is deleted, session, payment and billing data for ten years according to statutory retention periods, form enquiries for twelve months and technical logs for 30 days.

8. Security

Encrypted transmission (TLS), encrypted storage of credentials (AES-256-GCM), two-factor login and passkeys, roles and logging in the dashboard, strict separation of organisations in the database, data centres in Switzerland and the EU.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection as provided by law. Write to info@ladehase.com. If your question concerns a charging session, we forward it to the operator where necessary. You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

10. Changes

We update this policy when our services or the law change. The version published on the website applies.