Jedlix Privacy Statement

This Privacy Statement describes how Jedlix B.V. (hereafter: "Jedlix") processes and uses your personal data in connection with your use of Smart Charging services ('Services') through the Polestar Energy app which is a white label application operated by Jedlix B.V. ('Jedlix App')

The concept of 'personal data' includes all information about an identified or identifiable natural person. Jedlix B.V. acts as the data controller in the meaning of the General Data Protection Regulation 2016/679 ("GDPR") and where relevant, the UK General Data Protection Regulation ("UK GDPR") for the processing of your personal data.

The purpose of this Privacy Statement is to inform you about how Jedlix processes and uses your personal data, and to inform about your privacy rights.

This Privacy Statement does not apply to processing of personal data in connection with the use of Polestar vehicle and related services such as Polestar ID, where Polestar acts as an independent data controller. Polestar has other privacy documents that should be read together with this notice for a complete picture of how your data is used in relation to the Jedlix app and related Services. Access them on the links below:

• Polestar Customer Privacy Policy
• Polestar Car Privacy Notice

This Privacy Statement is divided into the following sections.

1. The purposes and grounds of the personal data collected by Jedlix
2. Your freedom to choose your smart charging services
3. How your personal data is collected
4. Jedlix' partners
5. Retaining and deleting personal data
6. Personal data necessary for your account settings and smart charging services
7. Specific personal data necessary for generating savings on your energy bill
8. Specific personal data necessary for generating earnings in partnership with your energy supplier
9. Specific personal data necessary for generating earnings from grid balancing service providers in eligible countries
10. Security measures to protect your personal data
11. Cookies
12. Your privacy rights
13. Exercising your privacy rights
14. Contact us
15. Amendments to this Privacy Statement

1. The purposes and grounds of the personal data Collected by Jedlix

Jedlix collects and processes your personal data to deliver its smart charging services (hereafter the "Services"). The purposes of the Services are:

• To help you save money on your electricity bill by charging your electric vehicle (EV) at times when the lowest electricity tariffs apply, typically during off-peak times.
• To generate earnings from your energy supplier by charging your EV at favorable times, for example when your energy supplier benefits from lower electricity purchasing costs, or when it needs to reduce an imbalance between the electricity consumption and production of its customers.
• To generate earnings from your national or regional grid operator by charging your EV at times when there is a need to reduce an imbalance in the levels of power consumption or production, thereby ensuring the stability and security of the grid.

The legal grounds for these activities are the contract between you and Jedlix, as set out in the Terms of Use, and/or where relevant our legal obligation to process personal data, your consent or our legitimate interests to process your personal data.

More specifically, Jedlix will process your personal data to:

• Identify and verify its customers in collaboration with its automotive and energy partners.
• Calculate and implement an optimal charging plan for the EV(s) linked to your account.
• Provide proof to its energy partners of the smart charging services it delivers, thereby allowing it to claim and process any benefits.
• Calculate any smart charging benefits (both savings and earnings) and provide pay-outs for any earnings, assuming this is necessary under the terms of the contract between Jedlix and you.
• Offer customer support and answer any queries about Jedlix and Jedlix' Services.
• Improve our Services by conducting research and development on people's charging patterns and on the Services themselves.

2. Your freedom to choose your smart charging services

In the Jedlix App, you are free to choose whether you want to charge your car using Jedlix smart charging services. You are also free to choose whether you want to generate savings based solely on your energy tariffs, and/or to generate earnings through our energy partners, and/or to generate earnings by allowing us and our partners to provide balancing services to grid operators. You must provide your explicit consent for us to collect and process the necessary personal data related to each service so that we can deliver that service to you.

3. How your personal data is collected

Your personal data is either collected from you directly when you provide information manually in the Jedlix App, or it is collected indirectly, from publicly available sources, or, with your explicit consent, it is collected from our partners in the energy and automotive industries.

We ask for your explicit consent in the Jedlix App for the right to collect and share the data necessary to deliver each smart charging service. Specifically, we ask for data regarding the historic load curve of your home meter for the relevant time period, as well as data to connect your home to the balancing services perimeter of the Balancing Service Providers (BSPs) we partner with. Our usage does not go beyond the stipulations of the energy code and regulations of your country of use. In the Jedlix App, you can decide whether or not to authorize Jedlix to access the data relevant to each particular service.

4. Jedlix' partners

In delivering its Services, Jedlix partners with several companies (data processors or data sub-processors, as the case may be) to enable the technical and financial operations of the Services. The third parties to whom the personal data are made available are obliged to handle your personal data confidentially. If these parties qualify as a 'data processor' within the meaning of the applicable privacy legislation, Jedlix will ensure that a data processing agreement is concluded with these parties, which complies with the requirements included in the GDPR and/or where relevant, the UK GDPR.

An up-to-date overview of the e-mobility stakeholders we partner with can be found here. These partners are:

• Polestar Performance AB which offers the Services and the Jedlix App under the name of Polestar Energy app.
• Energy suppliers and the associated Balance Responsible Party (BRP) that your Energy Supplier uses to purchase electricity on the energy market (larger Energy Suppliers also often act as BRPs).
• Balancing Services Providers (BSPs). BSPs, also known as 'aggregators,' combine different electricity sources (large batteries, windmills, etc.) and make them available to the Transmission System Operator (TSO) or Electricity System Operator (ESO) responsible for maintaining the frequency of the high voltage energy grid in a specific country, province or state. To maintain a constant balance between the total consumption and production levels at high voltage levels, TSOs and ESOs manage open and regulated markets and mechanisms of grid balancing services. They procure flexible power capacity from BSPs to offset temporary imbalances provoked by excess consumption or production compared with the national or regional volume that they had forecasted.

Jedlix and its BSP partners work together to offer the TSO or ESO flexibility when charging your EV, allowing you to earn benefits through smart charging, even when your energy supplier is not partnered with Jedlix.

• Distribution System Operators (DSOs). DSOs are responsible for the load management and security of the energy grid in your local area. They are also responsible for managing the metering data of your home (for both your energy consumption and/or your energy production). In some countries, DSOs have developed secured data platforms that can be accessed by third-party service providers like Jedlix with the express consent of the home energy contract owner. In these cases, Jedlix uses these provisions to automatically collect the meter code for your home's meter (in some countries this is called the EAN, MPAN or PDL code). Jedlix also collects some technical data concerning your energy contract, such as the power subscription of your home, the off-peak periods applicable to your metre, and your historic electric consumption indexes. Jedlix does this to comply with national open data regulations and to enable it to develop new digital energy management services.

In order to provide its Services, Jedlix might need to transfer your personal data to a recipient in a country outside the European Economic Area which may offer a lower degree of protection of personal data than the European law offers. In that case, Jedlix will ensure that such a transfer of personal data is in accordance with the applicable laws and regulations, for example by concluding a model contract prepared and approved for that purpose by the European Commission and will assess whether any additional measures are necessary to guarantee an appropriate level of protection of your personal data. Please do not hesitate to reach out to Jedlix if you wish to receive more information about the appropriate or suitable safeguards in place for data transfers outside of the European Economic Area or if you would like to obtain a copy of them.

5. Retaining and deleting personal data

Jedlix only retains your personal data for as long as it is necessary for us to fulfil the purpose we collected it for, including for the purpose of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of the data. We also consider the potential risk of harm from any unauthorized access to or disclosure of your personal data. In all matters, we take into account the purposes for which we process your data, and we consider whether we could achieve this purpose through any other means while still meeting all the necessary legal requirements.

For example, the GPS location is only used to verify whether or not the vehicle is at your designated smart charge location and therefore stored for a very limited period.

After the termination of your use of the Jedlix App and Services (as detailed in the Terms of Use), your personal data is deleted within twelve months, unless Jedlix has been required to retain your personal data by law or by the relevant authorities. Details of your payments are kept as long as is necessary for us to comply with our legal and regulatory requirements. This is generally seven years unless the law prescribes a longer period.

6. Personal data necessary for your account settings and smart charging services

We collect the following data:

• Identity data used to identify you. This includes your first name, last name, Polestar ID, nickname, email address, and an encrypted version of your chosen password.
• Address data used to determine your smart charge location. This includes your country, address, postcode and house number.
• Profile data used to provide you with customized services. This includes the name of your energy supplier, the make and model of your EV, your charging preferences and settings in the Jedlix App, and any information you provide in response to surveys or through customer feedback.
• Polestar ID data used to establish the connection with your EV. This includes your Vehicle Identification Number (VIN), and/or your Polestar ID credentials (this data is used only once to verify your account with the car manufacturer and retrieve an access token for our Services; your credentials are never stored by us). Jedlix also processes the data required for us to access the services provided by your car manufacturer which are needed for smart charging; you must authorize us to access this data on your behalf.
• EV data used to calculate an optimal charging schedule for your EV and to monitor the performance of our smart charging Services. This includes information about your vehicle status, the state of charge of your battery, telemetry data, and information about your vehicle's GPS location. We use this to make sure that we only smart charge your EV at the location you designate in the app. We validate this by measuring your energy consumption and telemetry data. We never store data about your EV's GPS location.
• Pay-out data used to pay earnings to you directly or through our partners. This includes your initials and your last name, the IBAN for your bank account, the amount to be paid to you, information about your charging data, and your contract number with your Energy Supplier.
• Technical data used to improve our Services. This includes information about your mobile device type and Jedlix App version, time zone, country of use, browser type and version, operating system, mobile platform, and other information about the technology used by your device solely to access our Services.
• Tracking data used to improve our Services. This includes information that we or others collect about you from cookies and similar tracking technologies, such as web beacons, pixels, and mobile identifiers.
• Marketing and Communications Data used to communicate with you. This is based on your preferences for receiving marketing from us and our partners.

The processing is necessary to fulfil contract with you as part of your subscribed services as set out in the Jedlix Terms of Use (performance of the contract (GDPR, article 6.1 (b))).

We exchange the following data with Polestar:

Jedlix will receive:

• EV data as described above (i.e. data from your Polestar vehicle generated as result of the use of the Jedlix app and related Services).
• Polestar ID data used to establish the connection with your car.

Polestar will receive:

• Profile Data and charging information shared with Polestar to allow us to connect your EV to the Jedlix App. This allows us to optimize the smart charging schedule for your EV, and when necessary to investigate technical customer support issues.
• Telematic data relating to the performance, use, operation and condition of the EV from the EV and/or the Jedlix app for the purpose of product analytics and improvement, for example, to determine technical malfunctions, to analyze the performance of the EV with the Services or to offer improved Services.

The legal basis for the exchange of data is the legitimate interest in providing and improving the Services and the Jedlix App (Art. 6 (1) f) GDPR.

Jedlix and Polestar and are joint controllers for the exchange of personal data necessary for the provision and improvement of the Services and the Jedlix App under the name of Polestar Energy app. Jedlix and Polestar have agreed that Jedlix is the primary point of contact for data subjects that wish to exercise their rights and the main responsible party for providing information to data subjects with regard to the Jedlix app. You are of course entitled to exercise your rights under the GDPR in respect of and against each controller mentioned in this policy. You can read about this in Section 14 below.

7. Specific personal data necessary for generating savings on your energy bill

If you have a time-of-use/off-peak tariff with your energy supplier, regardless of whether or not it has a partnership with Jedlix in your country, then Jedlix may collect the following data:

Data that is collected if you are with a non-partnered energy supplier:

• Your kWh Tariff Information by periods of the day/week, which is usually indicated in your Energy Supplier bill, to calculate your savings and charge your EV using the lowest tariffs at off-peak times.

Data that is collected if you are with a partnered energy supplier:

• Your energy contract number used to obtain information about the kWh tariff applicable to your energy contract directly from your energy supplier.

Data that is shared:

• Energy contract number and address data if your energy supplier partnered with Jedlix. This is used to validate the existence of your energy contract and, assuming the energy contract is validated, to automatically retrieve from the relevant information systems the applicable energy tariffs and off-peak times. This prevents Jedlix from having to ask you to fill in the same information manually in the Jedlix App.

8. Specific personal data necessary for generating earnings in partnership with your energy supplier

Data that is collected:

• Your energy contract number used to obtain information about the kWh tariff applicable to your energy contract directly from your energy supplier.

Data that is shared with your energy supplier:

• Identity data, energy contract number and address data is used to validate the existence of your energy contract and to allow you to generate earnings. With your explicit consent as the energy contract owner, your energy supplier can collect data on your historical electricity consumption from your smart meter.
• Energy contract number and EV data used by your energy supplier to validate and arrange for any financial settlement with its BRP. This is also used to validate any generated earnings. It includes the energy consumption calculated from your EV's telemetry data.
• Pay-out data, in cases where the pay-out of earnings is handled by the energy supplier and the energy supplier has no access to the relevant pay-out data.

9. Specific personal data necessary for generating earnings from grid balancing service providers in eligible countries

Data that is collected:

• Electricity meter point data including the full name of the energy contract owner linked to the electricity meter point at the home charging location, as well as the electricity meter code (in different countries, this is known variously as the EAN, MPAN or PDL code).

With your explicit consent, Jedlix will also collect the following data:

• Your historical electricity consumption data for the relevant meter point. This allows your designated grid operator to cross-validate the balancing effect of smart charging your EV with information related to the grid itself.
• Your explicit consent to link your meter point to the balancing perimeters of the relevant BSP, including the right to collect from your energy supplier, your DSO or the national meter data platform whether your home electricity meter point is under a profiled or smart meter allocation. This allows the BSP to deliver grid balancing services to the regional or national grid operator, thereby allowing you to generate earnings in accordance with the code and regulations for your specific grid.

Data that is shared with the DSO, and when necessary with your energy supplier:

• Address data and electricity meter point data used to identify and validate the electricity meter point at your home charging location. This is also used to collect specific data from your meter, such as the relevant off-peak hours and your home electricity meter point allocation status (profiled or smart allocation) that need to be taken into account to deliver grid balancing services.

Data that is shared with the BSP and the TSO or DSO:

• Electricity meter point data used by the DSO or TSO to add your meter point to the relevant balancing perimeters of the BSP. This is also used to collect specific data from your meter, such as your historical electricity consumption data, and when necessary your home electricity meter point allocation status (profiled or smart allocation). This allows the relevant grid operator to cross-validate the performance of the grid balancing services and reach a financial settlement with the BSP.
• EV data used to cross-validate the performance of the grid balancing services and reach a financial settlement between Jedlix, the BSP, and the designated grid operator. This data is calculated by Jedlix on behalf of the BSP.

10. Security measures to protect your personal data

The security of your personal data is very important to us. Given the risks connected to processing personal data, we take all material, logical, administrative, and organizational steps necessary to secure your personal data. This ensures that your data is not misconstrued or damaged, and it guarantees that your data is not made available to any unauthorized third parties. These protections extend to the storage of your personal data on the secure servers issued by our provider. If you have any questions about the security of your personal data, or if you suspect or see signs of misuse, please contact us via dpo@jedlix.com.

11. Cookies

Cookies are small parts of data that are not used for identification purposes but that learn about your usage and browsing behaviour based on how you interact with the Jedlix website and the Jedlix App.

Jedlix uses several types of cookies to analyze the quality and effectiveness of our Services. We also use cookies for marketing and advertising campaigns on our own website(s) and on the website(s) of certain third parties. You will be asked to consent to these cookies when you visit our website.

12. Your privacy rights

If you have given your consent to the processing of personal data, you can withdraw your consent at any time with future effect. Such withdrawal does not affect the lawfulness of the processing prior to the withdrawal of consent (Art. 7 (3) GDPR).

Under data protection law, you have the right to: request access to your personal data (Art. 15 GDPR), request rectification of your personal data (Art. 16 GDPR), request erasure of your personal data (Art. 17 GDPR), request restriction of processing of your personal data (Art. 18 GDPR), request data portability (Art. 20 GDPR) and object to the processing of your personal data (Art. 21 GDPR).

You also have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77).

We inform you that the aforementioned rights may be limited in accordance with applicable national data protection legislation.

1. Right of access (Art. 15 GDPR):

   You may have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. That information includes – among other things – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access.

   You may have the right to receive a copy of the personal data being processed (the data; not the data carriers). For further copies requested by you, we may charge you a reasonable fee based on administrative costs.

2. Right to rectification (Art. 16 GDPR):

   You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Right to have personal data deleted (Art. 17 GDPR):

   In some cases, you have the right to have your data deleted, namely when:

   1. the data is no longer needed for the purposes for which we collected it
   2. you withdraw your consent and there is no other legal ground for the processing (if applicable)
   3. the data is used for direct marketing, and you unsubscribe from it
   4. you oppose use that is based on our legitimate interest, and we cannot show compelling grounds for the processing which override your interests and rights
   5. the personal data has been used unlawfully, or
   6. deletion is required to fulfil a legal obligation

   If we delete personal data following your request, we will also inform those we have shared your data with (when applicable) - if it is not impossible or too cumbersome. If you ask us, we will also tell you who we have shared your data with.

4. Right to restriction of processing (Art. 18 GDPR):

   Under certain circumstances, you have the right to have us restrict the processing of your personal data. In this case, the data in question will be marked and may only be processed by us for certain purposes.

5. Right to data portability (Art. 20 GDPR):

   Under certain circumstances, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit that data to another entity without hindrance from us.

6. Right to object (Art. 21 GDPR):

   Under certain circumstances, where we process information based on a legitimate interest, you may have the right to object, on grounds relating to your particular situation, to the processing of your personal data and we may be required to no longer process your personal data. Furthermore, if your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing activities. In this case, we will no longer process your personal data for such purposes.

7. Right to make arrangements for the storage and communication of data after someone's death:

   You have a right to make specific arrangements for the storage and communication of your personal data after your death, and we will act accordingly. You may also make general arrangements with a third party, who will inform us of your instructions in due course.

Jedlix does not use automated decision-making within the meaning of Article 22 GDPR

If you wish to exercise any of your rights, contact us using contact information available in Section 10 below. If you have any objections or complaints about the way we process your personal data, please let us know and we will try to help. You always have the right to lodge a complaint with the supervisory authority where you live, work or where you believe an infringement has taken place. In the Netherlands, the supervisory authority is the Dutch Data Protection Authority.

13. Exercising your privacy rights

To exercise your privacy rights, you can contact Jedlix via dpo@jedlix.com or by post using the contact details stated below.

If you live or work in the UK, you can also contact our data protection representative for the UK via jedlix@lionheartsquared.co.uk or by post via: Lionheart Squared Limited, 17 Glasshouse Studios, Fryern Court Road, Fordingbridge, Hampshire SP6 1QX United Kingdom.

In order to prevent that Jedlix discloses information to the wrong person, Jedlix can ask you for additional information to verify your identity. In principle, Jedlix will inform you of whether Jedlix can comply with your request, within one month after receipt. In specific cases, for example when it concerns a complex request, this term may be extended by two months. Jedlix will inform you of such an extension within one month after receiving your request. On the basis of the applicable privacy legislation, Jedlix can refuse your request under certain circumstances. If this is the case, we will explain to you why. You can find more information about your privacy rights on the website of the Dutch Data Protection Authority.

14. Contact Us

Jedlix BV (referred to as "Jedlix", "we", "us" and "our") is the controller who processes your personal data as described in this notice. If other entities are processing personal data together with us, as so-called joint controllers, this is mentioned explicitly.

Jedlix BV is also the primary point of contact for data subjects that wish to exercise their rights and the main responsible party for providing information to data subjects with regard to the Jedlix app. You are of course entitled to exercise your rights under the GDPR in respect of and against each controller mentioned in this policy.

Each controller's identity and contact details are listed below.

Jedlix BV, is a Dutch legal entity registered at Stationsplein 45 Unit D, 3013AK, Rotterdam ('Jedlix').

Jedlix has appointed a Data Protection Officer who can be reached via email or via post as set out below:

• e-mail address: dpo@jedlix.com
• Postal address: Jedlix B.V., Stationsplein 45, 3013 AK Rotterdam, the Netherlands. Please address your enquiry to the Data Protection Officer.

For the processing of your personal data in the context of an application for an employment (or equivalent) position at Jedlix, please refer to our Job Applicant Privacy Statement. Please note that Jedlix also offers services for developers who choose to use the Jedlix API (an application programming interface developed by Jedlix or its suppliers and made available by Jedlix on its website) to exchange personal data with the Jedlix Platform (the smart charging platform developed and operated by Jedlix). In such cases, Jedlix acts as data processor and these developers or their customers will act as the data controller of your personal data and the privacy policies of such developers or their customers will apply.

Polestar Performance AB is a Swedish legal entity with company registration number 556653-3096, with mailing address Assar Gabrielssons Väg 9, 405 31 Gothenburg, Sweden, and visiting address Polestar HQ, Assar Gabrielssons Väg 9, 418 78 Göteborg.

Polestar has appointed a Data Protection Officer for the Polestar Group who can be reached via e mail or via post as set out below:

• E-mail address: dpo@polestar.com
• Postal address: Polestar Performance AB, Attention: The Data Protection Officer, 405 31 Göteborg, Sweden

15. Amendments to this Privacy Statement

This Privacy Statement can be modified or and/or supplemented at any time. Such amendments and/or supplements may be necessary in particular due to the implementation of new technologies and/or the introduction of new services. The most recent version of this Privacy Statement will always be posted on our website and in the Jedlix App.