Personal Data Protection

1. Introduction

1.1. This document explains how OOZI s.r.o. processes personal data of customers, users of the kyuzet.com website, users of the QZ web application and persons whose data may be processed when using the QZ device and QZ Foresight service.

1.2. When processing personal data, we proceed mainly in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and applicable Slovak laws.

2. What data we process

2.1. During the order process, we process mainly:

• a) name and surname or business name,
• b) e-mail,
• c) phone number,
• d) billing address,
• e) delivery address,
• f) Company ID, tax ID, VAT ID for business customers,
• g) order details,
• h) details required for invoicing.

2.2. During payment

we process information about the payment status, amount, currency, variable symbol or transaction identifier. Full payment card details are processed by the Stripe payment gateway provider.

2.3. During activation and use of the QZ Foresight service, we process mainly:

• a) user's e-mail,
• b) device identifier,
• c) QR or activation code,
• d) vehicle details entered by the user,
• e) vehicle type,
• f) battery type and capacity, if entered,
• g) vehicle usage mode,
• h) data about the condition of the 12V battery,
• i) battery voltage,
• j) time records of measurements,
• k) movement or stationary status,
• l) approximate or precise GPS location of the device depending on technical possibilities,
• m) data about mobile signal and technical status of the device,
• n) notification tokens,
• o) language and technical user settings.

2.4. From the measured data, we may derive in particular:

• a) vehicle standing time,
• b) voltage drop trend,
• c) probability of the need to recharge the battery,
• d) status recommendation such as OK, WEAKENING, CHARGE or CRITICAL,
• e) alert history,
• f) user reactions to alerts.

2.5. When using the website and web application, we process technical data, in particular IP address, device type, browser, operating system, access time, error logs and security records.

3. Purposes and legal bases of processing

3.1. We process personal data for the following purposes:

a) processing the order, delivery of goods and performance of the contract
Legal basis: performance of the contract.

b) activation of the device and provision of the QZ Foresight service
Legal basis: performance of the contract.

c) sending operational alerts, push notifications and e-mails related to the status of the service or battery
Legal basis: performance of the contract for warning and status alerts; legitimate interest or consent for other notifications.

d) invoicing, accounting and tax obligations
Legal basis: legal obligation.

e) customer support and complaint handling
Legal basis: performance of the contract, legal obligation or legitimate interest.

f) security, prevention of misuse, error diagnostics and protection of legal claims
Legal basis: legitimate interest.

g) marketing communication to existing customers to a reasonable extent
Legal basis: legitimate interest or consent, where required. Consumers may unsubscribe at any time via the link in every marketing e-mail or at support@kyuzet.com.

h) analytics and service improvement
Legal basis: legitimate interest or consent for tools that are not technically necessary.

4. GPS location and telematics data

4.1. QZ may process vehicle location because location may be necessary for the technical operation of the service, assessment of battery context, mobile signal and the last known status of the device.

4.2. QZ is not primarily intended as a system for tracking persons. The service is intended to monitor the technical condition of the 12V battery and the related device.

4.3. If the customer uses QZ in a company vehicle used by an employee, driver, service customer or another person, the customer is obliged to ensure that such persons are properly informed and that the customer has its own legal basis for using the device.

4.4. In business use, OOZI s.r.o. may in some cases act as a processor and the business customer as a controller. Details may be governed by a separate data processing agreement.

4.5. To display the vehicle's location on a map in the web application, map tiles are loaded directly by the user's browser from CARTO (basemaps.cartocdn.com), a service that uses OpenStreetMap data. The map tile provider thereby receives the user's IP address and the coordinates of the displayed map area (the vicinity of the vehicle's location). Tiles are loaded only when the map is displayed in the application. Legal basis: legitimate interest in a clear display of the vehicle's last known location.

4.6. To display the name of the city near the vehicle's location, we use the Nominatim reverse geocoding service operated by the OpenStreetMap Foundation (nominatim.openstreetmap.org). The user's browser sends this service the user's IP address and the vehicle's location coordinates. Legal basis: legitimate interest in a clear labelling of the location.

4.6a. To determine the outside temperature and weather context at the vehicle's location we use Open-Meteo (api.open-meteo.com). An approximate area containing the vehicle is sent to that service from our server — the coordinate rounded to a grid of about 5 km, not the exact position. This happens when the battery state is evaluated, and therefore also when location watching is switched OFF — temperature directly affects the battery assessment and without it the service could not serve its purpose. No vehicle identifier and no data about you are sent, only the coordinates. Legal basis: performance of the contract (providing the battery assessment service).

4.6b. The map inside the application is also a link to Google Maps (www.google.com/maps). Tapping it opens a new tab whose address contains the vehicle's coordinates, so Google LLC receives those coordinates together with your IP address. This happens only on your own tap — merely displaying the map sends Google nothing. Google LLC is established in the USA; clause 6.3 applies to that transfer. Legal basis: legitimate interest in letting you open the position in a navigation app.

4.6c. If you have the trip overview switched on, we use Nominatim (nominatim.openstreetmap.org, operated by the OpenStreetMap Foundation) to name the places a trip started and ended at. A coordinate rounded to roughly 110 metres is sent from our server — not the exact position, no vehicle identifier and no data about you. We store the answer as municipality and street only, never a house number, and one lookup serves every trip at the same place. This happens only for trips recorded in the overview; without that add-on nothing is sent. Legal basis: performance of the contract (providing the trip overview).

4.7. Vehicle location is retained for no longer than 30 days if location watching is switched on for the vehicle, otherwise for no longer than 3 days; after that the coordinates are removed automatically. If you withdraw consent we remove them without undue delay. Clauses 7.4 to 7.4.3 set out the details and the exception.

5. Automated evaluation

5.1. The QZ Foresight service evaluates technical data from the device and creates recommendations regarding the condition of the 12V battery. Evaluation is performed using fixed pre-defined rules — the service does not use machine learning to decide on battery condition.

5.2. The evaluation is used for informational and preventive alerts. It is not decision-making that would have legal effects on the user or similarly significantly affect the user within the meaning of Article 22 GDPR.

6. To whom we provide data

6.1. We may disclose personal data only to the necessary extent to the following categories of recipients:

• a) payment gateway provider,
• b) hosting and cloud infrastructure provider,
• c) e-mail communication provider,
• d) notification service provider,
• e) mobile IoT connectivity provider,
• f) error monitoring provider,
• g) accountant or tax advisor,
• h) carrier,
• i) public authorities, if required by law.

6.2. We may currently use mainly:

• a) Stripe — payment gateway,
• b) Hetzner — hosting and server infrastructure,
• c) Resend or another transactional e-mail provider,
• d) Sentry or another error monitoring tool,
• e) Backblaze or another backup provider,
• f) 1Global / 1NCE or another IoT connectivity provider.

6.3. For providers outside the EU/EEA, we use appropriate safeguards under GDPR, in particular standard contractual clauses or another valid transfer mechanism.

6.4. Some elements of the website and the application are loaded directly by the user's browser from third-party servers: the Google Fonts typeface (fonts.googleapis.com, fonts.gstatic.com) and the error-monitoring tool Sentry (browser.sentry-cdn.com, ingest.de.sentry.io). Such a load gives the provider concerned the user's IP address and technical data about the browser; in Sentry's case also data about the error that occurred and the steps that preceded it. Google LLC is established in the USA — clause 6.3 applies to that transfer. Legal basis: legitimate interest in a consistent appearance of the service and in its stability and security. Map tiles and geocoding are described in clauses 4.5 and 4.6.

7. How long we retain data

7.1. Order and invoicing data are retained for the period required by accounting and tax regulations.

7.2. Data required to provide the QZ Foresight service are retained during the service period and for a reasonable time after its termination, in particular for complaint handling, security and legal claims.

7.3. Measured technical data about the battery and the evaluations derived from it are retained during the service period and subsequently for no longer than 12 months, unless longer retention is necessary for complaint handling, a security incident or a legal claim.

7.4. How long vehicle location data is retained depends on whether location watching is switched on for that vehicle. If it is, we retain it for no longer than 30 days — watching is only meaningful if, after an alert about movement or towing, you can find out where the vehicle went. If it is not, we retain it for no longer than 3 days; that is the technical period needed to diagnose an incident while it is still open. After the applicable period the coordinates are removed automatically, including from the raw record received from the device.

7.4.1. If you withdraw location consent, we remove that vehicle's stored positions without undue delay — we do not wait for the period under clause 7.4 to elapse. In the application, withdrawal is available in the same place as switching it on.

7.4.2. If location watching is not switched on — or you withdraw it — we retain no position of the vehicle at all, not even the last known one. It is removed automatically. What remains for assessing the battery is only the approximate area under clause 4.6a (a coordinate rounded to a grid of roughly 5 km), from which we obtain the outside temperature; frost directly changes what we tell you about the battery. While watching is on we retain the last known position and you can see it in the app; it is removed when the vehicle is ended or archived.

7.4.3. Vehicle speed (without coordinates, heading or altitude) is retained for no longer than 30 days regardless of location watching. It is the basis for recognising a drive, which feeds the battery assessment; speed alone, without coordinates, does not establish where the vehicle was. Measured battery data is unaffected by anything in clauses 7.4 to 7.4.3 and is retained under clause 7.3.

7.5. Database backups are kept for 30 days. Data removed under clauses 7.3 or 7.4 may therefore still be present in a backup for that period. Backups are encrypted, serve solely to restore the service after a failure, and are accessible only to the controller.

7.6. Notification tokens are retained during the use of the service or until deactivation.

7.7. Technical logs are retained only for the time necessary for security, diagnostics and service stability.

8. Rights of the data subject

8.1. The data subject has the right:

• a) to access personal data,
• b) to rectification,
• c) to erasure,
• d) to restriction of processing,
• e) to data portability,
• f) to object to processing,
• g) to withdraw consent, if processing is based on consent,
• h) to lodge a complaint with the supervisory authority.

8.2. You may exercise your rights by e-mail at support@kyuzet.com.

8.3. The supervisory authority is:

9. Cookies

9.1. The website may use technically necessary cookies required for website operation, language settings, security and login.

9.2. Analytical or marketing cookies are used only if consent is required and the user has granted it.

9.3. Details about cookies may be provided in a separate cookie setting or cookie banner.

10. Security

10.1. We adopt appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure.

10.2. Access to data is granted only to authorised persons and providers who need it to perform their tasks.

11. Changes to this document

11.1. We may update this document, in particular if the service, technical providers or legal requirements change.

11.2. The current version is always available on kyuzet.com.