This policy explains how personal data is processed when you use NEXO CPMS: the driver apps and web checkout (including versions branded for a charging operator), sign-in at login.cpms.app, the back office and this website.
This website sets no cookies and loads no third-party content.
1. Who we are
NEXO CPMS is a charge point management platform developed and operated by Etiris d.o.o., Mostar, Bosnia and Herzegovina, with an office in Zagreb, Croatia (“Etiris”, “we”).
- For the NEXO platform itself, the back-office accounts we provide and this website, Etiris d.o.o. is the controller.
- When you charge on a network run by a charging operator, the operator shown at the charger and in the app is the controller of your charging and billing data. Etiris processes that data on the operator’s behalf as a processor, and the operator’s own privacy notice applies as well.
2. Data we process
- Account: name, email address, phone number if you give it, and language.
- Sign-in with Google or Apple: the account identifier and email address from the provider, and your name: from Google your given and family name, from Apple your name, if you choose to share it. Details are on Sign-in with Google and Apple.
- Charging sessions: charger, connector and location, start and end time, energy delivered, tariff and price.
- Billing: name or company name, address, tax or VAT number and personal or company identification number for invoices, and the invoices issued.
- Payments: amounts, status and payment references returned by the payment provider. Card details are entered with Monri or Stripe and we never store full card numbers.
- Identification: RFID card identifiers and contract details when your operator issues them.
- Device: the push-notification token of the app.
- Support: the requests you send and our replies.
- Back-office users: name, email address, role and activity of operator staff using the back office.
- Technical logs: IP address, browser or app version, time and errors, recorded by our servers.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Your account, charging sessions, payments, receipts and invoices | Performance of a contract, Art. 6(1)(b) |
| Roaming, when you charge on a partner network or a partner’s customer charges on ours | Performance of a contract, Art. 6(1)(b) |
| Keeping invoices and accounting records | Legal obligation, Art. 6(1)(c) |
| Security, fraud prevention, troubleshooting and improving the service | Legitimate interests, Art. 6(1)(f) |
| Emails your charging operator sends to its customers (campaigns), sent on its behalf | The operator’s own legal basis as controller; ask the operator if you no longer want them |
4. Recipients
We share personal data only as far as each recipient needs it:
| Recipient | Purpose | Data |
|---|---|---|
| Monri | Card payments online and on POS terminals at the charger | Amount, payment reference; card details are entered directly with Monri |
| Stripe | Online card payments | Amount, payment reference; card details are entered directly with Stripe |
| Mailjet | Delivery of receipts, invoices and notification emails | Email address, name, email content |
| Firebase Cloud Messaging (Google) | Push notifications to the app | Device token, notification content |
| Google and Apple | Sign-in, only when you choose it | The sign-in request |
| Hetzner | Hosting and log archive in Germany and Finland | Platform data, as infrastructure provider |
| OCPI roaming partners | Charging on partner networks | Token or contract identifier, session data (time, energy, price, location) |
| The charging operator | Runs the network you charge on | Your charging, billing and support data for that network |
| Authorities | Where the law requires it | What the law requires |
We do not sell personal data and do not use it for advertising.
5. International transfers
Platform data is hosted in the European Union, in Hetzner data centres in Germany and Finland. Our team in Bosnia and Herzegovina and Croatia accesses it to operate and support the platform. Google, Apple and Stripe may process data outside the EU/EEA under their own safeguards, such as the European Commission’s Standard Contractual Clauses.
6. Retention
- Charging sessions, payments and invoices: as long as accounting and tax law requires.
- Account data: while the account exists. When the account is deleted, the sign-in is removed and the profile is deactivated; write to support@etiris.ai to have the remaining profile data erased.
- Technical logs: searchable for up to 30 days for security and troubleshooting, and kept in an archive for up to one year, then deleted.
7. Your rights
Under the GDPR and the personal data protection law of Bosnia and Herzegovina you can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format, and you can object to processing based on legitimate interests or withdraw consent.
Write to support@etiris.ai. For data held for a charging operator we will pass your request on or ask you to contact the operator. We answer within one month. You can also complain to the data protection authority where you live or work.
8. Security
Traffic between the apps, browsers and the platform is encrypted (HTTPS). Access to data is limited by role, and the platform is designed to keep each operator’s data separate. No system is perfectly secure; if a breach affects you, we will inform you and the authorities as the law requires.
9. Children
NEXO is not intended for anyone under 18, and we do not knowingly collect their data.
10. Changes to this policy
We may update this policy. The date at the top shows the current version; significant changes are announced in the app or by email.
11. Contact
Etiris d.o.o., Mostar, Bosnia and Herzegovina
support@etiris.ai
See also the Terms of Use and Sign-in with Google and Apple.