Privacy Policy
Last updated: September 2026 · Mobyfinder / MoOngy S.A.
Who We Are
MobyFinder, a product owned by MoOngy S.A., is an innovative electric mobility support application, initially designed for Android Automotive, with plans for future expansion to Android, Android Auto, iOS and Apple CarPlay. This application transforms the way electric vehicle drivers interact with charging points, offering detailed information on their location, features, pricing and availability.
Through an intuitive interface, users can access key data, including the vehicle’s maximum charging power and the desired charging profile in terms of battery percentage, while also taking into account the associated costs, incorporating the tariffs of Charging Point Operators and Electricity Retailers for Electric Mobility (CEME), as well as Grid Access Tariffs. This functionality ensures that drivers receive up-to-date information tailored to their charging needs.
As the protection of the privacy and personal data of everyone who interacts with MoOngy S.A. is a concern and a priority for us, this privacy policy has been prepared accordingly, so that the good practices relating to this process can be conveyed in a clear and transparent manner.
Any and all personal data provided will be processed with the guarantee of security and confidentiality required by the legal framework on the protection of personal data.
Framework
This policy sets out a set of guidelines, rules and principles to be observed by MoOngy S.A. in order to ensure the protection of the rights of data subjects.
MoOngy S.A. undertakes to comply with this policy in accordance with the obligations laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR”).
Accordingly, MoOngy S.A. seeks to ensure that its internal procedures comply with the legal obligations of the GDPR and that the personal data of its employees, customers, suppliers or service providers, and of any other data subjects whose personal data MoOngy S.A. processes in the course of its business, are processed in accordance with the regulatory and legal rules in force and are kept securely.
Data Controller
Moongy, S.A., with registered office at Rua Sousa Martins, nº10, Lisbon, registered with the Lisbon Commercial Registry Office under the registration and tax identification number 507 431 073, is the entity responsible for the processing of personal data (data controller) and undertakes to implement the necessary technical and organisational measures, taking into account all aspects that may affect compliance with the General Data Protection Regulation (hereinafter the “GDPR”), in order to safeguard the Fundamental Rights of Data Subjects.
To this end, Moongy, S.A. has several technological measures in place (“privacy-enhancing technologies”), which we constantly seek to update, with employees specifically assigned to this purpose, demonstrating our concern for and commitment to the Data Subject. In addition, we keep a record of the nature, scope, context and purposes of the processing of the data collected, which allows us to ensure and demonstrate that processing is carried out in a manner that guarantees full Protection of Data Subjects, as a commitment that evidences our accountability.
Contacts:
📮 Postal address: Rua Sousa Martins, nº10, Lisboa, 1050-218 Lisboa, Portugal
📞 Telephone: +351 21 313 7680
✉️ E-mail: gdpr@moongy.pt
Application and Scope
This Privacy Policy also applies to the respective employees, processors, joint controllers, suppliers, customers and users of the MobyFinder Application.
For the purposes of this Privacy Policy, each company with its own tax identification number belonging to the Moongy, S.A. Business Group has its own independent and autonomous Privacy Policy. Accordingly, for the purposes of Controllership, each Company (and its assets) belonging to this Business Group is independent, and none of these entities is responsible for the acts or omissions of the other group entities as regards Data Protection.
Global Projects Department
Among other responsibilities, this department, which is kept informed and is always involved, properly and in a timely manner, in all matters relating to the protection of personal data, must always take into account the risks associated with processing operations, such as their nature, scope, context and purposes. It must also ensure compliance with all established processes aimed at preserving the confidentiality of the data.
This department is the point of contact for requests to exercise data subject rights, notifications of personal data breaches and other GDPR-related communications.
Contacts:
✉️ Global Projects Department: gdpr@moongy.pt
Your Personal Data
6.1 What is personal data?
Personal Data means any information relating to an identified or identifiable natural person (Data Subject), excluding data relating to legal persons. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, etc.
Or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
6.2 What data do we need to collect?
The personal data collected are strictly those that are necessary and are limited to the purposes for which they are intended, which are specified, explicit and legitimate, and are kept only for the period strictly necessary for those purposes. Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
To carry out its business activity and as the entity responsible for the collection, Moongy, S.A. needs to collect and process the following data:
| Data category | Information to be collected |
|---|---|
| MobyFinder Application Data | E-mail; Location (access permission); Virtual queue participation data (charging point and position in the queue); Device identifier for sending push notifications, if authorised by the user |
Privacy Notice: the Application stores the e-mail address in its database and, while the user remains in a virtual queue, the data necessary to manage the queue and send push notifications. No information relating to the data subject’s location will be stored.
6.3 What is the purpose of processing?
| Data category | Purpose of processing |
|---|---|
| MobyFinder Application Data | They are used for:
|
6.4 What is the legal basis for processing?
The purposes of processing personal data are determined by the performance of the various types of formal legal contracts required to carry out the company’s business, including:
- the performance of the service agreements we have with our customers;
- the employment contracts we have with our employees;
- the management of internal customer and employee processes;
- accounting, tax and administrative management;
- litigation management;
- physical security control and compliance with legal obligations.
Under the GDPR, we are duly entitled to process data on the following lawful bases:
- Performance of a contract or pre-contractual steps — Processing is necessary for the conclusion, performance and management of contracts to which the data subject is party, or at the request of the data subject.
- Compliance with a Legal Obligation — For compliance with a legal obligation to which the company is subject. For example, the reporting of tax data.
- Pursuit of a legitimate interest, such as providing an improved experience. Moongy, S.A. carries out a duly recorded balancing test to safeguard the legitimacy of the processing.
- Consent — Whenever the lawful bases listed above do not apply, Moongy, S.A. requests the Data Subject’s Consent. Consent is a freely given, specific, informed and explicit indication of wishes by means of a statement or clear affirmative (and written) action by which the Data Subject authorises the Processing.
Consent may be withdrawn at any time by sending a simple request to the following e-mail address: gdpr@moongy.pt.
The personal data we collect will be processed and kept in accordance with the purposes and for the minimum period required by law.
In the case of the MobyFinder Application, account data, location data and virtual queue participation data are processed for the performance of the Application’s Terms and Conditions. The sending of push notifications depends on the user’s permission, which may be withdrawn at any time in the system settings.
To whom may we disclose the data?
Within the scope of its core activities, Moongy, S.A. may disclose the data collected in order to fulfil the purposes set out in this policy. Only the data strictly necessary for the performance of the service will be provided to the entities of the Moongy, S.A. network, on the basis of the performance of a contractual obligation (for example, any obligation to be fulfilled under the ordinary terms of the service). Data may also, to the extent necessary, be disclosed to public authorities whenever required by law, and may be processed by processors engaged by the company (for example, internal and external auditors who enable us to maintain and improve the quality of the service).
Accordingly, the full scope of this policy extends to processing carried out by third parties and processors, taking into account:
- Compliance of the processing with the GDPR and this privacy policy, and lawful, fair and transparent processing;
- The data collected are merely instrumental to our business and are intended to pursue a specified, explicit and legitimate purpose; no further processing incompatible with those purposes may take place;
- The data collected will be strictly those necessary for the purpose, being adequate, relevant and necessary for the purposes of the processing, in line with the principle of data minimisation;
- The data will be kept accurate and up to date in order to ensure the principle of accuracy and to guarantee their integrity and confidentiality;
- Also with regard to integrity and confidentiality, there may be no unlawful or unauthorised processing, and all appropriate technical and organisational measures are adopted to prevent any loss, destruction of or damage to the data;
- The retention of the Data Subject’s data is a concern for Moongy, S.A., and therefore the data will be kept in identifiable form solely and exclusively for the period necessary for the purposes for which they are processed.
How we design new products
Whenever a new product is developed, it is ensured at the design stage itself (as a primary consideration) that it incorporates the most advanced technical and organisational measures available to Moongy S.A. (taking into account the risks arising from the processing to the rights and freedoms of data subjects, as well as the risks of varying likelihood and severity arising from the processing to the rights and freedoms of natural persons), while keeping privacy as a cornerstone throughout the entire processing. This ensures that all the Principles laid down in the GDPR are applied by design, protecting Data Subjects and safeguarding their rights.
In short, Moongy, S.A. undertakes to implement privacy and keep it present during the product development stage and throughout the processing, in order to ensure data protection from the very design of the product (“Privacy by Design”).
How long do we keep the data
The data will be kept strictly for the period necessary for the purposes for which they are intended and for which they are processed in connection with the application’s activity. Account data are kept while the account is active and are deleted following a request for account deletion, without prejudice to legal retention obligations.
Your Rights
10.1 Data subject rights
The Data Subject has the following rights, which may be exercised easily and free of charge by e-mail to: gdpr@moongy.pt
A fee may be charged for the exercise of these rights only in the case of manifestly unfounded or excessive requests (under Article 12(5) of the GDPR).
10.2 Right to Object
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.
In this case, the controller shall cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
10.3 Right of access
The data subject has the right to obtain confirmation as to whether or not their data are being processed and, where that is the case, the right to access their personal data and to be provided with the following information:
- The purpose of the processing;
- The categories of data to be processed;
- The recipients to whom the data will be disclosed;
- The envisaged retention period or, if that is not possible, the criteria used to determine that period;
- The existence of the right to request rectification, erasure, restriction of processing or to object to processing;
- The safeguards and destination relating to the transfer of data to third countries;
- The right to lodge a complaint with the supervisory authority.
The data subject also has the right to obtain a copy of the personal data undergoing processing.
10.4 Right to rectification
The data subject has the right to request and obtain the rectification of inaccurate data and to have incomplete personal data completed without undue delay.
10.5 Right to erasure / to be forgotten
The data subject has the right to request the erasure of their personal data without undue delay whenever the data are no longer necessary for the purpose for which they were collected or processed. The data subject may also withdraw consent to the processing of their personal data whenever they wish to exercise the right to object to such processing.
There are some exceptions to this right, such as where erasure would conflict with the exercise of the right of freedom of expression and information, or where the data are necessary for compliance with legal obligations, for reasons of public interest or public health, for archiving purposes in the public interest, for scientific or historical research or statistical purposes, or for the establishment, exercise or defence of legal claims. In such cases, the data subject should be informed of the reason why their request cannot be met.
10.6 Right to restriction of processing
The data subject has the right to limit/restrict the processing of their personal data where one of the following applies:
- The accuracy of the data is contested, for a period enabling their accuracy to be verified;
- The processing is unlawful, but the data subject opposes the erasure of the data and requests only the restriction of their use;
- The controller no longer needs the data for the purposes of processing, but the data are required by the data subject for the establishment, exercise or defence of legal claims;
- The data subject has at any time objected to the processing and the processing has not ceased (i) on compelling legitimate grounds presented by the controller or (ii) for the establishment, exercise or defence of legal claims.
In the situations listed above, the data subject may request the suspension of processing or the restriction of the scope of processing to certain categories of data (e.g. only full name and address) or even to specific processing purposes.
10.7 Right to notification
Whenever the data subject requests the rectification, erasure or restriction of processing of their data, the controller shall inform them that it has acted on the request, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject so requests.
10.8 Right to data portability
The data subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format, without Moongy S.A. being able to object, under Article 20(1) of the GDPR, where:
- the processing is based on a contract or on the data subject’s consent; and
- the processing is carried out by automated means.
10.9 How can I exercise my rights?
To exercise any of these rights or for any questions regarding the processing of their personal data, the data subject should send a request to the controller at the following e-mail address: gdpr@moongy.pt
Although these rights are explained to the data subject when their personal data are collected, in case of any doubt the data subject may contact the controller by e-mail at gdpr@moongy.pt
Responsibilities
11.1 How do we protect your data?
Moongy, S.A. has been working to maintain and preserve personal data with a high level of security. In compliance with the principles of security, confidentiality and privacy, we ensure that your data are processed only by authorised persons, with only those who are entitled to do so accessing and processing your data, always in a strictly confidential manner. We have adopted the “need-to-know” principle, under which employees may only access personal data where strictly necessary for the performance of their duties. Any processing outside this scope is prohibited and subject to disciplinary sanctions, in accordance with our internal security and confidentiality policies and procedures, which are updated periodically as needed.
Taking into account the nature, scope, context and purposes of the processing, as well as the risks arising from the processing to the rights and freedoms of the data subject, we implement, both at the time of determining the means of processing and at the time of the processing itself, the necessary and appropriate technical and organisational measures to protect the data.
Employees are not permitted to use personal data for private or economic purposes, to disclose them to unauthorised third parties and/or to allow access to them in any other way.
Moongy, S.A. further undertakes to ensure that, by default, only personal data which are relevant, necessary and adequate for each specific purpose of the processing are processed, and that such data are not made accessible without human intervention to an indefinite number of persons.
Although this is not envisaged, should personal data be transferred to countries outside the European Union, the applicable legal provisions will be observed, namely regarding the determination of the adequacy of that country in terms of data protection and the requirements applicable to such transfers.
Security measures have also been defined, ranging from good practices to the prevention of external threats. These are described in the security policy. If you wish to access it, you may request a copy by e-mail to gdpr@moongy.pt
11.2 Global Projects Department (GPD)
The GPD is responsible for:
- Acting on behalf of the controller with regard to all duties and obligations laid down in the GDPR;
- Monitoring and controlling, properly and in a timely manner, the compliance of processes with the GDPR and with the policies implemented;
- Ensuring that it has all the resources necessary to perform its duties;
- Acting as the point of contact for requests from data subjects regarding the processing of their personal data and the exercise of their rights;
- Carrying out a data protection impact assessment where a certain type of processing so requires.
Personal Data Breach
A personal data breach means any act that compromises the security of personal data, accidentally or unlawfully, leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
We reiterate that Moongy, S.A. has been working to maintain and preserve personal data with a high level of security, with technical staff dedicated solely to this mission within the company. However, minor deviations may always occur. If any of our candidates, employees, customers, processors or even third parties detect or suspect a possible data breach, they should immediately send an e-mail to gdpr@moongy.pt, describing what happened and identifying the data that may be affected. This will allow the responsible department to act quickly and appropriately in accordance with the rules laid down in the Regulation.
In the event of a data breach, and insofar as such breach is likely to result in a high risk to the rights and freedoms of customers, employees and other staff and/or partners, we undertake to notify the breach to the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados) within 72 hours of becoming aware of the incident, and to the data subjects whenever the breach is likely to result in a high risk to their rights.
Withdrawal and management of consent
The user may, at any time, withdraw the permissions granted to the Application, namely access to location and the sending of push notifications, in the vehicle’s system settings.
Complaints to supervisory authorities
Notwithstanding the commitment of Moongy, S.A. to resolve any type of situation, the Data Subject has the right to lodge a complaint with the competent Authority (CNPD) if any of their rights is denied.
Comissão Nacional de Proteção de Dados (Portuguese Data Protection Authority)
Av. D. Carlos I, 134 - 1.º
1200-651 Lisboa / Portugal
Tel: +351 213928400 · Fax: +351 213976832
✉️ geral@cnpd.pt · www.cnpd.pt
Changes to the Privacy Policy
Moongy, S.A. reserves the right to amend this Privacy Policy at any time, and any such amendment will be duly published here. Relevant changes are also communicated in the Application.
In any case, we recommend that you review this Policy regularly so that you are always duly informed of any changes or updates.
Governing Law and Jurisdiction
This privacy policy, as well as the collection, processing or transmission of data of customers, employees and partners, are governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the laws and regulations applicable in Portugal, namely Law No. 58/2019 of 8 August.
Any disputes arising from the validity, interpretation or performance of the Privacy Policy, or relating to the collection, processing or transmission of Customer data, shall be submitted to the jurisdiction of the courts of the District of Lisbon, without prejudice to the data subject’s right to bring proceedings before the courts of the Member State of their habitual residence and to the applicable mandatory legal provisions.
© 2026 Mobyfinder Inc. · MoOngy S.A. · All rights reserved.