Product conditions

Table of Contents

1. Introduction and definitions

These are the Product conditions for the registration and use of Cleverbase trust services. Cleverbase ID B.V. (hereinafter: Cleverbase or We) is an ETSI/eIDAS accredited Qualified Trust Service Provider and is supervised by the Dutch Authority for Digital Infrastructure (RDI). We are established at Maanweg 174, 2516 AB in The Hague and registered with the Chamber of Commerce under number 67419925. Cleverbase is also the brand under which We provide the services to you as a User.

Because Cleverbase provides several services, we have divided our Conditions per service. In this way we keep them concise. These Product conditions (this document) apply from the moment you register for a qualified certificate. They apply to:

  • Registration for and holding of qualified certificates.
  • The use of trust services in which a qualified certificate is used. These are currently qualified electronic signing and identification.
  • Registration for and use of the professional certificate for accountants: a qualified certificate that, in addition to the identity of the Certificate Holder, also confirms their professional capacity as an accountant. The additional provisions for this certificate are included recognisably in these Product conditions under the relevant topics (see in particular section 3.2).

1.1 Which definitions do We use in these Product conditions?

Definitions as set out in the General Terms and Conditions also apply here. In addition, we use the following definitions:

Accountants Register: the accountants register maintained by the NBA in which the Professional capacity, the title and the status of an accountant's registration are recorded.

Professional certificate for accountants (Professional Certificate): a qualified certificate that, in addition to the identity of the Certificate Holder, also confirms their verified Professional capacity as an accountant. The Professional Certificate contains at least the protected title (RA or AA) and data from which the registration in the accountants register of the NBA can be derived.

Profession-related data: the data concerning the Professional capacity that is included in the Professional Certificate, including the title (RA or AA), the NBA and the data from which the registration in the accountants register of the NBA can be derived.

Professional capacity: the capacity of the Certificate Holder as an accountant, evidenced by a valid registration in the accountants register of the NBA and the right to use the protected title Registeraccountant (RA) or Accountant-Administratieconsulent (AA).

Professional body (NBA): the Royal Netherlands Institute of Chartered Accountants (Koninklijke Nederlandse Beroepsorganisatie van Accountants, NBA), the public professional body which, pursuant to the Dutch Accountancy Profession Act (Wet op het accountantsberoep, Wab), maintains the accountants register.

Certificate: an electronic document that links cryptographic keys to a particular person and confirms the identity of that person in order to link a person to the use of a trust service. In the context of Cleverbase, every certificate is also a qualified certificate.

Certificate Holder: a User who is identified in a Certificate as the holder of the private key belonging to the public key given in the Certificate. In the case of person-bound Certificates, the Certificate Holder will be a natural person; in the Citizen domain, the Certificate Holder and the User are therefore always the same party.

Certificate Revocation List (CRL): a publicly available list of certificates issued by Cleverbase that are no longer valid due to revocation or expiry of validity.

EU trust list: a list of EU Member States with information about the qualified trust service providers for which the Member State is responsible, together with information about the qualified trust services they provide.

Qualified certificate: a certificate that meets the highest reliability requirements under the European eIDAS Regulation. Suitable for the use of qualified trust services.

Qualified trust service (within Cleverbase): an electronic service for electronic signing or identification in accordance with the highest reliability requirements under the European eIDAS Regulation. Equivalent to the most reliable analogue service.

1.2. Hierarchy of documentation

In the event of a dispute between documents, the following hierarchy is maintained:

  • Privacy statement
  • Certification practice statement
  • Identity proofing service practice statement
  • PKI disclosure statement
  • Algemene voorwaarden in het Nederlands
  • The terms & conditions in English
  • De product voorwaarden in het Nederlands
  • The product conditions in English
  • Other public communication by Cleverbase

2. Costs associated with the service

No costs are charged to the User for registering a certificate as a natural person. Nor are any costs charged to the User for the use of Cleverbase's trust services. Third-party platforms on which the trust services are used (such as signing platforms) may charge their own platform fees; these costs are separate from Cleverbase.

For the professional certificate for accountants, an annual fee per User applies, which is communicated on the website.

3. What may you expect from us as a User?

As a User of Cleverbase, you may expect various things with regard to the registration and use of qualified trust services.

3.1 Certificates

Cleverbase uses certificates for creating electronic signatures and for logging in. For each natural person, Cleverbase creates one or more certificates. The Dutch government and the European Union set strict rules for the issuance of certificates. This entails obligations both for us as Cleverbase and for you as a User. Cleverbase complies with the obligations it has imposed on itself in its internal procedures. It also commits itself to this towards its Users and the parties that rely on the certificates issued and managed by Cleverbase. Cleverbase has been certified against the standards imposed on it by PKIoverheid.

Cleverbase's internal procedures are laid down in its Certification Practice Statement (CPS). Cleverbase may amend the Certification Practice Statement or the procedures contained therein, but in doing so it will ensure that these procedures continue to meet the requirements applicable under PKIoverheid.

For the purposes of the certificates, Cleverbase records log files and other registration data relating to a Certificate. The retention periods for this data are set out in Cleverbase's Privacy statement.

For the purposes of the certification services, Cleverbase complies with ETSI 319 411-1, 319 411-2 and the PKIoverheid Programme of Requirements. This has been established by an external auditor, in accordance with the ETSI 319 403-1 certification scheme.

3.2 Professional certificate for accountants

In addition to the regular certificates, Cleverbase issues the professional certificate for accountants. This is a qualified certificate that, in addition to the identity of the Certificate Holder, also confirms their Professional capacity as an accountant. All provisions of these Product conditions apply to the professional certificate, supplemented by the provisions of this section and by the provisions specifically included for the professional certificate elsewhere in this document.

Before Cleverbase issues a professional certificate for accountants, Cleverbase establishes the Professional capacity of the Certificate Holder. To this end, Cleverbase verifies that the Certificate Holder is registered as an accountant in the accountants register of the NBA and is entitled to use the title RA or AA. This verification takes place against a reliable source, namely the accountants register of the NBA.

Cleverbase only includes the Profession-related data in the Professional Certificate if the registration is valid at the time of issuance. The Profession-related data reflects the Professional capacity as established at the time of issuance.

The validity of the Profession-related data is linked to the validity of the registration in the accountants register of the NBA. If the Certificate Holder's registration ends, is suspended or is removed, or if the right to use the title lapses, then the Professional capacity included in the Professional Certificate is no longer correct and Cleverbase revokes the Professional Certificate (see section 4.3).

3.3 Availability of services

The certificate status information will never be unavailable for more than four consecutive hours. The certificate status information will also be available after the expiry of the validity period of the Certificate for a period consistent with laws and regulations concerning certificates. Cleverbase has a termination plan in place to be able to fulfil this obligation.

4. What do We expect from you as a User?

4.1 Provision of information

If Cleverbase so requests, the User shall provide as soon as possible all information necessary to carry out the service properly. The User shall provide supporting evidence for this information within fourteen days.

If information in the Certificate is incorrect or is no longer correct due to a change, the User shall inform Cleverbase of this situation immediately.

For the professional certificate for accountants, this expressly also applies to the Profession-related data. The User shall inform Cleverbase immediately when their registration in the accountants register of the NBA ends, is suspended or is removed, or when a disciplinary or other measure restricts or terminates the right to use the title RA or AA.

4.2 Continuity of use

After the expiry of the validity period of the Certificate, the Certificate can no longer be used. As a User, you are yourself responsible for the timely renewal of certificates. As a User, you cannot derive any rights from internal policy under which Cleverbase informs the User at the end of the validity period of the Certificate about the expiry of the validity period of the Certificate.

You are also yourself responsible for emergency replacement if the key material is compromised or another calamity occurs.

Upon renewal of the professional certificate for accountants, Cleverbase again establishes that the Professional capacity is valid at that time. A professional certificate is not renewed if the registration in the accountants register of the NBA is no longer valid at the time of renewal.

4.3 Revocation and improper use

The User shall prevent improper use of the Certificate. A Certificate is issued for a predetermined purpose, namely Authentication or Signing. As a User, you may therefore not use the Certificate for any purpose other than that for which the Certificate was issued.

The professional certificate for accountants links the Professional capacity of the Certificate Holder to the electronic signature. As a User, you use the professional certificate solely in accordance with that capacity and do not wrongly give the impression of acting in that capacity.

The User shall ensure that no unauthorised or unlawful use is made of the services or certificates. In any event, the User shall ensure that no action is taken in breach of the law or regulations, that no criminal offences are committed or assisted, and that no harm is caused to Cleverbase, its reputation or its integrity. This entails that the User takes reasonable measures to:

  • safeguard the confidentiality of the PIN code, including at least:
    • preventing others from watching while the PIN code is entered,
    • not writing down the PIN code
    • and not providing the PIN code to anyone else;
  • safeguard the confidentiality of the use of the Cleverbase app.

As a User, you revoke the Certificate as soon as possible and no longer use the Certificate when:

  1. the key material may have been compromised,
  2. the PIN code may have been compromised,
  3. you yourself no longer have access to the key material (for example: you have lost your mobile phone),
  4. the information in the Certificate is no longer correct, or
  5. there is any other reason that justifies revocation of the Certificate.

For the professional certificate for accountants, you also revoke the Certificate as soon as possible when your registration in the accountants register of the NBA ends, is suspended or is removed, or when the right to use the title RA or AA lapses. Cleverbase revokes the professional certificate in any event as soon as it becomes aware that the Professional capacity of the Certificate Holder is no longer correct.

After a renewed registration, the use of services can be resumed.

4.4 Exclusion of use of the certificate as an identity document

A Certificate is not designated as an identity document under the Dutch Compulsory Identification Act (Wet op de identificatieplicht, Wid). It cannot be used to identify persons in cases where the law requires the identity of persons to be established with a document designated under the Dutch Compulsory Identification Act. For the avoidance of doubt, it follows from this that a Certificate cannot be used when obtaining government services where the law requires the identity of persons to be established with a document designated under the Dutch Compulsory Identification Act.

4.5 Relying party

If the relying party requests the status of a Certificate, it will have to verify the electronic signature and check the associated certification path. For this check, it can query Cleverbase's crl (trade name of Cleverbase ID B.V.) at https://pki.cleverbase.com/cleverbase3c.crl or carry out an OCSP status check. See section 4.10 of the Certification Practice Statement for a further explanation of requesting the certificate status. In addition, the relying party should be aware that, in order to be able to rely on a certificate as a qualified EU certificate, the CA (the trust anchor) for the validation of the certificate must be as identified in a digital service ID of an EU trust list with the service type ID https://uri.etsi.org/TrstSvc/Svctype/CA/QC/. ETSI TS 119 615 provides guidance for relying parties in validating a certificate against the EU trust service.

For the professional certificate for accountants, a relying party that relies on the Professional capacity included in the Certificate should be aware that this capacity was established by Cleverbase at the time of issuance and that the Professional Certificate is revoked by Cleverbase as soon as the registration in the accountants register of the NBA is no longer valid. The relying party can verify the current validity of the Professional Certificate via the aforementioned crl or OCSP. The current status of the registration as an accountant can also be consulted in the accountants register of the NBA.

Furthermore, it is recommended that the relying party be aware of the restrictions on the use of the certificate, as can be derived from the certificate itself and from the General Terms and Conditions.

5. No longer using the service

You may decide that you no longer wish to be a User of the services under these Product conditions. You must notify us of this in writing or by e-mail.

5.1 Termination by Cleverbase

If a Certificate is revoked by Cleverbase or by PKIoverheid, you remain a User of the service. Cleverbase reserves the right to deny a User the use of the service on the grounds set out in section 7.2 of the General User Terms and Conditions.

6. Amendment of the Product conditions

Cleverbase may have to amend its services or parts of its services due to new laws or regulations. If Cleverbase has to implement such an amendment of its services or a significant amendment of the Product conditions, We will inform you as a User in advance via the website www.cleverbase.com. These amendments then take effect 30 calendar days after Cleverbase has informed you.

Cleverbase also has the right to amend or supplement the Product conditions. If We decide on a significant amendment or supplement, We will inform you as a User in advance via the website www.cleverbase.com. This amendment then takes effect 30 calendar days after notification to you as a User for all current subscription agreements and for all services still to be purchased by you.

Should certain conditions or agreements in these Product conditions be invalid or (capable of being) annulled, this does not affect the validity of the other conditions and agreements described here. For the condition or agreement that is then no longer valid and must therefore be replaced, Cleverbase has the right to prescribe a new condition and agreement that approximates the content and purport of the previous agreement as closely as possible.

Only if this is confirmed in writing in advance by Cleverbase may these Product conditions be deviated from. What is then agreed in writing between Cleverbase and the User and deviates from what is stipulated here shall then prevail. The remainder of the conditions that are not deviated from shall continue to exist and remain valid.