This Privacy Statement is relevant for visitors of our website and (future) users of Cleverbase. We highly value your ease and convenience while making use of our products and in order to provide optimal security we handle your personal data with utmost care, integrity and transparency. With this Privacy Statement we would like to inform you about which data we collect, how we collect your data (directly or indirectly), why we collect your data (for which purposes), on basis of which principles (lawfulness) and how we further handle your data.
Who are we?
We are Cleverbase ID B.V. (hereafter: Cleverbase), an ETSI/eIDAS qualified trust service provider under the supervision of Radiocommunications Agency. We are located at the Maanweg 174, 2516 AB in Hague, the Netherlands, and registered in the Chamber of Commerce, registration number 67419925.
Which personal data do we process?
We process the following personal data in order to offer our products and services:
- Identification details: personalia (name, date of birth, place of birth, gender, details means of identification, video recording, static image).
- Contact details: name, e-mailadres and phone number.
- Technical details: IP adres, login details, language settings and operating system of the used device.
- User details: username.
Cleverbase has no legal basis for processing your citizen service number (=BSN) and does not want to do that either. Therefore, ensure that the citizen service number is covered during the registration process. The citizen service number can be found on the backside of the identity card and the passport under "personal number". For example, tape it off with opaque tape.
In addition, the citizen service number is included in the MRZ (= Machine Readable Zone) of the identity document. The MRZ is the two lines of text on the front of the passport and the three lines of text on the back of the identity card.
While taking the photo of your document, we make it possible to mask the citizen service number in the MRZ via an overlay on your telephone before it is sent to Cleverbase. After taking the photo and before starting the video call, you must manually tape the citizen service number in the MRZ.
How do we use your personal data?
General visitor data are used to show, maintain and improve the website as well as possible. We analyze how many visitors our website receives, which web pages are visited and where the visitors come from.
When we register you as a new customer, we use your identification details in order to correctly determine and confirm your identity.
We do not process any personal data without your consent and we don’t process more personal data than necessary.
For which purposes does Cleverbase process your personal data?
1. Registration with Cleverbase
To be able to register at Cleverbase, we collect the following personal data:
- Identity details
- Technical details
- Contact details
We need these details in order to comply with Dutch Identification legislation and to lawfully determine and confirm your identity. Additionally, we collect technical details to maintain and improve (the user-friendliness of) the registration process.
2. Contact with Cleverbase
As soon as you get in touch with Cleverbase, we collect the following details:
- Contact details
- Identity details
In order to support you in the best possible way, we use your contact details. In case you are a registered customer and you need support to make use of our services, we might also need to ask for your identity details.
3. Using the products of Cleverbase
To make use of the services of Cleverbase and in order to protect the security of our company (eg testing, incident response and management, technical support) we collect the following details:
- Technical details
- Identity details
To make use of the Signing service of Cleverbase, Cleverbase shares the following details with the (third party) signature application used for the signing process.
- Signing certificate
- Public key
- Full name end-user
To make use of the Identity Federation service of Cleverbase to share certain identity attributes with requesting third parties, Cleverbase creates, stores and shares the following personal data:
- The identity attributes that you have consented to share.
- A consent statement signed by you stating that you consent to sharing your personal data with the requesting third party. The consent contains information on which data you share, with whom and for what purpose.
Lawfulness of processing
Organisations are only allowed to process personal data if they have a basis for doing so. The General Data Protection Regulation lists six possible lawful bases. We use three of these bases for our various processing operations:
- Permission: to lawfully secure your identity and to get in touch with you at your request.
- Contractual agreement: when you, as a customer, purchase our products and/or services or would like to do so, and we must process your personal data to be able to do so. We also use this basis to provide you with the necessary information concerning using Cleverbase.
- Legal obligation: if we receive a legitimate claim to provide data to a competent authority. We are also legally obliged to keep personal data in our financial records in accordance with tax legislation.
Storage period of the data
We do not store your personal data for longer than strictly necessary for the purpose for which we obtained it. We base this assessment on the type of personal data, the product or service for which we have obtained the data, and what you, as the data subject, can reasonably expect as a retention period.
For the personal data that are processed to lawfully determine and confirm your identification, we use a retention period of maximum ten years: we store your personal data for as long as your certificate is valid, maximum three years, and on top of that seven more years based on legislation after the expiration date of the certificate.
We do everything to offer optimal data security and to secure your personal data against loss and illegitimate usage. All employees of Cleverbase who have knowledge of personal data in the context of their duties are obliged to maintain confidentiality. Your personal data will only be shared with third parties in case of necessity with regard to above mentioned purposes. Cleverbase has been evaluated by an independent auditor and is ISO27001 certified. ISO27001 is the standard for information security.
Based on the General Data Protection Regulation, you are entitled to the following rights:
- The right to be informed
- The right of access
- The right of rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
In case you would like to know which of your personal data we process and for which purposes, or in case you would like to invoke one of the above mentioned rights, please get in touch with us via firstname.lastname@example.org. We will inform you as soon as possible about your request.
Recipients of your personal data
The following persons and/or authorities possibly have access to your personal data:
- Employees of Cleverbase that are assigned to or managing responsibilities related to the processing of personal data or the people that are involved in doing so;
- (Sub)Processors that are involved by Cleverbase in order to execute specific tasks with regard to her provision of services;
- Governmental bodies, such as police and justice, for as far as necessary to comply with applicable norms and legislation.
In case of any questions related to the way we handle your privacy or in case you would like to invoke one or more of your rights as mentioned above, please get in touch with us via email email@example.com, via post “Maanweg 174, 2516 AB Hague, the Netherlands” or via phone: +31 70 820 96 80.
We are entitled to revise our Privacy Statement at any given moment. We will announce this revision via our website. In case we want to radically change the underlying principles, we will actively reach out to you.
Dutch Data Protection Authority
We would like to support you in case you have a complaint regarding the processing of your personal data. Based on privacy legislation, you can file a complaint with the Dutch Data Protection Authority about the processing of your personal data. This is possible via the website of the Dutch Data Protection Authority: https://autoriteitpersoonsgegevens.nl/en.
Version October 20th 2020
Cleverbase ID B.V.