This Privacy Statement is relevant for visitors of our website and (future) users of Cleverbase. We highly value your ease and convenience while making use of our products and in order to provide optimal security we handle your personal data with utmost care, integrity and transparency. With this Privacy Statement we would like to inform you about which data we collect, how we collect your data (directly or indirectly), why we collect your data (for which purposes), on basis of which principles (lawfulness) and how we further handle your data.
Who are we?
We are Cleverbase ID B.V. (hereafter: Cleverbase), an ETSI/eIDAS qualified trust service provider under the supervision of Radiocommunications Agency. We are located at the Maanweg 174, 2516 AB in Hague, the Netherlands, and registered in the Chamber of Commerce, registration number 67419925.
Which personal data do we process?
We process the following personal data in order to offer our products and services:
- Identification details: personalia (name, date of birth, place of birth, gender, details means of identification, video recording, static image).
- Contact details: name, e-mailadres and phone number.
- Technical details: IP adres, login details, language settings and operating system of the used device.
- User details: username.
Cleverbase has no legal basis for processing your citizen service number (=BSN) and does not want to do that either. Therefore, ensure that the citizen service number is covered during the registration process. The citizen service number can be found on the backside of the identity card and the passport under "personal number". For example, tape it off with opaque tape.
In addition, the citizen service number is included in the MRZ (= Machine Readable Zone) of the identity document. The MRZ is the two lines of text on the front of the passport and the three lines of text on the back of the identity card.
While taking the photo of your document, we make it possible to mask the citizen service number in the MRZ via an overlay on your telephone before it is sent to Cleverbase. After taking the photo and before starting the video call, you must manually tape the citizen service number in the MRZ.
How and for what purpose do we use your personal data?
1. Visitor data website
General visitor data are used to show, maintain and improve the website as well as possible. We analyze how many visitors our website receives, which web pages are visited and where the visitors come from.
2. Contact with Cleverbase
As soon as you contact Cleverbase, we collect the following data:
- Contact details
- Identity details
To ensure the best service, we use your contact details to communicate with you. If you are a registered client at Cleverbase and you need support with the use of a service, then we might ask you for additional identity details.
3. Use of Cleverbase services
Cleverbase collects the following data:
- Technical details
- Identity details
We use this data to properly protect our organisation and to guarantee user-friendliness. We do this with i.e. tests, handling incidents, problem solving, technical support and reporting.
Registration with Cleverbase
We collect the following data:
- Identity details
- Technical details
- Contact details
To register you as a new client, we use your identity and contact details to lawfully and correctly determine and confirm your identity. We need the above mentioned data to comply with Dutch Identification legislation. We use technical details to maintain and optimize the registration process.
Mobile application use
Anonymised usage and the anonymised crash reports in case of sudden closure of the Cleverbase app are used to optimize it. This way, we can continuously improve user-friendliness.
Signing with Cleverbase
Cleverbase shares the following data with the (third party) signature application used by you for the signing process:
- Signing certificate
- Public key
- Full name end-user
These details are needed by your (third party) signature application, so you can use Signing with Cleverbase.
Identity Federation by Cleverbase
- The identity attributes that you have consented to share.
- A consent statement signed by you stating that you consent to sharing your personal data with the requesting third party. The consent contains information on which data you share, with whom and for what purpose.
These details are used for sharing certain identity attributes with requesting third parties, so you can make use of Identity Federation by Cleverbase.
Lawfulness of processing
Organisations are only allowed to process personal data if they have a basis for doing so. The General Data Protection Regulation lists six possible lawful bases. We use three of these bases for our various processing operations:
- Permission: to lawfully secure your identity and to get in touch with you at your request.
- Contractual agreement: when you, as a customer, purchase our products and/or services or would like to do so, and we must process your personal data to be able to do so. We also use this basis to provide you with the necessary information concerning using Cleverbase.
- Legal obligation: if we receive a legitimate claim to provide data to a competent authority. We are also legally obliged to keep personal data in our financial records in accordance with tax legislation.
Storage period of the data
We do not store your personal data for longer than strictly necessary for the purpose for which we obtained it. We base this assessment on the type of personal data, the product or service for which we have obtained the data, and what you, as the data subject, can reasonably expect as a retention period.
For the personal data that are processed to lawfully determine and confirm your identification, we use a retention period of maximum ten years: we store your personal data for as long as your certificate is valid, maximum three years, and on top of that seven more years based on legislation after the expiration date of the certificate.
We do everything to offer optimal data security and to secure your personal data against loss and illegitimate usage. All employees of Cleverbase who have knowledge of personal data in the context of their duties are obliged to maintain confidentiality. Your personal data will only be shared with third parties in case of necessity with regard to above mentioned purposes. Cleverbase has been evaluated by an independent auditor and is ISO27001 certified. ISO27001 is the standard for information security.
Based on the General Data Protection Regulation, you are entitled to the following rights:
- The right to be informed
- The right of access
- The right of rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
In case you would like to know which of your personal data we process and for which purposes, or in case you would like to invoke one of the above mentioned rights, please get in touch with us via email@example.com. We will inform you as soon as possible about your request.
Recipients of your personal data
The following persons and/or authorities possibly have access to your personal data:
- Employees of Cleverbase that are assigned to or managing responsibilities related to the processing of personal data or the people that are involved in doing so;
- (Sub)Processors that are involved by Cleverbase in order to execute specific tasks with regard to her provision of services;
- Governmental bodies, such as police and justice, for as far as necessary to comply with applicable norms and legislation.
In case of any questions related to the way we handle your privacy or in case you would like to invoke one or more of your rights as mentioned above, please get in touch with us via email firstname.lastname@example.org, via post “Maanweg 174, 2516 AB Hague, the Netherlands” or via phone: +31 70 820 96 80.
We are entitled to revise our Privacy Statement at any given moment. We will announce this revision via our website. In case we want to radically change the underlying principles, we will actively reach out to you.
Dutch Data Protection Authority
We would like to support you in case you have a complaint regarding the processing of your personal data. Based on privacy legislation, you can file a complaint with the Dutch Data Protection Authority about the processing of your personal data. This is possible via the website of the Dutch Data Protection Authority: https://autoriteitpersoonsgegevens.nl/en.
Version March 1st 2021
Cleverbase ID B.V.