Privacy Policy

PRIVACY NOTICE FOR PROCESSING PERSONAL DATA BY CACHET OÜ

Version 1.1 – 20.11.2023

Cachet OÜ, address Tatari tn 64,, Tallinn 10134, Estonia, registry code 14560702 (hereinafter “Cachet”) processes personal data of individuals who use the information society service cachet.me.

1.GENERAL PROVISIONS

1. Cachet ensures that the processing of personal data is in accordance with the legislation regarding the protection and security of personal data (including the General Data Protection Regulation of the European Union, hereinafter, “GDPR”), other personal data protection legislation, and good business practices.

2. Cachet considers the privacy of individuals and the protection of their data important and makes the best efforts to ensure the security and protection of the information system and other data carriers.

2.DEFINITIONS

1. User means a person who signs up for the Platform or uses the services provided on the Platform.

2. Processing of personal data means viewing, collecting, saving, storing, altering, transmitting, or receiving personal data and other activities related to personal data.

3. Platform means the web service at https://Cachet.me/ and the mobile applications through which insurance intermediaries market and mediate the insurance contract to the Users.

4. Services means the account management and data exchange services provided by Cachet via the Platform.

3.PURPOSE OF THE PROCESSING OF PERSONAL DATA AND ITS LEGAL BASIS

1. Cachet processes personal data necessary for the management of the accounts of the Users of the Platform and for the collection of data on the activity of the use of the object of insurance.

2. In general, the legal basis for such a purpose is carried out in accordance with Article 6(1)(b) of the GDPR. Such processing is necessary for the performance of a contract to which the User is a party or in order to take such steps at the specific request of the User prior to entering into a contract. Sometimes the processing of data is necessary for legitimate interests under Article 6(1)(f) of the GDPR provided those interests are not outweighed by the Users’ rights and interests.

4.HOW CACHET COLLECTS AND USES PERSONAL DATA

1. Cachet collects personal information on the Platform as follows:

   1. the User enters the data necessary for creating an account on the Platform.

   2. the User authorizes Cachet to make inquiries for the collection of user activity data for insurance contracts, e.g. usage activity data from gig economy platforms. Cachet performs queries in an automated form (API solution) or by making individual requests;

   3. User activity data are communicated to the insurance intermediary and insurers, who make a subsequent insurance offer.

   4. usage activity data is analyzed by Cachet to improve data and service quality;

   5. after the end of the term of validity of the insurance contract, Cachet checks whether the User operates on gig economy platforms so that the insurance intermediary could remind the User to enter into an insurance contract;

   6. if the User enters into a contract on the basis of the offer, the insurance contract and policy data will be stored on the Platform.

   7. Cachet helpdesk requests are stored in the Platform’s helpdesk information system.

2. Insurance event notifications are stored on the Platform and forwarded to the insurer by the insurance intermediary. Cachet is not a claim handler.

5.TRANSMISSION AND STORAGE OF THE PERSONAL DATA

1. Cachet forwards User and object activity data to the insurance intermediaries and insurers who are offering services through the Platform.

2. Cachet makes automated inquiries, during which User identification data is transmitted to ride-sharing platforms in order to identify vehicle usage activity. Such requests shall be made at the request of the User and shall constitute an exercise of the right of transfer under Article 20 of the General Regulation on Data Protection.

3. Cachet provides Users’ insurance contracts data to ride-sharing platforms to the extent necessary to ensure that the vehicle has valid insurance.

4. Cachet Broker processes personal data in the European Union (EU) and within the European Economic Area (EEA). Cachet receives, transmits, and processes personal data only digitally.

6.DISCLOSURE OF PERSONAL DATA

1. Cachet will disclose personal data to all insurance intermediaries under the terms and conditions provided in the Data Processing Agreements. Users can receive additional information about Cachet partners (insurance intermediaries) on the Platform.

2. Cachet is providing second-level customer support services to its insurance intermediaries. In the event a User’s request falls outside the competence of the first-line support, then the second-level customer support service is provided by the IT team of the Cachet.

7.RETENTION AND DELETION OF PERSONAL DATA

1. The storage period of personal data depends on the legal obligations to store data (i.e. accounting regulations), contractual obligations, and legitimate interest or consent to provide the best services.

8.DATA CONTROLLER AND DATA PROCESSOR

1. Cachet is the controller of the data processing necessary for the management of the accounts of the Users of the Platform and the collection of data on the activity of the use of the object of insurance.

2. Cachet is a processor for data on storing the insurance contracts, insurance offers, insurance premiums and insurance contract performance, and

3. Cachet is a sub-processor on insurance contracts, including claims and indemnities provided for insurers via the Platform

4. nsurance intermediaries are processors of personal data in connection with the conclusion of a brokerage contract and the submission of a comparative insurance offer, the corresponding data processing notice is attached on the Platform under the terms and conditions of the insurance intermediary.

5. Insurers are controllers of data processing, the conditions of processing their personal data are published on the Platform as a reference to the respective service.

9.RIGHTS OF THE USER (DATA SUBJECT)

1. The User (data subject) shall have the right at any time to request:

   1. access to personal data (accessed via the Platform);

   2. correction of inaccurate personal data (given that vehicle activity data is automatically collected from gig economy platforms, Cachet cannot correct activity data);

   3. require the deletion of personal data (not applicable to insurance contracts and policies as they are subject to a statutory retention period);

   4. restriction of processing of personal data;

   5. transfer personal data to the controller designated by the User (only applicable to data, which Cachet is the controller);

   6. withdrawal of data-processing consent (applicable to requests made by the User).

2. In order to exercise these rights, the User must submit a declaration to support@cachet.me. The application shall be responded to within a maximum of 30 calendar days.

3. The User has the right to lodge a complaint against the processing of personal data with the supervisory authority, which is the Estonian Data Protection Inspectorate (www.aki.ee). Supervision of the insurance contract and the processing of personal data of the insured event may also be performed by the supervisory authority of the insurer.

10.CHANGES AND VALIDITY

1. Cachet has the right to change the conditions for processing personal data. In the event, that there are substantial changes, Cachet will provide at least 1 (one) month’s notice in advance through the Platform before the substantial changes take effect.

2. The conditions for processing personal data are valid from 1st June 2022.