Close
Processing of personal data

Version 0.6 – 23.01.2020

  1. GENERAL CONDITIONS
    1. Cachet is an insurance intermediary, which provides insurers with activity of vehicles on ride-sharing service platforms (Uber, Bolt and Yandex), mediates insurance contracts and reports insured events.
    2. Cachet OÜ, address Kohtu tn 2-21, Tallinn 10130, Estonia, registry code 14560702 (hereinafter Cachet) processes the personal data of persons (hereinafter referred to as Users) using the Cachet web platform Cachet.me (hereinafter the Platform).
    3. Cachet is the controller responsible for the processing of personal data necessary for the management of User accounts and for the collection of vehicle activity data from ride-sharing service platforms. Cachet is the processor of personal data for mediated insurance contracts and insured event notifications.
    4. From the moment the insurance contract is entered into, the insurer becomes the controller of the insurance contracts. With respect to the personal data of vehicle activity, the insurer shall be the processor of the personal data.
  2. PERSONAL DATA
    1. Cachet processes the following personal data:
      1. User identification data – name, surname, personal identification number, telephone number, e-mail address, country of residence;
      2. Platform usage Data – Helpdesk requests, alerts, and account logs;
      3. vehicle data – vehicle registration number and the activity data,
      4. insurance history – information on mediated insurance contracts, policies and beneficiaries;
      5. insured events – data on insured events reported on the Platform (case description, scheme, photographs).
  3. COLLECTION OF PERSONAL DATA
    1. Cachet collects personal information as follows:
      1. The User enters the data necessary for creating an account on the Platform;
      2. The User authorizes Cachet to query vehicle platforms to collect vehicle activity data. Cachet executes queries in an automated form (API solution);
      3. User and vehicle activity data are communicated to the insurer, who makes a subsequent insurance offer;
      4. if the User enters into an insurance contract on the basis of the offer, the insurance contract and policy details are stored on the Platform;
      5. User Helpdesk requests are stored in the Platform helpdesk information system;
      6. Verification of User submissions shall be on a case-by-case basis where there is reason to believe that the User is providing false information in order to obtain a more favourable insurance policy;
      7. Notices of insured events shall be stored in the Platform’s Helpdesk Information System and forwarded to the insurer. Cachet is not a claims handler.
  4. PROCESSING OF PERSONAL DATA
    1. Cachet processes personal data for the following purposes and on the following legal basis:
      1. Platform account creation and customer relations – performance of the contract;
      2. provision of technical and organizational notices to the Users by the Platform – performance of the contract and legitimate interest;
      3. collecting and transmitting vehicle activity data from ride-sharing service platforms to the insurers – each time the User agrees to make such an offer;
      4. the conclusion of insurance contracts through Cachet – performance of the contract;
      5. Validation of vehicle activity data – legitimate interest in preventing manipulation of insurance tariffs;
      6. mediation of claims – performance of the contract.
  5. RIGHTS OF THE DATA SUBJECT
    1. The User (data subject) shall have the right at any time to request:
      1. access to personal data (accessed via the Platform);
      2. correction of inaccurate personal data (given that vehicle activity data is automatically collected from ride-sharing service platforms, Cachet cannot correct vehicle activity data);
      3. require the deletion of personal data (not applicable to insurance contracts and policies as they are subject to a statutory retention period);
      4. restriction of processing of personal data;
      5. transfer personal data to the controller designated by the User (only applicable to data, which Cachet is the controller of);
      6. withdrawal of data-processing consent (only applicable to ride-sharing service platforms requests).
    2. In order to exercise these rights, the User must submit a declaration to support@cachet.me. The application shall be responded to within a maximum of 30 calendar days.
  6. TRANSMISSION OF PERSONAL DATA
    1. Cachet forwards User and User vehicle activity data to the insurers offering insurance products through the Platform. The insurers are AAS BTA Baltic Insurance Company (Latvian market) and AAS BTA Baltic Insurance Company Estonian branch (Estonian market).
    2. Cachet shall make automated inquiries during which the User identification data will be transmitted to the ride sharing platforms. Cachet does not submit User insurance, insurance history, or insured event data to ride-sharing service platforms.
  7. DISCLOSURE OF PERSONAL DATA
    1. Cachet will not disclose personal information to third parties unless the obligation to disclose it to the supervisory authorities arises from the law governing insurance businesses.
  8. DEADLINE FOR RECORDING
    1. Personal data is stored on servers located in the European Union. The User’s personal data will be retained as long as the User has an active account on the Platform. If the User deletes the Platform account or has been an inactive on the Platform for the last 24 calendar months, the User’s personal data shall be deleted.
    2. Personal data will not be deleted if there is a dispute between the User, Cachet or the insurer over the mediation and performance of the insurance contract. In this case, the personal data will be deleted after the expiry date for claim submission.
    3. Users have the right to lodge a complaint against the processing of personal data with the supervisory authority, which is the Estonian Data Protection Inspectorate (www.aki.ee). Supervision of the insurance contract and the processing of personal data of the insured event may also be performed by the supervisory authority of the insurer.