Processing of personal data

Processing of personal data

Version 1 – 29.06.2021

1. GENERAL CONDITIONS
   1. Cachet.me is an online data exchange environment that provides a service to insurance intermediaries, insurers and financial service providers (hereinafter the platform).
   2. Cachet OÜ, address Tatari 64, Tallinn 10134, Estonia, registry code 14560702 (hereinafter Cachet.me) processes personal data of persons (hereinafter users) who use the platform.
   3. Cachet.me is the controller of personal data of the data processing necessary for the management of the accounts of the users of the platform and for the collection of data on the activity of the use of the object of insurance or financial services.
   4. The processor of personal data in connection with the conclusion of a brokerage contract and the submission of a comparative insurance offer is an insurance intermediary, the corresponding data processing notice is attached on the platform under the terms and conditions of the insurance intermediary. Insurers and financial service providers are also controllers of data processing, the conditions of processing of their personal data are published on the platform as a reference to the respective service.
   5. Cachet.me is a processor for data on brokerage contracts, insurance marketing, including insurance offers, insurance premiums and insurance contract performance, and for insurers’ sub-processor data on insurance contracts, including claims and indemnities. For financial services, Cachet.me is an processor.
2. PERSONAL DATA
   1. Cachet.me processes the following personal data as a controller:
      1. user identification data – name, surname, personal identification number, telephone number, e-mail address and country of residence;
      2. platform usage Data – Helpdesk requests, alerts, and account logs;
      3. Object of insurance contract – e.g. vehicle registration number and the activity data (start and end of the trip, length of the trip, location with city accuracy) data. User activity data can be viewed by the user on the platform account. 
   2. Cachet.me processes the following personal data as a processor:
      1. Customer data necessary for marketing of the insurance contract – name, personal identification code, contact information (telephone number, e-mail address), data of beneficiaries and insured persons;
      2. data on the reminder made at the end of the insurance contract period – the activity of the user’s vehicle on the ride-sharing platforms after the end of the insurance contract;
      3. Insurance premium payment data – the customer’s bank account number, credid payment data, invoice or payment notification data and other payment data.
   3. Cachet.me processes the following personal data as a sub-processor:
      1. Data on loss events: time, place, circumstances, insurance indemnity, repair, amount of loss, refusal to indemnify and other data.
3. COLLECTION OF PERSONAL DATA
   1. Cachet.me collects personal information on the platform as follows:
      1. the user enters the data necessary for creating an account on the platform.
      2. the user authorizes Cachet.me to make inquiries for the collection of usage activity data for insurance contract, e.g. vehicle usage activity data from ride-sharing platforms. Cachet.me performs queries in an automated form (API solution);
      3. user activity data are communicated to the insurance intermediary and insurers, who make a subsequent insurance offer.
      4. usage activity data is analyzed by Cachet.me to improve data and service quality;
      5. within one calendar month after the end of the term of validity of the insurance contract, Cachet.me checks whether the user operates on ride-sharing platforms so that the insurance intermediary could remind the user to enter into an insurance contract;
      6. if the user enters into a contract on the basis of the offer, the insurance contract and policy data will be stored on the platform.
      7. Cachet.me helpdesk requests are stored in the platform’s helpdesk information system.
   2. Insured event notifications are stored on the platform and forwarded to the insurer by the insurance intermediary. Cachet.me is not a claims handler.
4. PROCESSING OF PERSONAL DATA
   1. Cachet.me processes personal data for the following purposes and on the following legal basis:
      1. platform account creation and customer relations – performance of the contract;
      2. provision of technical and organizational notices by the platform – performance of the contract and legitimate interest;
      3. collecting and transmitting activity data to insurance intermediaries and insurers – each time the user agrees to make such an offer;
      4. the conclusion of insurance contracts through Cachet.me – performance of the contract;
      5. validation of activity data – legitimate interest in preventing manipulation of insurance tariffs;
      6. analysis of activity data – legitimate interest;
      7. request for usage activity data from ride-sharing platforms after the end of the insurance contract period with the aim of sending reminders to the user – legitimate interest;
      8. mediation of claims – performance of the contract.
5. RIGHTS OF THE DATA SUBJECT
   1. The User (data subject) shall have the right at any time to request:
      1. access to personal data (accessed via the platform);
      2. correction of inaccurate personal data (given that vehicle activity data is automatically collected from ride-sharing service platforms, Cachet cannot correct vehicle activity data);
      3. require the deletion of personal data (not applicable to insurance contracts and policies as they are subject to a statutory retention period);
      4. restriction of processing of personal data;
      5. transfer personal data to the controller designated by the User (only applicable to data, which Cachet.mr is the controller of);
      6. withdrawal of data-processing consent (applicable to requests made by the user).
   2. In order to exercise these rights, the user must submit a declaration to support@cachet.me. The application shall be responded to within a maximum of 30 calendar days.
6. TRANSMISSION OF PERSONAL DATA
   1. Cachet.me forwards user and object activity data to the insurance brokers, insurers and financial service providers offering services through the platform.
   2. Cachet.me makes automated inquiries, during which user identification data is transmitted to ride-sharing platforms in order to identify vehicle usage activity. Such requests shall be made at the request of the user and shall constitute an exercise of the right of transfer under Article 20 of the General Regulation on Data Protection.
   3. Cachet.me provides data on users’ insurance contracts to ride-sharing platforms to the extent necessary to ensure that the vehicle has valid insurance.
7. DISCLOSURE OF PERSONAL DATA
   1. Cachet.me will not disclose personal information to third parties unless the obligation to disclose it to the supervisory authorities arises from the law governing the respective activity.
8. DEADLINE FOR RECORDING
   1. Personal data is stored on servers located in the European Union. The user’s personal data will be retained as long as the user has an active account on the platform and the term of storage of his insurance or financial service contracts has not expired. If the user deletes the platform account or has been inactive on the Platform for the last 24 calendar months, the user’s personal data shall be deleted, except to the extent the law provides their storage.
   2. Personal data will not be deleted if there is a dispute between the user, Cachet.me or the broker,  insurer or financial service provider over the mediation and performance of the contract. In this case, the personal data will be deleted after the expiry date for claim submission.
   3. User has the right to lodge a complaint against the processing of personal data with the supervisory authority, which is the Estonian Data Protection Inspectorate (www.aki.ee). Supervision of the insurance contract and the processing of personal data of the insured event may also be performed by the supervisory authority of the insurer.