Processing of personal data

Version 1.1 – 20.11.2023

Cachet OÜ, address Tatari tn 64,, Tallinn 10134, Estonia, registry code 14560702 (hereinafter “Cachet”) processes personal data of individuals who use the information society service cachet.me.

1. GENERAL PROVISIONS
   1. Cachet ensures that the processing of personal data is in accordance with the legislation regarding the protection and security of personal data (including the General Data Protection Regulation of the European Union, hereinafter, “GDPR”), other personal data protection legislation, and good business practices.
   2. Cachet considers the privacy of individuals and the protection of their data important and makes the best efforts to ensure the security and protection of the information system and other data carriers.
2. DEFINITIONS
   1. User means a person who signs up for the Platform or uses the services provided on the Platform.
   2. Processing of personal data means viewing, collecting, saving, storing, altering, transmitting, or receiving personal data and other activities related to personal data.
   3. Platform means the web service at https://Cachet.me/ and the mobile applications through which insurance intermediaries market and mediate the insurance contract to the Users.
   4. Services means the account management and data exchange services provided by Cachet via the Platform.
3. PURPOSE OF THE PROCESSING OF PERSONAL DATA AND ITS LEGAL BASIS
   1. Cachet processes personal data necessary for the management of the accounts of the Users of the Platform and for the collection of data on the activity of the use of the object of insurance.
   2. In general, the legal basis for such a purpose is carried out in accordance with Article 6(1)(b) of the GDPR. Such processing is necessary for the performance of a contract to which the User is a party or in order to take such steps at the specific request of the User prior to entering into a contract. Sometimes the processing of data is necessary for legitimate interests under Article 6(1)(f) of the GDPR provided those interests are not outweighed by the Users’ rights and interests.
      

      Processing activity (controller)	Data categories	Purpose	Legal basis
      Creating accounts	User identification data, name, surname, personal identification number, telephone number, e-mail address and country of residence	Providing the Platform	Contract
      Platform usage Data	Helpdesk requests, alerts, and account logs	Customer support	Contract, legitimate interest
      Request to ride-hailing data owners	Vehicle registration number and activity data (start and end of the trip, length of the trip, location with city accuracy) data. User activity data can be viewed by the User on the Platform account	Providing data for the insurance intermediaries	Consent (data retransmission request issued by the data subject)
      Service updates	Name, e-mail address	Customer support	Legitimate interest
      Newsletters	Name, e-mail address	Marketing	Consent
      Reminders and notifications	The activity of the User’s vehicle on the ride-sharing platforms after the end of the insurance contract	Notification	Legitimate interest

      
      

      Processing activity (processor)	Data categories	Purpose	Legal basis
      Storing the insurance contracts	Name, personal identification code, contact information (telephone number, e-mail address), data of beneficiaries and insured persons	Data hosting and access	DPA provided by the insurance intermediary
      Payment data	The bank account number, payment data, invoice or payment notification data and other payment data	Payment management for insurance intermediaries	DPA provided by the insurance intermediaries

      
      

      Processing activity (sub-processor)	Data categories	Purpose	Legal basis
      Storing the data of insurance events	Data on insurance events, time, place, circumstances, insurance indemnity, repair, amount of loss, refusal to indemnify and other data	Management of insurance events	DPA provided by the insurance intermediaries

4. HOW CACHET COLLECTS AND USES PERSONAL DATA
   1. Cachet collects personal information on the Platform as follows:
      1. the User enters the data necessary for creating an account on the Platform.
      2. the User authorizes Cachet to make inquiries for the collection of user activity data for insurance contracts, e.g. usage activity data from gig economy platforms. Cachet performs queries in an automated form (API solution) or by making individual requests;
      3. User activity data are communicated to the insurance intermediary and insurers, who make a subsequent insurance offer.
      4. usage activity data is analyzed by Cachet to improve data and service quality;
      5. after the end of the term of validity of the insurance contract, Cachet checks whether the User operates on gig economy platforms so that the insurance intermediary could remind the User to enter into an insurance contract;
      6. if the User enters into a contract on the basis of the offer, the insurance contract and policy data will be stored on the Platform.
      7. Cachet helpdesk requests are stored in the Platform’s helpdesk information system.
   2. Insurance event notifications are stored on the Platform and forwarded to the insurer by the insurance intermediary. Cachet is not a claim handler.
5. TRANSMISSION AND STORAGE OF THE PERSONAL DATA
   1. Cachet forwards User and object activity data to the insurance intermediaries and insurers who are offering services through the Platform.
   2. Cachet makes automated inquiries, during which User identification data is transmitted to ride-sharing platforms in order to identify vehicle usage activity. Such requests shall be made at the request of the User and shall constitute an exercise of the right of transfer under Article 20 of the General Regulation on Data Protection.
   3. Cachet provides Users’ insurance contracts data to ride-sharing platforms to the extent necessary to ensure that the vehicle has valid insurance.
   4. Cachet Broker processes personal data in the European Union (EU) and within the European Economic Area (EEA). Cachet receives, transmits, and processes personal data only digitally.
6. DISCLOSURE OF PERSONAL DATA
   1. Cachet will disclose personal data to all insurance intermediaries under the terms and conditions provided in the Data Processing Agreements. Users can receive additional information about Cachet partners (insurance intermediaries) on the Platform.
   2. Cachet is providing second-level customer support services to its insurance intermediaries. In the event a User’s request falls outside the competence of the first-line support, then the second-level customer support service is provided by the IT team of the Cachet.
7. RETENTION AND DELETION OF PERSONAL DATA
   1. The storage period of personal data depends on the legal obligations to store data (i.e. accounting regulations), contractual obligations, and legitimate interest or consent to provide the best services.
      

      Data type	Purpose	Retention time	Legal basis
      Insurance contracts	The personal data will be retained as long as the User has an active account on the Platform and the term of storage of his insurance service contracts has not expired	The personal data will be retained as long as the User has an active account on the Platform and the term of storage of his insurance service contracts has not expired	Contract
      History of the insurance contracts	Personal data will not be deleted if there is a dispute between the User, Cachet or the insurance intermediary, insurer over the mediation and performance of the contract	The personal data will be deleted after the expiry date for claim submission	Legitimate interest
      Account	Account management	If no purchases are made by the User, the account will be deleted after 24 months since the sign-up	Legitimate interest
      Payment data	Accounting	Seven years since the payment is made	Legal obligation
      Insurance events	Providing information to the insurance intermediaries	Three years since the information was provided to insurance intermediaries	Legitimate interest
      Email address, newsletter consent	Marketing	Until withdrawal of consent	Consent

8. DATA CONTROLLER AND DATA PROCESSOR
   1. Cachet is the controller of the data processing necessary for the management of the accounts of the Users of the Platform and the collection of data on the activity of the use of the object of insurance.
   2. Cachet is a processor for data on storing the insurance contracts, insurance offers, insurance premiums and insurance contract performance, and
   3. Cachet is a sub-processor on insurance contracts, including claims and indemnities provided for insurers via the Platform
   4. nsurance intermediaries are processors of personal data in connection with the conclusion of a brokerage contract and the submission of a comparative insurance offer, the corresponding data processing notice is attached on the Platform under the terms and conditions of the insurance intermediary.
   5. Insurers are controllers of data processing, the conditions of processing their personal data are published on the Platform as a reference to the respective service.
9. RIGHTS OF THE USER (DATA SUBJECT)
   1. The User (data subject) shall have the right at any time to request:
      1. access to personal data (accessed via the Platform);
      2. correction of inaccurate personal data (given that vehicle activity data is automatically collected from gig economy platforms, Cachet cannot correct activity data);
      3. require the deletion of personal data (not applicable to insurance contracts and policies as they are subject to a statutory retention period);
      4. restriction of processing of personal data;
      5. transfer personal data to the controller designated by the User (only applicable to data, which Cachet is the controller);
      6. withdrawal of data-processing consent (applicable to requests made by the User).
   2. In order to exercise these rights, the User must submit a declaration to support@cachet.me. The application shall be responded to within a maximum of 30 calendar days.
   3. The User has the right to lodge a complaint against the processing of personal data with the supervisory authority, which is the Estonian Data Protection Inspectorate (www.aki.ee). Supervision of the insurance contract and the processing of personal data of the insured event may also be performed by the supervisory authority of the insurer.
10. CHANGES AND VALIDITY
    1. Cachet has the right to change the conditions for processing personal data. In the event, that there are substantial changes, Cachet will provide at least 1 (one) month’s notice in advance through the Platform before the substantial changes take effect.
    2. The conditions for processing personal data are valid from 1st June 2022.