Claimtech privacy statement

This privacy statement explains how Claimtech B.V. processes personal data when you use our websites, Claimio, a claim scan, an account or another Claimtech service. Claimtech B.V. is established in Rijswijk, the Netherlands, and registered with the Dutch Chamber of Commerce under number 93665938.

For a specific claim program, a partner or representative organisation may act as an independent or joint controller for part of the processing. Before we share a dossier, we inform you about the organisation involved, the purpose of the transfer and the data to be shared. Questions about this statement can be sent to [email protected].

We process personal data only for defined purposes, including:

• creating, securing and managing your account;
• performing a scan initiated by you and showing possible matches;
• creating, retaining and reviewing a dossier submitted by you;
• sending necessary messages about your registration or dossier;
• transferring a dossier to a partner chosen by you and approved for the program, after the required information and authorisation have been recorded;
• handling questions, complaints and requests under the GDPR;
• securing, monitoring and improving our services and preventing misuse.

A scan result is a technical, preliminary assessment. It does not establish that you have an enforceable claim or a right to compensation.

Claim keys in the Claimio app. In the Claimio app you can add claim keys yourself: answers to short questions about yourself, your postcode, a data-breach check on your email address, your car's licence plate and a bank connection. We ask for your consent separately for each claim key. We use claim keys only to find claims and ongoing court cases that may apply to you. From a bank connection we keep only which companies relevant to a claim or case you paid, with the number of payments and the years, and no statements. You can add claim keys from the age of 16. You can give a mandate from the age of 18.

What we use from your bank and from the RDW. We search your payments only for companies that a claim on Claimio or an ongoing court case in the app asks about, and only if the period of that claim or case overlaps the period your bank or bank file shows. A bank file you choose yourself is searched by the app on your phone. The file itself does not reach us, only the hits. From your licence plate we keep what the RDW (Netherlands Vehicle Authority) publishes about the car: make, model, fuel, body type and the year of first admission. If you consented under the text that names them, we also keep the Euro emission class, the date of first admission and the date of first registration in the Netherlands. We do not keep the date on which the car was registered to its current owner.

Your bank connection. A bank connection runs through GoCardless. Through it we read your payments as far back as your bank allows, up to two years. If you consented under the text that says so, we keep the connection until your bank ends the access, usually after 90 to 180 days. That way you can use ‘Opnieuw checken’ (check again) in the app to have your payments searched again without logging in to your bank again. We only read a kept connection again when you ask for it in the app. If you remove the connection or the claim key for your bank, we end the connection at GoCardless straight away; if that does not work at once, we keep trying. Once the access has expired, we also remove the connection at GoCardless. If you consented under an earlier text, we read your payments once and end the connection after that.

We keep your claim keys until you remove them. We erase claim keys and followed cases after 24 months in which you did not view or change your claim keys or the court cases in the Claimio app. About a month before we erase claim keys, we send you a push notification as a reminder, if you receive push notifications from the app. If you view your claim keys or the court cases in the app after that, they are kept. If you have no claim keys and only follow cases, you get no reminder.

Ongoing court cases of other organisations. The Claimio app may also show you information about collective court cases of other organisations that may concern you. Claimio is not a party to those cases and does not work with the organisations that bring them. You cannot register for such a case through Claimio. We compare your claim keys with the characteristics of the case only within Claimio. We do not share your claim keys or other data with the organisation behind the case, the opposing party or anyone else. A claim key you consented to under a text that did not yet mention these court cases is used for this only after you separately consent to it in the app. A result is an estimate and not a legal judgement.

Following cases. If you follow an ongoing court case, we keep which case you follow and the status we last confirmed, so that you can look it up later. We keep this until you stop following the case, erase your claim keys or have your account deleted, or until we erase it after 24 months in which you did not view or change your claim keys or the court cases in the Claimio app. If notifications about followed cases are switched on, we send you a neutral push notification when the status we confirmed of a case you follow changes. That message does not name the case; you only see it in the app.

Notifications about possible matches. We may automatically compare your claim keys again when a claim or case is added or changes, so that you see a new possible match in the app. Only if you turn this on in the app do we also send you a push notification about it. Notifications about new ongoing court cases have a separate setting. Such a message does not name a claim or case; you only see that in the app. Both notifications are off by default and you can always turn them off again.

Checking again. If you consented in the app under a text that mentions it, we may request two claim keys again later, without you doing anything. We check your email address again with Have I Been Pwned when a claim or ongoing court case about a specific data breach is added after your last check. Here too, only your email address goes to Have I Been Pwned, a service from Australia, so outside the EEA. We only turn this repeated check on once a valid basis for that transfer is in place, such as standard contractual clauses (Article 46 GDPR); you may ask us which one. We look your licence plate up again with the RDW when a claim or ongoing court case about cars needs information about your car that we do not have yet, at most once every 90 days per car. If a check fails, the data we already had is kept. You stop this by removing the data-breach check or the licence plate under Claimsleutels (claim keys). We never read or connect your bank again without you. The app may suggest that you check again, for example when claims are added or when your bank can look further back than at your previous connection, but only you start that.

Depending on the purpose, we process personal data on the basis of your consent, performance of a contract or pre-contractual steps requested by you, a legal obligation or a legitimate interest. Where a source connection or other processing requires consent, we request that consent separately and for a specific purpose. Consent is not automatically the legal basis for every processing activity within the platform.

This statement may apply to website visitors, Claimio users, people who start a claim scan or registration, partner contacts and people whose data is supplied by an authorised partner. A partner may supply personal data only where a valid legal basis exists and the data subject has been appropriately informed.

Depending on the service selected, we may process:

• identity and contact data, such as name, address, email address and phone number;
• account, authentication and security data;
• data about a possible claim, counterparty, event and relevant period;
• documents, correspondence and other evidence supplied by you;
• data from a source connected by you, such as selected transaction or vehicle data;
• claim keys you add in the Claimio app, the ongoing court cases you follow there and your notification settings;
• consents, mandates, signatures and a history of relevant actions;
• technical data, such as session, device, security and access-log data;
• payment data where required for a specific settlement.

We do not request more data than is reasonably necessary for the relevant step.

Documents or transaction descriptions may reveal information about health, political views or other sensitive circumstances. We seek to avoid or limit such data. Where processing is nevertheless necessary, we assess the applicable legal basis, necessity, access restrictions and additional safeguards in advance. Do not upload sensitive data that is not relevant to your scan or dossier.

Where necessary, we may provide personal data to:

• service providers for hosting, storage, security, communications and support;
• DigitalOcean for hosting our services;
• Google Firebase Cloud Messaging to send push notifications to the Claimio app;
• GoCardless or another open-banking provider when you initiate a bank connection, for as long as that connection runs;
• Have I Been Pwned when you start a data-breach check on your email address yourself, and the RDW (Netherlands Vehicle Authority) when you add a licence plate as a claim key, and with your consent also again later (see ‘Checking again’ under 2);
• the claim partner, representative organisation or legal service provider chosen by you, within the recorded program and authorisation scope;
• regulators, law-enforcement bodies or other parties where required by law.

We do not sell personal data. A partner does not gain access to your dossier merely by having an account. Access requires a valid role, program assignment and the required authorisation.

Organisations behind the ongoing court cases shown in the Claimio app do not receive any data from us, not even if you follow a case.

We seek to process personal data within the European Economic Area. If a service provider processes data outside the EEA, we apply a valid transfer mechanism and the required additional safeguards. You may request information about a specific transfer.

We implement appropriate technical and organisational measures proportionate to the nature of the data and the risks of processing. These measures include access management, encryption where appropriate, logging, data minimisation, secure storage, backups and incident procedures. No digital system is entirely risk-free, and we therefore do not give an absolute security guarantee.

We retain personal data no longer than necessary for the purpose for which it was collected, unless a statutory retention duty, pending dispute, legal claim or another legitimate reason requires a longer period. The period may differ for account, dossier, evidence, communication and audit data. You may ask through your dashboard or by email which period applies to your data.

We erase claim keys and followed cases in the Claimio app after 24 months in which you did not view or change your claim keys or the court cases in the Claimio app. If you receive push notifications from the app, we send you a reminder about a month before we erase claim keys.

We end a kept bank connection at the latest when your bank ends the access, usually after 90 to 180 days, or earlier if you remove the connection. We keep its hits as a claim key, with the period above.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before that time. It may mean that a source connection, scan or other optional function is no longer available. Processing based on another valid legal basis does not automatically end when consent is withdrawn. In the Claimio app you can remove a claim key, or only a licence plate, your bank connection or a bank file. You can also turn off notifications there and stop following a case. With ‘Wis al mijn claimsleutels’ (erase all my claim keys) you erase all claim keys, the consents for them, the cases you follow and your notification settings in one go.

If you have a question or complaint about the processing of your personal data, contact us at [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority. We appreciate the opportunity to investigate your complaint first, but this is not mandatory.

To the extent provided by the GDPR, you may request information, access, rectification, erasure, restriction of processing or transfer of your data. You may also object to processing and, where applicable, request human intervention in automated decision-making. We may verify your identity and must take account of statutory retention duties and the rights of others. You may submit a request through your dashboard or at [email protected].

We may amend this privacy statement when our services, partnerships or legal obligations change. The current version and date appear on this page. Where a change has material effects, we will notify you through an appropriate channel before it takes effect, to the extent required by law.