Privacy

Enrisq Privacy Policy

Example draft — not legal advice. This template assumes an EU/EEA context. Replace all bracketed fields and confirm that every statement matches your actual practices before publishing.

Last updated: [date]

1. Who we are

[Legal company name], trading as Enrisq, provides tools that enrich uploaded object information and support insurance workflows, including integrations with systems such as ANVA. Our registered address is [address]. For questions about personal data, contact [privacy email]. [Add data protection officer details if applicable.]

2. When this policy applies

This policy explains how we handle personal data when you visit our website, contact us, or use our services. We act as a controller for information used to manage our own business, website, and customer relationships. Where we process uploaded data on a business customer’s instructions, we act as a processor under a separate data processing agreement. For requests concerning that data, contact the business that provided it; we will assist where required. [Confirm these roles.]

3. Information we collect

Depending on how you interact with us, we may process:

• Contact and account details: name, work email, company, role, and account identifiers.
• Uploaded content: spreadsheets, object descriptions, photographs, and related insurance information. These may contain personal data if included by you or your organisation.
• Service and technical data: IP address, device and browser information, timestamps, access logs, and integration activity.
• Communications and billing details: support messages, correspondence, and relevant invoicing information.

Information may come from you, your organisation, connected systems, or [identify any external enrichment sources and the personal data obtained from them]. Upload only information you are authorised to share, and avoid unnecessary sensitive personal data.

4. Why we use information

For processing where we are the controller, the purposes and legal bases may include:

• Providing accounts and services, and managing contracts — performance of a contract where you are a party to it, or legitimate interests in serving your organisation.
• Responding to enquiries and providing support — legitimate interests in communicating with customers and resolving issues.
• Protecting the service and investigating misuse — legitimate interests in security and fraud prevention.
• Keeping required financial records — compliance with legal obligations.
• Sending optional marketing or using non-essential tracking — consent where legally required.

[Confirm each purpose and legal basis, explain applicable legitimate interests, and remove activities you do not carry out.] You may withdraw consent at any time without affecting the lawfulness of earlier processing.

5. Automation and AI-assisted processing

Our service may analyse uploaded photographs and object information to enrich records and support policy selection and transfers into connected systems. [Describe the actual technology, external providers, human review, and whether uploaded data is used to train models.]

[Confirm whether any solely automated decision produces legal or similarly significant effects for individuals. If so, explain its legal basis, meaningful information about its logic and consequences, and applicable rights to human intervention and to contest the decision.]

6. Who receives information

We may share relevant information with authorised service providers supporting [hosting, support, payments, and other actual functions], connected systems selected by your organisation, and authorities where legally required. Providers receive access appropriate to their role and are subject to applicable contractual safeguards. [Identify recipients or categories, including enrichment and AI providers, and confirm any other disclosures.]

7. International transfers

[State where data is stored and accessed.] If personal data is transferred outside the EEA, we use applicable safeguards, such as an adequacy decision or Standard Contractual Clauses, where required. Contact [privacy email] for information about relevant safeguards and how to obtain a copy.

8. Retention and security

We retain personal data only as long as needed for the purposes described, legal obligations, or the establishment or defence of legal claims. [Specify retention periods or clear criteria for accounts, uploads, logs, backups, and billing records.] Customer-controlled uploads are retained or deleted according to the applicable agreement.

We use appropriate technical and organisational measures designed to protect personal data. [Confirm and describe relevant measures.] No system can guarantee absolute security.

9. Cookies

[Describe the cookies and similar technologies actually used, their purposes, providers, and durations.] Where consent is required, non-essential technologies are used only after consent. You can change your preferences through [cookie settings link].

10. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data, and object to certain processing, including direct marketing. You may also withdraw consent. Contact [privacy email]; we may need to verify your identity and will respond within applicable legal time limits.

You may complain to your local data protection authority. [If applicable, include the Dutch Autoriteit Persoonsgegevens and its contact details.]

11. Changes and contact

We may update this policy to reflect changes in our services or legal requirements. We will publish the updated version with a revised date and provide further notice where required.

Privacy contact: [legal company name], [postal address], [privacy email].