Privacy statement

Privacy Statement

Version 1.11 13-05-2026

Table of contents

1. Introduction

This Privacy Statement is relevant for visitors of our website, (future) users of Cleverbase and potential job applicants. We highly value your convenience while making use of Cleverbase. Likewise, We value the security, integrity and transparency in the handling of your personal data. With this Privacy Statement We want to inform you about what data We collect, how We collect your data, why We collect your data (for what purposes), on the basis of which principles (legal basis) and how We further handle your data (in accordance with the General Data Protection Regulation “GDPR”).

1.1. Hierarchy of Documentation

This document is written with due care. However, in case of disputes between documentation, the following hierarchy exists:

  • The privacy statement
  • The certification practice statement
  • The identity proofing service practice statement
  • PKI disclosure statement
  • The terms & conditions in Dutch
  • The terms & conditions in English
  • The product conditions in Dutch
  • The product conditions in English
  • Other public outings by Cleverbase

2. Who Are We?

Cleverbase ID B.V. (hereafter: Cleverbase or We), is an ETSI/eIDAS accredited Qualified Trust Service Provider under the supervision of the Dutch Authority for Digital Infrastructure. We are located at Maanweg 174, 2516 AB in The Hague, the Netherlands, and are registered in the Chamber of Commerce (Kamer van Koophandel), with registration number 67419925.

3. What Personal Data Does Cleverbase Process?

3.1. Types of Data

When Do We Process Your Data? How and Why Do We Process Your Data? What personal Data Do We Use? Legal Basis Retention Periods
Registering at Cleverbase In order to be register a user for Qualified Trust Services, We use your identity information to perform a correct identity verification.
We use technical data to maintain and improve the registration process. We do this for testing, incident handling, troubleshooting, technical support, and reporting.
We use your email address to contact you outside the Cleverbase app if necessary to ensure the safe use of the service.		 Identity Data:
- Personal Details: first name, surname, date of birth, place of birth, sex, nationality.
- ID data from Photo and/or NFC Chip: issue date, date of expiration, issued by, document number,document issuer, document type.
- Recording of video call between Registrant and Employee.
- Facial Photo (Selfie).
- ID Document Photo.
Technical Data: IP-address, App version, device type and operating system of the registered device.
Email address		 Agreement: When you, as a user,use or intend to use trust services from us, We necessarily need to process your personal data to do so. We also use this legal basis to provide you with necessary information about updates if you are a user of Cleverbase. Upon successful completion of the registration process: 10 years (your ip-adress 18 months). We apply this retention for compliance reasons .
If the registration process is not fully completed: 2 years. We apply this retention to potentially proof non-discriminatory grounds.
Registering at Cleverbase With consent from users, We can use one-time automated techniques to match a face with the photo on the ID document in order to verify that the registrant is the legitimate passport holder. Biometric Personal Data: automated facial matching and recognition of liveness. Consent No data is stored except for the outcome. The outcomes are a user id and result (yes/no) which are not biometric data.
Contacting Customer Support When contacting customer service with questions and requests, We record your contact details so We can assist you with your requests. Contact Data: name, email address, phone number Legitimate interest: When you, as a user, contact customer service, We need your contact details in order to respond. 18 months
Using Cleverbase Services When using Cleverbase services, We may use your email address to occasionally invite you to participate in a low-frequency, anonymous survey about your user experience. Email address Legitimate interest: Cleverbase uses a minimal data set to understand and improve the user experience. 18 months
Using the Cleverbase App When using the mobile app, We collect app data to perform statistical analyses of the Cleverbase app’s usage with the help of Firebase Analytics. Technical Data: Masked IP-address, App version, device type and operating system of the device.
All data is aggregated so that it cannot be related to an indiCleverbasel
Cleverbase has entered into a data processing agreement with Firebase Analytics and does not use any other statistical analysis services for app usage in combination with Firebase Analytics.		 Legitimate interest: Cleverbase uses a minimized amount of data to improve the user experience. 2 months
Signing with Cleverbase When signing with Cleverbase, Cleverbase shares certificate data with the signing software you use (possibly from third parties). This data is required for the signing software you use so that you can make use of Signing with Cleverbase. Signing Certificate
- Public Key Certificate
- Full Name Final User		 Agreement: When you, as a user, make use of Signing with Cleverbase, We necessarily need to process this personal data in order to provide the service. 18 months
Identifying with Cleverbase When you identify with Cleverbase, we share identity data with a requesting third party with your consent. When you are requested to share data, We display which data is requested. You consent by signing a consent declaration. Identity Data: scope of what you permit to share.

Declaration of Consent		 Agreement: When you use Identification with Cleverbase, We necessarily need to process this personal data in order to provide the service. 18 months
Applying at Cleverbase Cleverbase collects data in the context of processing job applications. We use this data to properly carry out the application procedure. Identity Information: name, date of birth, information from the resume.
Contact Information		 Legitimate interest: To conduct a proper application procedure.
Agreement, when we intend to enter into a employment agreement		 1 year after final contact in the application process.
Exercising GDPR (General Data Protection Regulation) Requests regarding the exercise of rights under the GDPR Identity data needed for identification of concerned party
Contact Information		 Legal Obligation 2 years
Revoking a Certificate The request to revoke a certificate requires identification of the interested party.
Identity data needed for identification of concerned party
Contact Information		 Legal Obligation 10 years

3.2 Processing of Personal Numbers

Cleverbase has no ground to process your personal number (BSN or other national personal numbers) and prevents the unwanted processing of personal numbers as much as possible. Depending on the nationality and the model, a personal number can be found on the front and / or back side of the plastic card. Please mask the personal number in these places before taking a photo of the document in the Cleverbase app, for example with opaque tape. For some models, the personal number is also located in the MRZ (= Machine Readable Zone), the two lines of text at the bottom of the plastic card, or the three lines of text on the back. This entire MRZ code must be readable when the document is being photographed with the Cleverbase app. We mask the MRZ with an overlay, so that We do not save it. After the photo, We ask you to also mask the personal number in the MRZ, because We cannot mask it during the video.

3.3 Website and cookies

When visiting the website, general visitor data is used to display, maintain, and improve the website as effectively as possible. We analyze how many visitors our website receives and which web pages are visites. This data cannot be traced back to you. We only use functional cookies. Contact forms you fill out on the Cleverbase website fall under “Contacting customer service.”

4. Processing of Special Personal Data

When you consent to it, Cleverbase uses automated techniques for facial matching and ’liveness’ detection during the registration process. This involves the one-time processing of biometric personal data. No special personal data is stored; the results of the processing contain ‘regular’ personal data (see 3.1). The biometric data is processed by Keyless Technologies. This supplier has taken adequate to protect the integrity and confidentiality of processing. Additional consent is requested for processing biometric personal data. Registering for Cleverbase and using Cleverbase remains possible without this specific consent. If you have questions regarding special data, you can send your request via email to klantenservice@cleverbase.com.

5. Securing Your Data

Cleverbase does everything to offer optimal security against loss and illegitimate usage of your personal data. All employees of Cleverbase who have knowledge of personal data in the context of their duties are obliged to maintain confidentiality. When We use third party processors, a proccessing agreement is in place. Your personal data will only be shared with third parties in case of necessity with regard to above mentioned purposes. Cleverbase has been evaluated by an independent auditor and is ISO27001 certified. ISO27001 is the standard for information security.

6. Your Rights

Based on the General Data Protection Regulation, you have the right to submit a request concerning the following:

  • To view your personal data.
  • To change/correct your personal data.
  • To delete your personal data.
  • To transfer your personal data to another party.
  • To stop the handling of your personal data.
  • To object the handling of your personal data.

In case you would like to invoke one of the above mentioned rights, you can do so by sending a request via klantenservice@cleverbase.com. We will inform you as soon as possible about the progress of your request.

7. Recipients of Your Personal Data

The following persons and/or authorities possibly have access to your personal data:

  • Employees of Cleverbase that are assigned to/or managing responsibilities related to the processing of personal data or the people that are involved in doing so.
  • (Sub)Processors that are involved through Cleverbase in order to execute specific tasks with regard to her provision of services.
  • Governmental bodies, such as police and justice, in case it is necessary, to comply with applicable norms and legislation.

We do not share your personal data with third parties unless you explicitly grant us permission to do so.

8. Questions

In case you have any questions related to the way We handle your privacy, or in case you would like to invoke one or more of your rights as mentioned above, please get in touch with us via email klantenservice@cleverbase.com, via post “Maanweg 174, 2516 AB Hague, the Netherlands” or via phone: +31 70 820 96 80.

9. Revisions

We are entitled to revise our Privacy Statement. We will announce this revision via our website. In case We want to radically change the underlying principles, We will actively reach out to you.

10. Dutch Data Protection Authority (AP)

We would also like to support you in case you have a complaint regarding the processing of your personal data. Based on privacy legislation, you can file a complaint with the Dutch Data Protection Authority about the processing of your personal data. This is possible via the website of the Dutch Data Protection Authority: https://www.autoriteitpersoonsgegevens.nl/en.