We process personal data only on your instructions
Onesurance processes personal data exclusively on behalf of its clients, in full compliance with the GDPR. Privacy by Design is embedded in our architecture and processes.
- GDPR compliant: full compliance with the General Data Protection Regulation.
- Processor (art. 28 GDPR): Onesurance acts as processor; the client is the controller.
- DPO appointed: our Data Protection Officer is available at dpo@onesurance.ai.
You determine purpose and means, we process
Onesurance operates as a processor within the meaning of the General Data Protection Regulation (GDPR). Our clients, insurers and intermediaries, are the controllers who determine the purpose and means of processing.
Role allocation
- Onesurance = processor: we process personal data exclusively on behalf of and according to the instructions of the controller.
- Client = controller: the client determines the purpose and means of data processing.
Data Processing Agreement (DPA)
- Article 28 GDPR: a data processing agreement is concluded with each client in accordance with article 28 GDPR, detailing the obligations of both parties.
- Data processing agreement prevails: for privacy, data processing and information security, the provisions of the data processing agreement take precedence over any other terms and conditions.
Data Protection Officer
- Menno Kooistra, DPO: our Data Protection Officer can be reached at dpo@onesurance.ai for all privacy-related questions and requests.
Which personal data we process, and why
Onesurance processes various categories of personal data on behalf of insurers and intermediaries. All processing takes place within the European Union.
Categories of personal data
| Category | Examples |
|---|---|
| Personal details | Name, address, city of residence |
| Contact details | Email address, phone number |
| Date of birth | Age data for risk assessment |
| Family situation | Household composition, marital status |
| Policy number | Insurance policy number and product type |
| Claims data | Loss reports, claims history, claim status |
Processing purposes
ML predictions
Churn prediction, Customer Lifetime Value (CLV), next-best-product recommendations.
No general model training
Client data is not used for general model training or product development, not even in anonymised form, unless otherwise agreed in the data processing agreement.
100% EU processing
All data processing takes place exclusively within the European Union.
Every GDPR right supported, requests forwarded within 48 hours
Onesurance supports all data subject rights as established under the GDPR. As the client is the controller, we forward data subject requests to the client within 48 hours and assist with handling them.
GDPR rights
| Right | Article | What it means |
|---|---|---|
| Right of access | Art. 15 | Data subjects can request which personal data is being processed. |
| Right to rectification | Art. 16 | Inaccurate personal data is corrected upon request. |
| Right to erasure | Art. 17 | Personal data is deleted upon request where no statutory retention obligation applies. |
| Right to restriction | Art. 18 | Processing can be restricted upon request in specific cases. |
| Right to data portability | Art. 20 | Personal data is provided upon request in a structured, machine-readable format. |
| Right to object | Art. 21 | Data subjects can object to the processing of their data. |
Submitting a request
Forwarded within 48 hours
We forward every request to the relevant client within 48 hours.
The client responds
As controller, the client responds within the GDPR time limits.
Privacy built into the design, not added as an afterthought
Onesurance employs comprehensive technical and organisational measures to protect personal data, in accordance with the principles of Privacy by Design and Privacy by Default.
Privacy by Design and DPIA
- Privacy by Design: privacy protection is built into the design of all systems and processes, not added as an afterthought.
- Data Protection Impact Assessment (DPIA): for high-risk processing activities, a DPIA is conducted in advance to identify and mitigate risks.
Pseudonymisation and anonymisation
- Pseudonymisation: personal identifiers are pseudonymised to prevent direct identification.
- Data minimisation: only the data required for the agreed services is processed; any additional data received is not used substantively.
Encryption and access control
- Encryption at rest: stored personal data is encrypted with controlled key access.
- Encryption in transit: communications are secured with modern transport protocols; details available on request under NDA.
- RBAC + MFA: personal accounts, role-based access based on least privilege, and multi-factor authentication where technically available.
Your data stays within the European Union
Onesurance processes and stores all data exclusively within the European Union. No transfers of personal data to countries outside the EU take place.
EU data residency
- 100% EU data residency: personal data is stored, processed and made accessible exclusively within the European Union. This also applies to backups, logging, prompts, model input and model output.
- No transfers outside the EU: Onesurance does not transfer personal data to third countries or international organisations outside the EU.
Sub-processors
- Same EU obligations: Onesurance contractually imposes the obligation to process exclusively within the European Union on its sub-processors.
Questions about privacy or your rights as a data subject?
Our Data Protection Officer is happy to assist you with questions about privacy, data processing or your rights as a data subject.