Privacy Policy

Eye Underwriting B.V., located at Saturnusstraat 60-54, 2516 AH The Hague, is responsible for the processing of personal data as shown in this privacy statement.

This Privacy Notice sets forth the handling practices of Eye Underwriting B.V. (variously, “Eye”, “we”, “our” or “us”) and its affiliates in regard to the collection, usage and disclosure of personal data or personal information that you may provide to us through using this website (https://eye.security) (the “Website”), or by using any product or service provided by Eye (the “Services”).

When we refer to the "Eye”, we mean all Eye entities.

Eye respects your right to privacy. This Privacy Notice explains how we collect, share and use personal information about you, and how you can exercise your privacy rights. This Privacy Notice only applies to personal information that we collect through our Site at  https://eye.security and our client portal (collectively, the “Site”).

We may amend this Privacy Notice from time to time for example, to keep it up to date or to comply with legal requirements or changes in the way we operate our business. We will notify you about material changes by prominently posting a notice on our Site. We encourage you to periodically check back and review this Privacy Notice so that you will always know what information we collect, how we use it, and with whom we share it.

If you do not accept this Privacy Notice and/or do not meet and/or comply with the provisions set forth herein, then you should not use our Site.

Identity and contact details of the data controller

If you would like to receive this, or any other, notice in another format or have any questions, comments or concerns about how we use the personal data we hold about you, please contact us by email at privacy@eye.security,  or in writing at Saturnusstraat 60-54, 2516 AH, The Hague, The Netherlands.

The data controller responsible in accordance with the purposes of the General Data Protection Regulation (GDPR) and other data protection regulations is:

• Saturnusstraat 60-54
• 2516 AH The Hague The Netherlands
• +3188 644 4888
• https://eye.security

You can also contact the regulator or authority in your country that is responsible for handling complaints about the use of personal data.

I. General information on data processing

1. Scope of processing personal data

Each time our website is accessed, our system automatically collects data and relevant information from the computer system of the calling device. It is not necessary for us to collect every personal detail about you. Our main reason for collecting your personal data is to provide and improve the service, products and experiences that you and our customers expect from us.

Personal data is defined slightly differently across the world. To guarantee your privacy and the protection of your information, we comply with the definition as set forth under the GDPR, defined  as any information that could be used to identify you or another individual.

In general, we only process the personal data of our users to the extent necessary in order to provide a functioning website with our content and services. The processing of personal data regularly only takes place with the consent of the user. Exceptions include cases where prior consent technically cannot be obtained and where the processing of the data is permitted by law.

1.1. Personal data that we process

Eye processes your personal data because you use our services and/or because you provide it to us yourself.

Below you will find an overview of the personal data that we process:

• First and last name
• E-mail address
• Location data
• Browser type and version used
• The user's operating system
• The internet service provider of the user
• IP address
• Date and time of access
• Web pages from which the user’s system accessed our website
• Web pages accessed by the user’s system through our website
• The data is stored in the log files of our system. The data is not stored with the user’s other personal data.

1.2. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the IP address of the user must remain stored for the duration of the session.

The storage in logfiles is done to ensure the functionality of the website. The data is also used to optimize the website and to ensure the security of our IT systems. An analysis of the data for marketing purposes does not take place.

1.3. Who does this Privacy Notice relate to?

This Privacy Notice relates to the following types of individuals, where we hold your personal information:

• Individuals who are prospective, current or former clients (“you”);
• Employees or representatives of our prospective, current or former clients;
• Other individuals named in policy or transactional documents;
• Visitors to our websites;
• Individuals who contact us with a query, concern or complaint;
• Individuals who request information from us or permit us to contact them for marketing purposes. 

2. Legal basis for data processing

The legal basis for the temporary storage of data is Art. 6 (1) (f) GDPR.

Our main reason for collecting and using your personal data is to provide and improve the service, products and experiences that you expect from us. This section details how we use the data that we collect directly from you or indirectly from third parties, such as our retail partners.

Art. 6 (1) (a) GDPR serves as the legal basis to obtain the consent of the data subject for the processing of their data. As for the processing of personal data required for the performance of a contract of which the data subject is party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual activities.

When it is necessary to process personal data in order to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.

If vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.

If the processing of data is necessary to safeguard the legitimate interests of our company or that of a third party, and the fundamental rights and freedoms of the data subject do not outweigh the interest of the former, Art. 6 (1) (f) GDPR will serve as the legal basis for the processing of data.

3. How we protect personal data

We take appropriate technical and organisational measures (policies and procedures, IT security etc.) to ensure the confidentiality and integrity of your personal data and the way it’s processed.

We apply an internal framework of policies standards to keep your personal data safe. These policies and standards are periodically updated to keep them up to date with regulations and market developments. In addition, Eye employees are subject to confidentiality obligations and may not disclose your personal data unlawfully or unnecessarily. To help us continue to protect your personal data, you should always contact Eye if you suspect that your personal data may have been compromised.

We aim to ensure the highest possible level of protection for your personal data:

• We invest in our systems, procedures and people.
• We make sure that our working methods are in keeping with the sensitive nature of your personal data.
• We train our people how to keep your personal data safe and secure.

We take the protection of your data seriously and takes appropriate measures to prevent misuse, loss, unauthorized access, unwanted disclosure and unauthorized modification. If you have the impression that your data is not properly secured or there are indications of abuse, please contact our customer service or via privacy@eye.security.

4. Data removal and storage duration

Applicable laws require us to retain personal data for a period of time. This retention period may vary from a few months to several years, depending on the applicable law.

We only keep your personal data for as long as we need to, to be able to use it for the reasons given in this privacy notice, and for as long as we are required to keep it by law. The data will be deleted as soon as it is no longer necessary for the purpose of its collection. The session is complete when the collection of data for the provision of the website is accomplished.

The personal data of the data subject will be erased or restricted as soon as the purpose of its storage has been accomplished. Additional storage may occur if it was provided for by the European or national legislator within the EU regulations, law, or other relevant regulations to which the data controller is subject. Restriction or erasure of the data also takes place when the storage period stipulated by the aforementioned standards expires, unless there is a need to prolong the storage of the data for the purpose of concluding or fulfilling the respective contract.

The collection of data for the provision of the website as well as the storage of data in log files are essential for the operation of the website. The user can object to this. Whether the objection is successful will be determined after evaluating interests. To do so, send an informal e-mail to privacy@eye.security / info@eye.security

II. Rights of the data subject

Data protection law gives you rights relating to your personal data. This section gives you an overview of these rights and how they relate to the information you give us. The Autoriteit Persoonsgegevens has also published detailed information about your rights on their website: https://www.autoriteitpersoonsgegevens.nl/

When your personal data is processed, you are subsequently a data subject in the sense of the GDPR and have the following rights:

1. Right to information

You may request from the data controller to confirm whether your personal data is processed by them.

If such processing is the case, you can request the following information from the data controller:

• The purpose for which the personal data is processed;
• The categories of personal data being processed;
• The recipients or categories of recipients to whom the personal data relating to you have been disclosed or are still being disclosed;
• The planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
• The existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the data controller or a right to object to such processing;
• The existence of a right of appeal to a supervisory authority;
• All available information on the source of the data if the personal data is not collected from the data subject;
• The existence of automated decision-making including profiling under Art. 22 GDPR and, in certain cases, meaningful information about the data processing system involved, and the scope and intended result of such processing on the data subject.

You have the right to request information on whether your personal data will be transmitted to a third country or an international organisation. In this context, you can then request for the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have a right to rectification and/or completion of the data controller, if your processed personal data is incorrect or incomplete. The data controller must correct the data without delay.

3. Right to the restriction of processing

You may request the restriction of the processing of your personal data under the following conditions:

• If you challenge the correctness of your personal data for a period of time that enables the data controller to verify the accuracy of your personal data;
• The processing is unlawful, and you refuse the erasure of the personal data and instead demand the restriction of the use of the personal data;
• The representative no longer needs the personal data for the purpose of processing, but you need it to assert, exercise or defend legal claims; or
• If you have objected to the processing pursuant to Art. 21 (1 GDPR and it is not yet certain whether the legitimate reasons of the data controller outweigh your reasons.
• If the processing of personal data concerning you has been restricted, this data may with the exception of data storage only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest, interest to the Union, or a Member State.
• If the processing has been restricted according to the beforementioned conditions, you will be informed by the data controller before the restriction is lifted.

4. Right to erasure

a) Obligation to erase

If you request from the data controller to delete your personal data with immediate effect, they are required to do so immediately given that one of the following applies:

• Personal data concerning you is no longer necessary for the purposes for which they were collected or processed.
• You revoke your consent, to which the processing is allowed pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR and there is no other legal basis for processing the data
• According to Art. 21 (1) GDPR you object to the processing of the data given that the processing of the data is justified by a legitimate interest, or you object pursuant to Art. 21 (2) GDPR.
• Your personal data has been processed unlawfully.
• The act of deleting your personal data will invoke a legal obligation under the Union law or the law of the Member States to which the data controller is subject.
• Your personal data was collected in relation to information business services offered pursuant to Art. 8 (1) GDPR. 

b) Information to third parties

If the data controller has made your personal data public and has to delete the data pursuant to Art. 17 (1) GDPR, they shall take appropriate measures, including technical means, to inform data processors who process the personal data, that a request has been made to delete all links to such personal data or copies or replications of the personal data, taking into account available technology and implementation costs to execute the process.

c) Exceptions
The right to deletion does not exist if the processing is necessary

• to exercise the right to freedom of speech and information;
• to fulfill a legal obligation required by the law of the Union or of the Member States to which the representative is subject, or to perform a task of public interest or in the exercise of public authority delegated to the representative;
• for reasons of public interest in the field of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;
• for archival purposes of public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, to the extent that the law referred to in subparagraph (a) is likely to render impossible or seriously affect the achievement of the objectives of that processing, or
• to enforce, exercise or defend legal claims.

5. Right to information

If you have the right of rectification, erasure or restriction of processing over the data controller, they are obliged to notify all recipients to whom your personal data have been disclosed of the correction or erasure of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort.

 You reserve the right to be informed about the recipients of your data by the data controller.

6. Right to data portability

You have the right to receive your personal data given to the data controller in a structured, standard and machine-readable format. In addition, you have the right to transfer this data to another person without hindrance by the data controller who was initially given the data, given that the processing is based on a consent in accordance with Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract in accordance with Art. 6 (1) (b) GDPR and the processing is done by automated means.

In exercising this right, you also have the right to maintain that your personal data relating to you are transmitted directly from one person to another, insofar as this is technically feasible. Freedoms and rights of other persons shall not be affected.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the data controller.

7. Right to object

Subjective to your situation, you have, at any time, the right to object against the processing of your personal data pursuant to Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions.

The data controller will no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, exercising or defending legal claims.

If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data in regard to such advertising; this also applies to profiling insofar as it is associated with direct mail.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purpose.

8. Right to revoke the data protection consent declaration

You have the right to withdraw your consent at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

9. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in the Member State of their residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you violates the GDPR.

The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

III. Data sharing and third party

Whenever we share your personal data externally (i.e., outside of Eye) with third parties in countries outside of the European Economic Area (EEA) we ensure the necessary safeguards are in place to protect it. For this purpose, we rely upon, amongst others:

• Requirements based on applicable local laws and regulations.
• EU Model clauses, when applicable, we use standardised contractual clauses in agreements with service providers to ensure personal data transferred outside of the European Economic Area complies with GDPR.

1. Sharing personal data within our group

We may share your personal data within our group. Transfers of personal data between Eye entities are governed by Eye Group Framework Agreement for Data Protection.

Eye’s processes, procedures and systems are shared across the Eye-Group, which means that we need to share your personal data between our entities. We make sure that access to your personal data is limited to those of our staff who need it, and that all staff understand how and why we protect your personal data.

The relevant Eye group company or companies will collect personal data from you in the country in which you live. We will make sure that any transfers of your personal data from one country to another comply with those data protection and privacy laws which apply to us.

European data protection laws, in particular, include specific rules on transferring personal data outside the EEA.

2. Sharing personal data with other service providers

We may occasionally share your personal data with other companies or organisations outside Europe, for instance in the context of an outsourcing contract. In that case, we ensure that we have concluded separate contracts with those parties, and that these contracts comply with the European standard, such as the EU's standard contractual clauses, and additional requirements.

3. Links to third-party websites

Where applicable, we share your personal data with the following types of third parties when we have a valid reason to do so

Eye provide links to other websites which are not operated and controlled by Eye. We have no control over and are not responsible for the content of those sites or how the third parties responsible for them collect and use your personal data. We do not endorse or make any representations about third party websites.

Third party websites usually have their own privacy notices explaining how they use and share your personal data. You should carefully review those privacy notices before you use these websites to make sure that you are happy with how your personal data is being collected and shared.

4. Sharing with third parties          

Eye shares your personal data with certain third-party service providers. They only have access to the personal data they need to perform those services. Third party service providers are required to keep your personal data confidential, must not use it other than instructed by us and must always act in accordance with this privacy notice.

The third parties providing services fall into the following categories (without limitation):

• Distributors, who help us to sell our products in certain countries;
• Sub processors, such as those helping us to deliver products to you;
• Those helping us to provide you with relevant and interesting communications (e.g. social media platforms, analytics companies, marketing and advertising agencies);
• Third parties that help us with mailing services, product services and repairs, processing product purchases, financial services, audit services, administrative services, IT technologies (e.g. data storage), security services and insurance claims; and
• Third parties that help us to provide services and responses to you.

Eye shares certain personal data with third parties who help us to detect and prevent criminal activity (such as in the case of a breach). The information we share with those third parties includes some of the information that you share with us (such as your contact details and information about the transaction), and some of the information from your online interactions (such as the IP address of your device).

We will also share your personal data if we are required to do so by law, including in response to a legal process, such as a court order or subpoena, or to comply with other national, state, provincial or local laws. Finally, in the process of purchasing an Eye product you may interact with a third party who will be independently responsible for the personal data that you provide.

Changes to this Privacy Notice

We may amend this Privacy Notice to remain compliant with any changes in law and/or to reflect how our business processes personal data. If we change our Privacy Notice in a way that significantly changes how we process the personal data that we hold about you, we will also ask you to confirm and argue to those changes through the most appropriate method (e.g. in email or a notification on our Site).

This Privacy Notice was last updated and reviewed in 2022. The most recent version is always available on eye.security.

IV. Use of Cookies

Eye’s website uses functional, analytical and tracking cookies. Cookies are text files that are stored in the internet browser or the internet browser on the user’s computer system. If a user calls up a website, a cookie can be stored on the user’s operating system. These cookies contain a string of characters that allows the browser to be uniquely identified when the website is reopened.

Eye uses cookies with a purely technical functionality. We use cookies to make our website more user-friendly. Some elements of our website require the calling browser to be identified even after a page break. These ensure that the website works properly and that, for example, your preferred settings are remembered. These cookies are also used to make the website work properly and to optimize it. In addition, we place cookies that keep track of your surfing behavior so that we can offer customized content and advertisements. On your first visit to our website, we already informed you about these cookies and asked for permission to place them. You can opt out of cookies by setting your internet browser so that it no longer stores cookies. In addition, you can also delete all information that has previously been stored via the settings of your browser.  

The following data is stored and transmitted in the cookies:

• Language settings
• Log-in information
• Cookie setting
• Search queries
• Further information that is required for the provision of the website

We also use cookies on our website, which enable us to analyse the browsing behaviour of our users. As a result, the following data will be transmitted:

• User behaviour on our website
• Further information used for marketing purposes

The user data collected in this manner is pseudonymised by technical measures. It is therefore not possible to assign the data to the user accessing the site. The data is not stored together with other personal data of the users.

1. Purpose of using cookies

The purpose of using technical cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. These require that the browser is recognized even after a page change. The user data collected by technical cookies are not used to create user profiles.

The analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and thus can constantly optimize our offer.

2. Legal basis for cookies

The legal basis for the processing of personal data using non-technical cookies is Art. 6 (1) (a) GDPR. The legal basis for the processing of personal data using technical cookies is Art. 6 (1) (f) GDPR, legitimate interests. 

3. Duration of storage and possibility of objection and removal

Cookies are stored on the user's device and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that not all functions of the website can be used to their full extent.