Digidentity

eHerkenning is similar to DigiD. Just like citizens can use DigiD to login with the government agencies, companies, entrepreneurs and professionals can do that with eHerkenning.

An eHerkenning tool is person-bound. It cannot be transferred to someone else, such as a colleague. As user of eHerkenning, you can be authorised by your supervisor to act on behalf of your company with your service providers. 1 or more authorisations are registered when applying for a tool.

€0.75

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

€9 ex VAT per year

Request EH1

€1.75

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

€21 ex VAT per year

Request EH2+

€3.00

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

With BSN check on Dutch ID document

€36 ex VAT per year

Request EH3 / Id3

€6.00

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

One time cost €17.50 for the face-to-face check

€72 ex VAT per year

Request EH3

€6.00

per employee

per company

per month

No extra costs

Minimum contract period 12 months

Yearly billing

One time cost €17.50 for the face-to-face check

€72 ex VAT per year

Request EH4

Physical identification

An eHerkenning tool can be requested online. For an eHerkenning tool with assurance level 3 and 4, a face-to-face check is also required. This happens at our office or at the customer's location.

Signatures on contracts, employment agreements, purchase agreements, leases, living wills, tenders, policies, building plans and other documents no longer need to be handwritten on paper. These documents can be attested by a digital signature.

Using eSGNG by Digidentity, you can digitally sign PDF documents in a legal valid way. This digital signature also ensures that the document has not been edited afterwards.

You can download the eSGNG app from the app store on a tablet, it is also available as a web application, or you can integrate the functionality into your own workflow.

Benefits

Ease: The signatory can conduct his or her business fully digitally at any location and at any time. The signatory can simply sign using his or her mobile phone, laptop, desktop computer, or tablet. eSGNG allows for multiple signatories. Having an eSGNG account allows them to notified when a document is ready for signing and you will receive a message as soon as everyone has signed the document.
Cost savings: Thanks to digital signing, save money by reducing printing on paper, administrative actions and mail.
Time saving: Reduce operational costs and put an end to manual processes. This way, you will no longer need to send prompt notes or follow up by phone: If a signatory still lingers over your contract, you can send them a fast reminder through eSGNG (in the app). This will save you time and effort.
Safe: We are fully compliant with the latest security standards .
Legal validity: The qualified digital signature is 100% legally valid, it is legally equivalent to a handwritten signature.
Environmentally friendly: No paper, printing or mail.

What is an electronic or digital signature?

An electronic or digital signature is equivalent to a hand-written signature. An electronic signature consists of cryptographic electronic data that are attached to a digital document.

The purpose of an electronic or digital signature is to establish:

the identity of the sender (authenticity and identification) and§
the invariability of the information sent (integrity).

The app eSGNG

You can download the eSGNG app from the app store on a tablet (and it is also available as a web application). Once you have signed in with your Digidentity account, you can start using eSGNG right away.

Integrating digital signatures into the workflow

Alternatively, you can choose to integrate digital signatures into the existing workflow of your company or organization. Send, sign and share immediately from the applications that you are already using.

We provide a user-friendly integration of digital signatures into your own application (Application Programming Interface, API). This could be a portal, a mobile app, document management system (DMS) or any other application in which documents need to be signed in a straightforward and legally valid way.

So:

no separate application, but entering digital signatures directly from the trusted custom applications and
signing large volumes.

Types of signatures and legal validity

There are three types of electronic signatures:

Get started quickly using eSGNG Basic with a digital signature. You can use this electronic signature to sign your insurance policy for example: Once you pay the insurer the premium and they have your address details, this type offers sufficient reliability (and legally valid).
eSGNG Advanced is a legally valid digital signature. The advanced digital signature provides a high degree of reliability and offers legal certainty, because the identity of the signer has been established and attested to by us. This signature is used, for instance, to file your tax return.
With eSGNG Qualified you have the most reliable digital signature. It is a qualified digital signature that is legally equivalent to a handwritten signature. In the case of a legal dispute, the contrary must be proven.

eIDAS

This arrangement is known as the eIDAS Regulation. eIDAS is the acronym for ‘Electronic Identification and Trust Services (for electronic transactions in the Internal Market)’, referring to the eIDAS Regulation no. 910/2014 of the European Parliament.

European member states have agreed to use the same concepts, arrangements and infrastructure with regard to access to online services. This ensures that the levels of reliability of the login schemes used within the European Union are aligned. The various arrangements have been enshrined in the eIDAS Regulation.

This regulation promotes cross-border services and trade between citizens and businesses in the European member states.

The eIDAS Regulation became effective on 17 September 2014. As from September 2018, the mutual recognition of notified member state eIDs is mandatory.

Digital services

eIDAS renders digital services accessible to Europeans residing in the Netherlands. Expats, foreign students and seasonal workers do not need to apply for a Dutch DigiD, but can log in using their own eID instead, for instance to apply for a parking permit or to inform their municipality they have moved.

National login schemes or eIDs

In the Netherlands, we use DigiD, eHerkenning or Idensys. The Fins use a Mobiilivarmenne or FINeID; in Denmark, one can log in using a NemID; and in Spain, citizens use a Documento Nacional de Identidad electrónico (DNIe).

Incoming and outgoing traffic

The regulation consists of two parts, i.e. incoming and outgoing traffic.

Incoming traffic

European citizens using their national login scheme to log in to Dutch service providers. For instance, expats can already log in to the portal of the municipality of Wassenaar by means of their own national login ID in order to access their personal data. This section of the regulation is mandatory for Dutch public organisation.

Outgoing traffic

Dutch citizens logging in to service providers elsewhere in Europe using a notified login scheme (recognised by Europe). This part of the regulation is not mandatory However, DigiD, eHerkenning and Idensys intend to have their login schemes notified. This will render them suitable for logging in to all European government services.

Regulation concerns the entire public sector

Since all member states must implement the mandatory section of the regulation, so – obviously – must the Netherlands. The public sector is at the forefront of this development, as the European measure is binding for all public organisations (i.e. those offering digital services involving online authentication and accepting login schemes with 'substantial' and 'high' levels of reliability). Apart from this, private organisations performing public tasks likewise need to comply with the regulation. Thus, the regulation concerns ministries, implementing organisations such as RDW and UWV, municipalities, provinces, district water boards, but also private independent administrative bodies (ZBOs), academic hospitals and pension funds.

On 25 July 2017, the Dutch Ministry of Economic Affairs issued an administrative letter on eIDAS (only Dutch). This letter informs 808 public organisations and private organisations performing a public duty regarding the eIDAS regulation. If your organisation received this letter, you are obliged to comply with this European regulation.

What does your organisation need to do to comply with the obligation?

In the Netherlands, you can comply with the eIDAS obligation for online access through the eHerkenning | Idensys system. This means that by connecting to an eHerkenning | Idensys broker you will comply with the obligation to grant EU citizens online access to your service. As accredited brokers, we are able to arrange this connection for you.

Are you already connected to eHerkenning | Idensys? Then you are part-way to complying with the measure.

Are you participating in DigiD? In that case, we can arrange a connection to eHerkenning | Idensys for you.

Please contact us to find out which steps you need to take.

What is the advantage of the eIDAS regulation for my organisation?

Prior to the eIDAS regulation, your customer service was tasked with the administrative processing of European citizens, consumers and company representatives. These administrative processes were often long-winded and complex compared to the digital services that were already being provided for Dutch citizens, consumers and company representatives. Thanks to the eIDAS regulation, public services providers will be able to render services to European citizens, consumers and company representatives more easily and more cheaply.

Trust services

The European Union's eIDAS legislation goes beyond electronic identification.

Trust services are electronic services, usually provided for remuneration, which comprise the following:

creating, verifying and validating electronic signatures, electronic seals or electronic time stamps, services for electronic registered delivery and certificates related to those services; or
creating, verifying and validating certificates for website authentication; or
preserving electronic signatures, seals or certificates related to those services (article 3, under 16, eIDAS Regulation).

Trust services are understood to mean:

electronic signatures (also called digital signature, e-signature or e-sign);
electronic seals;
electronic time stamps;
services for registered delivery;
electronic certificates for website authentication.

With regard to trust services, a distinction is made between qualified and non-qualified services. In principle, a non-qualified supplier is any supplier offering such a service. A qualified provider is a provider that offers services with a higher level of reliability.

The change that probably impacts on the providers of such services most is the new notification requirement and duty of care. As from 1 July 2016, providers of both qualified and non-qualified trust services are to report incidents with a significant impact to the supervisory body (the Authority for Consumers and Markets – the ACM) and, where appropriate, also to the Dutch Data Protection Authority (AP) and the National Cyber Security Centre (NCSC). Moreover, there are enhanced supervision and security requirements. For instance, qualified trust service providers are to carry out annual security audits and submit their results to the supervisory body.

Are you a trust service provider and do you want to find out what this means to your organisation and which measures you need to take? Please contact us. We are happy to help you!

Certified Trusted Service Provider

Digidentity is a certified Trusted Service Provider (TSP). As objective organisation, we provide commercial reliability with digital transactions. We do this with commercial and technical security services.

A TSP has technical and legally reliable resources for performing and facilitating electronic transactions, and for producing objective evidence in case of disputes.

Periodic audits

As neutral facilitator, it is important to us to control our processes. To guarantee this control, Digidentity is periodically audited according to the norms of ETSI EN 319 411-1, ETSI EN 319 411-2 and ISO 27001:2013.

For more information, read the general terms and conditions of Digidentity and the Certificate Practice Statements of PKIgovernment.

Highest safety standards

We comply with the strictest safety standards and are authorised to provide digital identities. The information that we send via the internet is secured on a very high level.

We are thus not only a Trusted Service Provider, but also a Certification Authority and hold a PKIgovernment certificate. Our organisation, systems and employees are periodically audited and found acceptable by BSI. This happens conform the CWA requirements.

Our certifications

BSI - ISO/IEC 27001:2013

Delivery of Identity Services, Digital Signing and Certificate Services by the processes Registration, Dessimination, Authorisation, Broker and Revocation Service, IT Operations and Development.

BSIGroup.com Certificate ISC 066

BSI - ETSI EN 319 411-1

Trust Service Providers issuing certificates; Part 1: General requirements

Providing Certification Authority processes and services under the Staat der Nederlanden Root CA-G2, the Staat der Nederlanden Organisatie CA-G2 and the Staat der Nederlanden Burger CA-G2.

BSIGroup.com Certificate ETS 043

BSI - ETSI EN 319 411-2

Trust Service Providers issuing certificates; Part 2: Requirements for Trust Service Providers issuing EU qualified certificates

Providing Certification Authority processes and services under the Staat der Nederlanden Root CA-G2, the Staat der Nederlanden Organisatie CA-G2 and the Staat der Nederlanden Burger CA-G2.

BSIGroup.com Certificate ETS 015

PKIgovernment

Public Key Infrastructure for the government, in short PKIgovernment, enable reliable communication. PKI certificates secure the information that persons and organisations send via internet on a high level of reliability.

Logius.nl

eHerkenning

We are officially recognised by the eHerkenning administration organisation, part of the minister of Economic Affairs, as eHerkenning broker. This means that we can offer services and solutions for the total playing field of eHerkenning, the successor of DigiD for companies.

eHerkenning.nl

Idensys

Login safely on the internet. This is very important when doing business with the municipality, the Tax department or a health care insurer online. This is also important when you shop or bank online. The government and enterprises thus work together to safely login on the internet. The new way of logging in is called Idensys.

idensys.nl

tScheme

tScheme is the independent, industry-led, self-regulating system set up to create strict assessment criteria based on which the Trust Services will be approved.

tScheme.org

About us
1. Digidentity BV is a registered company in the Netherlands, with company number 27322631, situated at Waldorpstraat 17 P (2521 CA) in The Hague, the Netherlands.
2. If you have any questions about the identity service, you can consult our website (www.digidentity.eu/en) or contact the Service Desk via phone (+44‐330 60 60 732) or e‐mail (helpdesk@digidentity.co.uk).
Contract and Scope of Application
1. You agree to these terms and conditions by applying for an identity account via Digidentity. The terms and conditions will continue to apply whether or not the verification of your identity is successful.
2. The present terms and conditions exclude any other terms and conditions. The present terms and conditions will apply to all aspects of the relationship and the contract between you and Digidentity, unless Digidentity has otherwise expressly agreed to in writing. Unconditional acceptance and agreement of these terms and conditions is implied.
3. Digidentity reserves the right to modify the terms and conditions at all times. The modified terms and conditions will apply as soon as Digidentity has published them on the website. Digidentity will inform you of any changes via notifications on the website and/or by notifications in your identity account.
4. If you are not in agreement with any modified or revised Digidentity terms and conditions, you can no longer use the Digidentity Identity Services. In that case, please clicking the "delete" button in your identity account.
The Identity Service
1. Once you apply for an identity account, the process of verification will begin immediately. This process includes the validation of documents and data that you and other sources have provided. If the completed verification process results in a confirmation and/or validation, the fully verified identity account will be provided. The decision to grant an identity account remains exclusively with Digidentity at all times.
2. If Digidentity grants you an identity account, you can log in using a free mobile/tablet app. Your login details are strictly personal and confidential. Sharing this information with any other person or entity is not permitted. You must take all reasonable measures to prevent the abuse, misuse, theft, or loss of your login details.
3. Digidentity will store documentation and information that you and other sources have provided for the verification of identity. Digidentity will store this information in accordance with appropriate data protection laws as set out in our privacy policy. After Digidentity has issued a fully verified identity account, and provided the means to access personal identity accounts, Digidentity will need to re‐validate your existing information/data via the relevant issuing authorities from time to time. This is necessary to ensure that Digidentity have the most up‐to‐date data available for the purposes of identity verification.
Termination
1. You may deactivate identity accounts at any time by using the "deactivation" button in your identity account. A 30-day 'cool-off' period is required, as set out in our privacy notice. If you wish to reactivate your account, you can log back in within 30 days after requesting deactivation. If you have not reactivated your account within those 30 days, you will no longer be able to use the account. Relevant records will be kept for the purposes of auditing, in accordance with appropriate laws.
2. Digidentity reserves the right to deactivate accounts with immediate effect if there is any reason to believe or suspect that the verification and/or validation provided is no longer correct, or has been faulty, false or fraudulent as set out in the privacy policy. If you want to continue using an identity account, you will need to apply for a new account. Digidentity will refer any fraudulent activity to the relevant authorities. On behalf of the Identity service, we may also report any suspicious activities to any relevant body or appropriate authority.
3. Digidentity reserves the right to deactivate accounts with immediate effect if it considers communications from a user to Digidentity employees to be harassing, threatening, abusive. As far as Digidentity is concerned, this makes it impossible to provide reasonable services in support of applications for identity verification. Digidentity will report any continuation of abusive, threatening or harassing behaviour to the appropriate authorities.
Our Obligations
1. Digidentity will provide the identity service as described on the website in accordance with the terms and conditions, the associated privacy notice and Good Industry Practice. In the provision of identity verification Digidentity will act diligently and with reasonable care. Digidentity will carry out any contractual obligations involving efforts in verification processes. However, these obligations are no guarantee for a successful outcome in your application for an identity account.
2. Digidentity aims to provide a continuously functioning and accessible identity service, but makes no guarantees about the availability of any services provided. You accept the fact that (temporary) errors may occur which would render the service inaccessible on some occasions.
3. Digidentity reserves the right to limit access to, or render the identity service entirely inaccessible for limited periods of time in order to carry out maintenance and/or implementation of required modifications. Digidentity aims to carry out these scheduled 'down times' in periods which could be reasonably considered to affect the minimum number of users as far as possible, e.g. outside of office hours.
4. Digidentity will provide the service in accordance with the published Digidentity Privacy Policy. This Privacy Policy is accessible from the website. Digidentity will update its Privacy Policy from time to time to reflect changes to data processing in relation to the service.
Your Obligations
1. The moment you apply for the verification of identity, we shall ask you to submit centain personal data, including contact data, an identity document and banking details. You will understand and accept that Digidentity will not be able to process your request if you do not submit these data, since we need them to fulfil our authentication and authorisation services. At the moment of registering, Digidentity will also ask you to transfer £ 0.00 from your bank account. Thus, we can verify whether the bank account number you submitted for direct debit purposes is really yours and check your creditworthiness to verify if you are capable of paying your bills. In our Privacy Policy, you can find further information about the warranties Digidentity makes regarding its processing of your personal data.
2. You understand that verification of identity is a process that relies on personal data, available documentation and information provided by you, and is uniquely based on your own data. You accept that this identity verification process cannot be based on other user experiences or requirements.
3. You ensure and guarantee that all data, documentation and information provided is correct, complete, accurate and up‐to‐date, and that it conforms to the requirements as set out by Digidentity during the process of identity verification. You will update your online profile if changes occur in the data you have submitted upon registering. You will follow instructions and requirements for any transfer of data (via the online process, or using the mobile/tablet application) that Digidentity indicates.
4. You agree to inform Digidentity immediately if there are any security concerns, security issues or data leaks. Digidentity will treat any report of this information as strictly confidential, and will handle it in accordance with appropriate laws and regulations to minimise damage to the affected users, to Digidentity or relying parties. Digidentity aims to resolve any security alerts or hazards as fast as reasonably possible and will take steps to inform any third parties that the issue affects.
5. You accept the obligation to inform Digidentity of any violation of the terms described in articles 6, 8 and 9, adding a detailed description of such violation and any other relevant information. You must take all reasonable measures to prevent further and/or continuing violations and will take all reasonable measures to limit any damage resulting from such a violation.
Reasonable Use of Website and associated materials
1. It is forbidden to copy, pass on, sell, publish or make a profit from any content of the website, products, services or associated materials of Digidentity.
2. It is forbidden to use the website, products or associated materials of Digidentity in any way that causes, or may cause, damage to the website or impairment of the performance, availability or accessibility of the website, products or associated materials.
3. It is forbidden to access the Digidentity website and associated materials using any robot, spider or other automated means.
Personal Data
1. You acknowledge that the identity service is an authentication and authorisation service and you understand that Digidentity will process certain personal data to establish an identity and to verify the validity of personal data or documents. Digidentity is the Data Controller as defined under the EU General Data Protection Regulation (GDPR) and will process the personal data with due care, in compliance with any applicable data protection laws including the GDPR, and these terms & conditions, unless otherwise agreed upon.
2. To this end, Digidentity may only process the personal data in order to perform its duties under the contract with you and to create and maintain a direct relationship with you as indicated in the privacy policy. For the avoidance of doubt: this includes comparing and checking the data against databases (public or otherwise) that are available for the purpose. Digidentity will not process the personal data for other purposes, unless the processing is required on the basis of a legal obligation or a court order, or if you have given your consent.
3. In order to perform its duties under the contract, Digidentity will involve relying parties in the processing of personal data. Digidentity will take appropriate measures to ensure that these relying parties will process personal data in accordance with the applicable data protection laws including the GDPR.
Confidentiality
1. Digidentity and you are obliged to take all reasonable measures to protect confidential information or the identity account from unauthorised access, loss, damage, modification or unauthorised processing. In the event that such an issue occurs, you must immediately inform Digidentity of any such unauthorised access, loss, damage, modification or unauthorised processing.
Rights of Ownership and Intellectual Property
1. At all times, any intellectual property rights that have to do with the identity service, or associated materials remain the property of Digidentity, the licensee or our supplier.
2. Your right to use the identity service or associated materials does not entitle you to any intellectual property rights of the identity service or associated materials. Digidentity only provides a non‐exclusive right to use the identity service and/or associated materials to verify your identity and create an account. Your usage rights are strictly personal and cannot be transferred to any other person.
3. It is forbidden to use (part of) the identity service, data or associated materials in any way that would result in the violation of intellectual property rights of Digidentity, the licensee or suppliers.
4. Digidentity reserves the right to take all necessary measures to protect their own, the licensee's or suppliers' intellectual property rights. These measures include ending the use of the identity service or associated materials when the contract ends. It is forbidden to use, remove or avoid any such measures in any way.
Liabilities
1. Nothing in these Terms and Conditions excludes or limits our liability in respect of a) any breach of law by Digidentity or its sub-contractors, b) any loss, unauthorised access to or corruption of personal data held by Digidentity or its sub-contractors (including any credentials issued to you), c) any wilful default on the part of Digidentity or its sub-contractors. Any other limitations on liability in these terms & conditions must be reasonable in all the circumstances of the services provided by Digidentity to the user.
2. We are not responsible to you for any loss or damage suffered by you which was not an obvious consequence of us breaching these Terms and Conditions. We are not responsible to you for losses which you suffer due to any events beyond our reasonable control. We are not responsible to you for losses that that Digidentity has not caused directly by actions.
3. You cannot hold Digidentity liable for damages resulting from events beyond reasonable control or that Digidentity has not caused directly by actions.
4. You cannot hold Digidentity liable for any indirect damages or damages that were/or are caused because you did not/or do not take appropriate measures to i) limit such damages immediately after a damaging event has occurred, ii) prevent further damage or subsequent damages resulting from the initial event, iii) immediately inform Digidentity about events which would cause damages and/or provide relevant information to Digidentity.
5. In all cases, the liability of Digidentity shall be limited to the usual and foreseeable damages. You cannot hold Digidentity liable for any business damages after using the identity service in the capacity of a consumer.
6. You can never hold Digidentity liable in respect of any damages resulting from
  1. Your unauthorised or improper use of the data, the identity service and/or related materials;
  2. Providing incorrect and/or incomplete data, or not providing data to Digidentity in a timely manner;
  3. Losing your own data;
  4. Your failure to abide by any obligations provided in these terms and conditions, including not cooperating with the terms and conditions.
  5. The late, incorrect, or incomplete accessibility of the identity service;
  6. Miscommunication or loss of messages and notices resulting from the use of a mode of communication selected by you, or resulting from the dysfunction of any materials used by you, including improper functioning of the internet;
  7. The use of materials you selected;
  8. The unauthorised use, loss or theft of log in details that have been provided to you;
  9. The downtime or unavailable online tools of third parties;
  10. Sharing your username and password with any other person.
Limitation of Action
1. You must bring any claim for damages against Digidentity within one year after the damage has occurred.
Force Majeure
1. Digidentity are not obliged to perform any of the obligations under the contract or the terms and conditions in case of force majeure. Force majeure includes, but is not limited to: improperly functioning materials provided by users, requirements under the law, power cuts, improper functioning of the internet, or of computer‐ and telecommunication facilities, extreme weather conditions, fire, flooding, war, strike, general problems of transportation and unavailability of one or more of Digidentity's employees.
Applicable Law and Disputes
1. The contract and the terms and conditions are governed by Dutch law in adherence and conformity with application European Directives, specifically Article 8 of the European Convention of Human Rights regarding laws on privacy.
2. Any dispute that a user and Digidentity cannot settle amicably will be brought before the competent judge of the place where Digidentity have a statutory seat (The Hague). If applicable Dutch or European law provisions determine that another judge is also competent, then the case may also be brought before this judge. If applicable Dutch or European law provisions determine that another judge has exclusive competence, then the case may only be brought before that judge.
Warranties
1. Digidentity do not provide for any other guarantees, undertakings, and/or commitments than those explicitly provided for in the terms and conditions.
Concluding Provision
1. Should any provision of the terms and conditions be declared invalid or void, this shall not affect the validity of any of the other provisions included in the terms and conditions. In such case Digidentity will amend the terms and conditions with the aim to achieve the same object and purpose served by the provision declared invalid.

Definitions

User
"User", "you" or "your" in these Terms and Conditions refer to you as a user of the Identity Service.
Identity service
The service we provide to you entailing the verification of your identity and/or the validity of any documents or data. If this verification and/or validation process results in a confirmation and/or validation of the information you have provided, we will create an identity account for your personal use.
Relying party
The relevant third party who requires you to verify your identity so that you can use its services, i.e., Government Departments.
Contract
The relationship between you and us, governed by the terms and conditions according to article 2.1.
Terms and conditions
These terms and conditions as set out here.
Identity account
Your unique user profile we have provided to you after identification and/or validation of data and documents whether or not the verification of your identity is successful
Data
Any data you have provided to us or in connection with the Digidentity Service.
Licensee
The holder of a licence for intellectual property rights connected to the identity service.
Materials
Materials refer to any software, hardware, websites, database, designs, models, programs, reports, and other identity services and materials we or the relying party have put to use in relation to the identity service.
In writing
For the present terms and conditions, the term "in writing" will refer to any written communication, whether this be by electronic means or by regular postal mail.
Good Industry Practice
At any time, the exercise of that degree of care, skill, diligence, prudence, efficiency, foresight and timeliness, which would be reasonably expected at such time from a leading and expert provider of services that are similar to the Digidentity Service, such provider seeking to comply with its obligations in full and complying with applicable laws and with ISO27001 and Scheme accreditations.

Introduction

At Digidentity Identity Service, our mission is to respect your privacy and protect your personal data.

In this privacy policy, we will inform you about the way we look after your personal data whenever you visit our website or interact with us in any other manner. Also, we will tell you about your privacy rights and explain how you may exercise them.

Please, feel free to click through to the areas set out below.

INFORMATION ABOUT US AND THIS POLICY
WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?
HOW DO WE USE YOUR PERSONAL DATA?
WHAT ARE COOKIES AND HOW DO WE USE THEM?
SHARING YOUR PERSONAL DATA
INTERNATIONAL TRANSFERS?
DATA SECURITY
DATA RETENTION
YOUR RIGHTS
GLOSSARY

INFORMATION ABOUT US AND THIS POLICY

WHO ARE WE?

This Privacy Policy ("Policy") describes Digidentity B.V.'s use of your personal data. References in this Policy to "Digidentity", "we" or "us" shall mean Digidentity B.V. (registered in the Netherlands under company number 27322631), being the data controller for the data processing.

PURPOSE OF THIS POLICY

With every service we provide we take the protection of your privacy and personal data very seriously. We ensure that we collect and process personal data in compliance with applicable privacy and data protection law. We do not allow anyone to use or access your personal data for any other purposes than those set out in this Policy.

In this Policy, we give you information about how Digidentity collects and processes your personal data when you visit our website or otherwise interact with us. This includes any personal data that you provide when you purchase our products or services. The Policy also informs you how you can exercise your rights.

It is important that you read both this privacy policy and our Terms and Conditions. This policy does not override earlier policies, but rather supplements them.

We protect and handle any personal data about you in accordance with relevant and applicable data protection and privacy legislation (including but not limited to the EU General Data Protection Regulation ("GDPR")).

CONTACT DETAILS

If you have any questions, comments or requests concerning this Policy, please contact our data privacy officer (by e-mail, postal service or phone) using the details set out below.

Email address: privacy@digidentity.eu
Postal address: PO Box 19148, 2500 CC The Hague, the Netherlands
Telephone number: +3188 7 78 78 78

If you have any concerns about the way we handle your personal data you have the right to make a complaint at any time to the local data protection authorities. In the United Kingdom, this is the Information Commissioner's Office or "ICO". In the Netherlands, this is the Autoriteit Persoonsgegevens or "AP". However, we would appreciate the chance to respond to your concerns before you approach either the ICO or the AP, so please contact us in the first instance.
WHAT PERSONAL DATA WE COLLECT ABOUT YOU?

We collect and process personal data about you when you interact with us and our products and services, or when you use or purchase our products or services. Personal data includes any information from which you can be identified (directly or indirectly).

We have grouped different categories of personal data we may process:
- "Identity Data" which includes, if relevant: name, or similar identifier, date of birth, gender, BSN or equivalent identifiers and other similar data;
- "Contact Data" which includes, if relevant: billing address, home address, email address and telephone number(s);
- "Financial Data" which includes, if relevant: bank account number and/or other payment card details;
- "Transaction Data" which includes, if relevant: details about payments and delivery to and from you and other details of products and services you have purchased from us;
- "Technical Data" which includes, if relevant: internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to use our products and services;
- "User Profile Data "which includes, if relevant: your username and password, your purchases or orders, your preferences, feedback and survey responses;
- "Usage Data" which includes, if relevant: information about how you use our website, products and services;
- "Aggregate Data" which include, if relevant: statistical and/or demographic data, which we have derived from your personal data and which we may for example use to calculate the percentage of users that access a specific website feature. We ensure the key to link the aggregate data back to your personal data can only be accessed by those persons who need to access it for specific and legitimate purposes.
We do not collect any sensitive or special categories of personal data. Such data may include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. Nor do we collect information about any criminal convictions or offences.

WHAT HAPPENS IF YOU DO NOT PROVIDE PERSONAL DATA?

You do not have to supply us directly with any personal data when you use our website. However, some communications, services and facilities can only be provided if we receive relevant details from you, or they may not function properly if you do not provide certain data. If and when you wish to communicate with us or make use of any of our services and/ or facilities, we will inform you at that time about which personal data we need (and which we may not need) in order to respond to your request. Also, we will inform you of the (possible) consequences if you do not provide us with the personal data we require you to give.

Also, it is important that the personal data we hold about you is accurate and current. Please, inform us through your online account, or via the contact details as set out above if your personal data changes during your relationship with us.

HOW DO WE USE YOUR PERSONAL DATA?

We will only use your personal data in accordance and compliance with applicable data protection and privacy laws. We use your personal data we collect through our website on the following grounds:

As required to perform a contract with you.
As required by us to enable our business and pursue our legitimate interests. We will only use your personal data if using them does not conflict with your interests and fundamental rights.
Where we need to comply with applicable legal or regulatory obligation and for the protection of our legitimate business interests and legal rights, such as for security, (credit) fraud prevention purposes and for use in connection with legal claims, compliance, regulatory and investigative purposes.
In accordance with your preferences and your consent.

FOR WHICH PURPOSES DO WE USE YOUR PERSONAL DATA?

In the table below, we have described all the ways we collect and process your personal data. We have also indicated which of the legal grounds (as explained above) we rely on to do so. Moreover, we have identified what our legitimate interests are where appropriate.

Please note that we may process your personal data for more than one legal ground. This depends on the specific purpose for which we are processing. If more than one legal ground has been set out in the table below, feel free to contact us for details about the specific legal ground we are relying on to process your personal data.

Purpose/Activity	Type of personal data	Lawful basis for processing including basis of legitimate interest
Automated technologies and interactions (including, but not limited to log information, data analytics and cookies).	Technical Usage	Necessary for our legitimate interests (in maintaining and managing our website and ensuring its security). With your consent Please find more information in Chapter 4 on "cookies".
Responding to your inquiry when you seek interaction with us (including, but not limited to inquiries, creating an account, subscriptions, feedback and reviews)	Identity Data Contact Data	Necessary for our legitimate interest (i.e. legitimate business in communicating with you and/or your wishes and expectations, accessing appropriate professional advice, ensuring we comply we with obligations to which our business is subject).
To register you as a (new) customer	Identity Data Contact Data Profile Data Technical Data Financial Data Transaction Data Usage Data	Performance of a contract with you. With your consent.
To process and deliver your purchase orders (including, but not limited to managing payments, fees and charges, collecting and recovering money owed to us)	Identity Data Contact Data Financial Data Transaction Data	Performance of a contract with you. Necessary for our legitimate interests (to recover debts due to us).
To manage our customer relationship with you which will include: Notifying you about changes Asking you to leave a review or take a survey	Identity Data Contact Data Profile Data	Performance of a contract with you. Necessary to comply with a legal obligation. Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services).
To administer and protect our business and the website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	Identity Data Contact Data Technical Data	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). Necessary to comply with a legal obligation.
To make suggestions and recommendations to you about products or services that may be of interest to you (Promotional offers)	Identity Data Contact Data Technical Data Usage Data Profile Data	Necessary for our legitimate interests (to develop our products/services and grow our business).

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it. The exemption may be that we may need to use your personal data for a reason that is related to or compatible with the original purpose. If you wish to get more information as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we want to process your personal data for an unrelated purpose, we will notify you prior to commencing such processing and we will inform you of the lawful basis on which such processing is based, or otherwise only do so with your consent.

WHAT ARE COOKIES AND HOW DO WE USE THEM?

Cookies are files that store information on your hard drive or your browser. Thanks to cookies, companies can see whether you have visited their website before. This allows you to maintain your preferences on those websites.

If you wish, you can delete all the cookies currently stored on your computer. You can find out how to delete cookies for your browser by clicking 'help' on your browser's menu. You can also find out how to do this, and find further information on cookies at www.allaboutcookies.org. If you delete your cookies, however, you may find that you can no longer take full advantage of the websites you visit.

Category 1: Strictly Necessary Cookies

These cookies are essential in order to enable you to move around the website and use its features. Without these cookies, we cannot provide services you have asked for such as remembering your login details or data provided for a purchase. Cookies that are timed (i.e. session cookies) will expire after the set time interval, unless replaced by another cookie with a new timer. Cookies that expire on session end will be erased when the user closes (all) the browser instances. The session cookie is stored in temporary memory and is not retained after the browser is closed. Session cookies do not collect information from the user’s computer. They typically will store information in the form of a session identification that does not personally identify the user.

Category 2: Performance Cookies

These cookies collect information on how people use our website. For example, we use Google Analytics cookies to help us understand how users arrive at our site, browse or use our site and highlight areas we can improve such as navigation, website experience and marketing campaigns. The data stored by these cookies never shows personal details from which your individual identity can be established.

Category 3: Functionality Cookies

These cookies remember choices you make, such as the country you visit our website from, language and search parameters such as number of visitors and time of stay. These can then be used to provide you with an experience that is more appropriate to your selections and to make the visits more tailored and pleasant.

GOOGLE ANALYTICS

Our website uses Google Analytics, which is a web analytics service provided by a third-party provider (Google Inc.) Google Analytics is used for the purpose of evaluating your use of our website, compiling reports on website activity and other services relating to website activity and internet usage. The information generated by the cookie about your use of the website is usually transmitted to and stored by Google on servers in the United States. This transfer is covered by Google Inc.’s Privacy Shield certification and a separate data processing agreement that we have concluded with Google. On this website, we have also activated the IP anonymization tool “gat._anonymizeIp();” provided by Google Inc. to help protect your privacy.

This means that your IP address will automatically be shortened after it is collected so it can no longer be connected to you (see https://support.google.com/analytics/answer/2763052).

For further information see https://support.google.com/analytics/answer/6004245?hl=de&ref_topic=2919631 (information on Google Analytics and data privacy).

We don't use third-party cookies for any commercial purposes.

Where we use third parties to deliver a service on our behalf, please visit their website to obtain further information regarding their use of cookies.
SHARING YOUR PERSONAL DATA

Where necessary, your personal data may be shared with our suppliers, third party service providers and professional advisors who will process it on behalf of Digidentity in order to help us fulfil our purposes for processing data as described in the table above, i.e. to help us administer and manage our website, in order to resolve a query or complaint, in order to manage online payments or fulfil and deliver orders. Please find a list of third parties we may share your personal data with below.

In any other case, we will not share your information with any third party unless:
- we have your permission;
- we are required to do so by law;
- this is necessary in order for us to enforce our terms of use, rights or property or the rights or property of any third party; or
- this is necessary in the connection with the sale, transfer or merger of (parts of) our business or its assets (in which case your details will be disclosed to our advisers and any prospective purchaser's advisers and will be passed to the new owners.)
THIRD PARTIES

Internal Third Parties

Other companies in Digidentity's parent company Solera/Audatex Group, acting either as joint controllers or processors. They are based in the European Economic Area (EEA), provide IT and system administration services and undertake information reporting.

External Third Parties
- Service providers
  All our service providers are based in the EEA.
- Professional advisers, including lawyers, bankers, auditors and insurers. They, too, are based in the EEA and they provide consultancy, banking, legal, insurance and accounting services.
- Various government authorities and/or law enforcement officials.
We require all third parties with whom we may share your personal data to respect the security of your personal data and to treat it in accordance with the law. We do not allow third parties to use your personal data for their own purposes and only permit them to process your personal data for specified purposes as per our instructions. All these conditions are laid down in data processor (or other) agreements which we have concluded with them prior to sharing your personal data and in accordance with applicable data protection and privacy legislation.
INTERNATIONAL TRANSFERS

Unless expressly stated otherwise in this Policy, we do not transfer your personal data outside the European Economic Area (EEA).
DATA SECURITY

We have taken the necessary security measures to prevent that your personal data is accidentally lost, used or accessed in any unauthorised way, altered or disclosed. Also, we limit access to your personal data to those employees who have a business need to know. They will only process your personal data as per our instructions, and they are legally bound to keep your personal data confidential.

We have set up procedures to deal with any suspected personal data breaches, and we will notify you and any relevant data protection authority of a breach where we are legally required to do so.
DATA RETENTION

HOW LONG WE STORE YOUR PERSONAL DATA?

We will only store and process your personal data for as long as we need to in order to fulfil the purposes we collected it for, including compliance with any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider:
- the amount, nature, and sensitivity of the personal data,
- the potential risk of harm from unauthorised use or disclosure of your personal data,
- the purposes for which we process your personal data,
- whether we can achieve those purposes through other means, and
- the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available in our retention policy.

In some circumstances, we may anonymise personal data (so that it can no longer, in any manner possible, be associated with or be re-identified with you).
YOUR RIGHTS

You have the right to:

Request access to the personal data (commonly known as a “data subject access request”) we hold about you. This means that you receive a copy of the personal data we hold about you, so that you can check that we are lawfully processing it.

Request correction (i.e. rectification) of the personal data that we hold about you. This means you can have any incomplete or inaccurate personal data we hold about you corrected. However, we may need to verify the accuracy of the new personal data you provide to us.

Request erasure of your personal data. This means that, you can ask us to delete personal data we hold about you. Please note however that the right to erasure is not absolute, and we may not be able to fulfil (a part of) your request if we are required to keep (certain) personal data by law or in connection to a contract with you. We will in our response to your request explain this to you in more detail where applicable.

Object to processing of the personal data we hold about you in cases where we rely on a legitimate interest (or those of a third party) and as you feel it impacts on your fundamental rights and freedoms.

If we have responded to your request for objection, you also have the right to ask us to delete your personal data.

Request restriction of processing of the personal data we hold about you. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
1. if you want us to establish the personal data’s accuracy;
2. if our use of the personal data is unlawful but you do not want us to erase it;
3. if you need us to hold the personal data even though we no longer require it, as you need it to establish, exercise or defend legal claims; or
4. if you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer (i.e. data portability) of the personal data we hold about you to yourself or a third party of your choice. We will provide to you, or that third party, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to digital information that you have provided us with, either on the basis of your consent, or where we needed to process the information in the performance of a contract we have with you.

WITHDRAWAL OF YOUR CONSENT

In those cases where we rely on your consent for the lawful processing of your data, you have the right to withdraw consent at any time. If we have no other legal ground on the basis of which we may process this data, we will discontinue processing it once you have withdrawn your consent.

Please note that any processing we carried out before the withdrawal of your consent remains lawful. Also, if you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case when you withdraw your consent.

If you wish to exercise any of these legal rights, please contact us via the contact information in Paragraph 1.

NO FEE IS USUALLY REQUIRED

You will not have to pay a fee to access your personal data (or to exercise any of the other legal rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

WHAT WE MAY NEED FROM YOU

If and when you make a request with respect to any of your rights as described above (i.e. access, correction, erasure, objection, restriction or transfer) we may need to request specific information from you to help us confirm your identity and to ensure your right to access your personal data (or to exercise any of your other legal rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

TIME LIMIT TO RESPOND

We aim to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you of such a delay within one month and keep you updated.
GLOSSARY

LEGAL GROUNDS

Legitimate Interest means the interest of our business in conducting and managing our business, so that we can give you and others the best service/product and the best and most secure experience. We consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where the impact on you overrides our interests (unless we have your consent or are otherwise required or permitted to by law).

If you would like further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities, please contact us.

Performance of Contract means that we process your personal data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract.

Comply with a legal or regulatory obligation means that we process your personal data because we need to fulfil a legal or regulatory obligation

Consent means that we process your personal data because you have given us (demonstrable) permission to do so.

CHANGES TO THE POLICY

Our Policy may require updates from time to time. We shall publish any changes we may make to our Policy in the future on our website www.digidentity.eu/en.

PURPOSE

When you register with Digidentity your personal data is required to confirm your identity. This document provides you with information about how long your personal data is stored. This personal data is subject to data protection laws, as described in the Terms and Conditions and Privacy Policy.

DATA RETENTION PERIODS

The data retention periods are in the table below:

Type of Data	Retention Period	Archive after (after an account is inactive)*
Personal details – name, address, date of birth	While account is active	7 years
Mobile phone number	While account is active	7 years
Email address	While account is active	7 years
Passport images from mobile app	6 months	•
Passport number	While account is active	7 years
Identity card images from mobile app	6 months	•
Identity card number	While account is active	7 years
Driving licence images from mobile app	6 months	•
Driving licence number	While account is active	7 years
Bank Account number (masked)	While account is active	7 years
BSN Number (masked)	Deleted immediately after checking	•
Selfies	14 days and deleted	•
Chamber of Commerce Listing (KvK)	While account is active	7 years
Bank card transactions (masked information)	While account is active	7 years

Digidentity will only store your data if necessary, to meet obligations for auditing and forensic evidence purposes. Your rights to request deletion are described in the Terms and Conditions and Privacy Policy.

During archival the data is securely stored (encrypted/masked/locked away), and is inaccessible to authorized users during daily business tasks. Data will only be accessible to personnel in functions related to security e.g. Security Officers or the Data Protection Officer (DPO).

Once the data has reached the maximum retention period of 7 years it is deleted/destroyed. The destruction of data ensures that no information can be recovered.

Report your findings.

If you find a weak spot in one of our systems, please let us know. We will always seriously consider your notification and will investigate every possible vulnerabilities. In this way we can repair this as quickly as possible. This way, we can work with you to protect our clients and systems.

We ask you

Please e-mail your findings to our Network Operation Centre ;
Do not abuse the problem, by for example
- reading more information than is necessary to prove the leak;
- download, delete or edit data or components of the software system;
Do not use attacks on physical security, social engineering, distributed denial of service, spam or applications of third parties;
Provide adequate information to reproduce the problem so that we can solve it quickly;
Do not share the problem with others until we have stated that the vulnerability has been rectified and that we have agreed with you to make it public.

We promise

To respond to your notification within 3 days. We will give our assessment of the notification and an expected date for a solution;
We will not take any legal steps against you about your notification. If you at least kept to the abovementioned requirements;
We will treat your notification confidential and will not share your personal data with third parties without your consent;
We will inform you about the progress of our rectification of the problem;
We will mention your name as the person who detected the problem in notifications, but only if you want this;
As a token of our appreciation for your help, we would like to offer you a reward. We will make a €100 donation to any of the following charities, according to your choice for every problem with our security that you detect. Choose from CARE , Homeplan , Edukans .

Summary of the Notifications

May 2016

Vulnerabilities found in the 2-factor authentication of the Idensys App and the website during the pilot phase. The website was vulnerable for a brute force attack on the PUK code. The app was vulnerable for cloning of the PKI certificates. This was only possible through jail breaking/rooting and illegal possession of the smartphone. The vulnerabilities have been fixed. Rewards were applicable. Reported by Jaap van Ginkel c.s. (UvA).

April 2016

A vulnerability was found in the website. It was possible to inject (SQL/Java) codes within the web application (sub domain). The vulnerability was fixed quickly. A reward was applicable and this has been paid. Reported by Serge van Haag (VulnerabilityHunt).

October 2015

Reporting a SSL vulnerability (support of protocols that are no longer safe). This was a known vulnerability and it was in the process of being fixed. Even though it was not necessary to pay a reward for this, an amount was paid to 'CARE' charity. Reported by Joost van Hassel.

Digidentity is a certified identity provider for the GOV.UK Verify service, and as such is listed by GOV.UK as a certified company: GOV.UK website.

Via Digidentity:

Users can register for a Digidentity account to assert their identity.
Users with an asserted identity can access services available for GOV.UK Verify.
Users can expect the highest standards of authentication and security available.

To provide this service to users, Digidentity ensures that the requirements and standards of the UK Government in GPG (Good Practice Guide) 44 and GPG 45 are met.

Once a user has successfully verified for an identity account for GOV.UK Verify LoA1 or LoA2, it can be used to access associated LoA1 or LoA2 services provided by the GOV.UK Verify initiative.

How the service works

Registration

Via the GOV.UK pre-registration questions, Digidentity can be chosen as the identity provider. Once chosen, users are automatically directed to the registration process of Digidentity. The registration process will be per the chosen LoA. Users are required to accept the terms and conditions, without accepting these it is not possible to register.

Authentication

When logging into their profile, or when requiring access to GOV.UK Verify services, users are required to make use of the 2-factor authentication. Users can opt for SMS or by using the Digidentity Authenticator app available. Once authenticated users can access services and/or their profile to maintain it.

IPV

Identity proofing and verification is at the core of creating a digital identity. The information required to verify an identity is dependent on the Level of Assurance. The higher the level, the more assurance is required.

Account Maintenance

Users are in control of their own identity account, and can also make changes where needed e.g. change of name because of marriage. Changes are always verified to ensure maximum protection and security, and for fraud prevention.

Registration

Making an account

Once directed to the Digidentity process users are required to make a username, password and to confirm their email address. Once this is complete the user needs to choose their form of 2- factor authentication, e.g. SMS. 2-Factor authentication is always required to secure the account for GOV.UK verify.

Entering personal details

Users are required to enter their personal details, including; name, date of birth, gender (optional) and address. Sometimes name history and/or address history is required. Once this is entered the details are confirmed and used to collect data from a credit file. The data collected is NOT a credit reference, and has NO impact on the credit reference. The data is used to check and verify information for the process of verification, along with data/document checking services provided by the Government.

Identity proofing

Depending on the Level of Assurance users will be required to provide evidence of the identity. Users registering for LoA2 are required to reach a higher level of assurance and will need to supply a combination of evidences which include (but not limited to): UK passport, Non-UK passport, Photo card ID (Government issued), Photo card driving licence, mobile phone contract, bank transaction £0.00 and knowledge based verification (questions generated from the data). Users can also choose to provide their details using our mobile app. Since photos are required of the document, and selfies too, more assurance is attained per document. Users who provide a UK Passport with the app therefore, need only add one more piece of evidence e.g. bank transaction £0.00.

Completion

Once the process of verification is completed the user will be redirected to the service they initially required. To access services of GOV.UK in the future users can use their existing account credentials, and once successfully logged in, will be redirected to the service required.

Revalidation

During the lifespan of the account it is necessary to revalidate details within 180 days of the registration date. Revalidation is a requirement per the Good Practice Guide set out by GOV.UK. Revalidation ensures the integrity of the data within the user account. If the account revalidation occurs users may be asked to take steps to update their information e.g. passport is expired and so add a new one.

Support

Users requiring support during the process are able to contact us:

Email: helpdesk@digidentity.co.uk
Phone: +44(0)330 05 83 454

Monday to Friday 08:00 to 22:00
Saturday and Sunday 08:00 to 17:00

Calls cost no more than calls to geographic numbers (01 or 02) and your telecoms provider must include these calls in inclusive minutes and any discount schemes in the same way.

GOV.UK Verify: a secure way to prove your identity online

Your own Digidentity, be verified

Request a Digidentity

Identification

Verification

Use it

Safe, Simple, Secure, Be Verified

Be verified

Easy online

All in 1 ID

Safe access to your online service

We will help you with eHerkenning and Idensys

We will help you with eIDAS

Who is Digidentity?

A team with a mission

Will you strengthen our team?