Privacy Policy
Last updated: 2026-10-20
This notice explains how PolisOne B.V. processes personal data for the public waitlist, enquiries and the insurance service, including insurance collection through Insurely. The public service currently remains a waitlist; insurance collection and import are available only to approved private testers.
Who is the data controller
PolisOne B.V., Damstraat 37, 4401 AC Yerseke, the Netherlands (Chamber of Commerce no. 42127898), is the data controller for the personal data we process to provide PolisOne. Contact us at privacy@polisone.com about this notice or your data. Insurely’s separate role is explained below.
What we collect
Waitlist and enquiries: the contact details and optional message you provide, campaign labels, and your analytics and advertising choices. A Meta click ID is saved only with advertising consent. Account and security: your account identifier, email address, authentication and session records, and technical information needed to operate and protect the service. Signing in to PolisOne is separate from authenticating with an insurer. Insurance collection: when you request a collection, Insurely processes the identity and authentication information required by the selected insurer, which may include your Swedish personal identity number and BankID authentication. Depending on the insurer and policy, the returned data may include the policyholder’s name and contact details, policy number, insurer, policy type, premium, payment and coverage dates, insured amounts, benefits, exclusions, deductibles, insured addresses or vehicles, household details and co-insured people. We receive collection identifiers and policy data and store imported policy details together with the provider’s returned policy record. The fields available vary by policy; a missing field does not mean there is no cover. PolisOne does not receive or store your BankID security code. Do not send us BankID credentials or unnecessary personal information in messages. The marketing measurement section below explains the separate optional measurement data.
Why we process it
We process account and insurance data where necessary to provide the service you request under our Terms (Article 6(1)(b) GDPR). Insurance retrieval starts on your instruction; without the required insurer authentication and policy information we cannot perform that retrieval. During the current private pilot, imported policies are stored and displayed for the approved tester; external AI analysis, live quotes, automated switching and policy notification processing are not enabled. Where a policy includes co-insured people, we process only information relevant to understanding that policy. Our legitimate interest is to give the policyholder an accurate overview of the cover they have requested us to retrieve (Article 6(1)(f)). Co-insured people can contact us to exercise their own rights. We manage waitlist requests and enquiries, and protect the service against misuse, on the basis of our legitimate interests in responding to requests, managing access and maintaining security (Article 6(1)(f)). We process records required by applicable law on that legal basis (Article 6(1)(c)). Optional analytics and advertising measurement require your separate consent (Article 6(1)(a)); joining the waitlist or authorising insurance retrieval does not grant that consent. We do not sell or rent your personal data.
How long we keep it
Account and imported policy data are kept while your account is active. When you close your account or ask us to delete it, other than records we must retain by law, account and policy data are deleted within 30 days. Records that fall under Dutch tax and bookkeeping retention obligations are kept for 7 years; this does not mean your entire insurance record is kept for that period. Communications are retained for 2 years. Waitlist details are retained while needed to manage your request and communicate availability, or until you ask us to remove them, subject to any legal obligation to retain a specific record. In Google Analytics, event data associated with identifiers is retained for 2 months and user data for 14 months; new activity resets the user-data period. Aggregated standard reports may remain available longer. The marketing measurement section below describes the shorter retention of matching data used for server events.
Your rights
Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction, portability and objection to processing. Where we rely on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal. You can change optional measurement choices through Cookie preferences. To exercise rights, request account closure, or ask about data concerning you as a co-insured person, contact privacy@polisone.com. We may need to verify your identity before acting. You may lodge a complaint with the Dutch Autoriteit Persoonsgegevens, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or the competent supervisory authority where you live, work or consider an infringement has occurred. You do not have to exhaust our complaints process before contacting an authority.
How Insurely processes collection data
We use Insurely AB (Swedish registration number 559103-5646) to retrieve insurance information from the insurers you select. Insurely acts as our processor for that retrieval, under our written instructions and data processing agreement. The collection takes place through Insurely’s module and the selected insurer’s authentication process. Insurely’s privacy notice also describes its separate role as controller when anonymising certain user and insurance data to improve its products and services. This anonymisation processing is distinct from acting as our processor; the resulting anonymous information is intended no longer to identify you. Read the Usage of Insurely via partner services section of Insurely’s Privacy Policy using the link below. Questions about that processing can be sent to privacy@insurely.com.
Who receives your data
Insurance information is made available to Insurely and the selected insurer as required to perform the collection you request. Authorised PolisOne personnel and technical service providers receive access only as needed to operate, support and secure the service. Our infrastructure includes Supabase for account and database services, Railway for application hosting, and Cloudflare for website delivery and security. We use email providers for service communications; waitlist team notifications through Resend are sent only when that feature is enabled. On public marketing pages, Google Analytics and Meta receive the limited measurement data described below only under the relevant cookie choice. We do not send personal identity numbers, policy data, account activity, names, email addresses or form contents in those measurement events. Private account and insurance pages do not load our optional marketing tags. We may disclose data to competent authorities where required by law.
International access and transfers
Our service relies on providers that may process or access personal data in the EU/EEA and in other countries. We do not treat a provider’s EU hosting location as a guarantee that all support access and subprocessors remain in the EU/EEA. Where a transfer outside the EU/EEA occurs, the applicable protection may be an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with additional measures where necessary. Contact privacy@polisone.com for information about relevant destinations and safeguards, or to request a copy of the safeguards applicable to your data.
Your collection choices
You can choose not to begin a collection and use the controls in the module to cancel an available authentication or collection step. A new retrieval requires your instruction and the authentication required by the insurer. Stopping further collection does not automatically delete policy data already imported into your account; request account closure or deletion using the contact details above. The current private pilot does not use your imported policies to make solely automated decisions with legal or similarly significant effects on you. PolisOne does not decide whether an insurer will offer you cover or pay a claim. Any later feature that introduces additional purposes or processing will require updated information before it is introduced.
Marketing measurement
On public marketing pages, optional analytics and advertising measurement are controlled by separate choices. Google Analytics receives site-use events when analytics is allowed. Meta receives limited browser events and successful waitlist Leads through its Conversions API when advertising measurement is allowed. Server Leads include IP address, browser information and, when available, Meta click and browser identifiers. Form contents, names, email addresses, identity numbers, account activity and insurance details are excluded from Meta events. We may use your IP-based country to suggest a selection on the waitlist form; you can change it. The country you select is saved with your waitlist signup and is not sent in marketing events. Campaign labels are saved with the operational signup; Meta click IDs are saved only with advertising consent. Successful waitlist signups are counted in aggregate from operational records regardless of cookie choice. We save your analytics and advertising choices with the signup. Technical delivery data is used only for a consented server Lead and temporary retries. We remove that payload after delivery or cancellation; unused payloads expire after one hour and are cleared by scheduled cleanup. We retain delivery status to check reliability. Functional submission keys stored in your browser for one hour help prevent duplicate retries and cancel pending delivery when you withdraw advertising consent.
Questions? Contact
privacy@polisone.com