GDPR Compliance

1. What is the GDPR?

The General Data Protection Regulation (GDPR), known in Dutch as the Algemene Verordening Gegevensbescherming (AVG), is the European privacy legislation that has been in force since 25 May 2018. The GDPR gives individuals more control over their personal data and imposes strict requirements on organisations that process personal data.

2. Our role under the GDPR

Under the GDPR, Casemeister can fulfil two roles:

2.1 Controller

For the data of our customers (account holders), we act as controller. This concerns:

• Account data and login credentials
• Billing data
• Communication with our support

2.2 Processor

For the data that our customers enter into case files (data of their clients), we act as processor. The customer (the law firm) remains the controller for this data.

3. Technical security measures

We have implemented the following technical measures:

4. Data location and AI processing

All primary data (database, documents, backups) is stored in data centres within the European Union:

4.1 AI services and pseudonymisation

Casemeister offers AI features such as document generation, a digital assistant and speech recognition. For certain AI services, processing may take place outside the EU.

To safeguard the privacy of data subjects, documents are pre-processed within our own environment in the EU prior to AI processing. In this process, personal data is:

• Identified and masked (names, addresses, citizen service numbers (BSN), etc.)
• Replaced with pseudonymised tokens
• Restored only after the result has been received, within our own EU environment

As a result, identifiable personal data in principle does not leave the European Union. Where a transfer does take place, it is safeguarded by Standard Contractual Clauses (SCCs) and additional technical measures.

5. Data processing agreement

In accordance with Article 28 GDPR, we conclude a data processing agreement with our customers. This agreement governs:

• The subject matter and duration of the processing
• The nature and purpose of the processing
• The type of personal data and categories of data subjects
• The obligations and rights of the controller
• Security measures
• Engagement of sub-processors
• Assistance with data subject rights
• Obligation to notify data breaches

A data processing agreement is available on request. Please contact us via privacy@casemeister.com.

6. Sub-processors

We use carefully selected sub-processors. Data processing agreements have been concluded with all parties.

Category	Service	Location
Hosting & infrastructure	Servers, storage and network	EU (Germany)
Database	Storage of application data	EU
Payment processing	Subscriptions and payments	EU (Netherlands)
Email delivery	Transactional emails	EU
AI service providers	Document generation, assistant, speech recognition	EU and US (with SCCs + pseudonymisation)
Email/calendar integration	Synchronisation (if enabled)	EU and US (with SCCs)
Document processing	Online document editing	EU

An up-to-date overview of the processors and sub-processors we engage is available on request via privacy@casemeister.com. Changes to sub-processors are communicated in advance to customers with a data processing agreement.

7. Data subject rights

The GDPR grants data subjects (persons whose data is processed) various rights. We support you in facilitating these rights:

7.1 Functionality in the application

• Right of access: Export function for case file data and personal data (GDPR export)
• Right to rectification: Data can be corrected directly
• Right to erasure: Deletion function for case files and contacts
• Right to data portability: Export in common formats (JSON, CSV)

7.2 Support with requests

Have you received a GDPR request from a data subject? We will help you within 48 hours with:

• Identification of relevant data
• Export of data
• Deletion of data

8. Data breaches

We have a procedure for dealing with data breaches:

1. Detection: Monitoring and alerting for suspicious activity
2. Notification: In the event of a data breach, we notify affected customers within 24 hours
3. Documentation: All incidents are documented
4. Support: We provide support with any notification to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

The obligation to notify the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) (within 72 hours) rests with the controller (your law firm). We provide you with all the necessary information.

9. Data Protection Impact Assessment (DPIA)

A DPIA may be required for high-risk processing. We can provide support with:

• Identification of processing operations that require a DPIA
• Technical information about our security measures
• Risk assessment of the processing via Casemeister

10. Retention periods

We apply the following standard retention periods:

Data type	Retention period	Explanation
Case file data	Until deleted by the customer	Customer determines the retention period
Account data	2 years after termination	For any questions/claims
Billing data	7 years	Statutory retention obligation
Log files	12 months	Security & troubleshooting
Backups	30 days rolling	Disaster recovery

11. Privacy officer

For questions about data protection, you can contact:

12. Compliance documentation

The following documentation is available to customers on request:

• Data processing agreement (DPA)
• Technical and organisational measures (TOM)
• Detailed list of sub-processors
• Data centre certificates

Contact us via privacy@casemeister.com to request these documents.

13. Frequently asked questions

14. Updates

This page is updated whenever there are changes to our GDPR compliance or security measures. Important changes are communicated by email to all customers.