Privacy Policy

1. Introduction

Casemeister ("we", "us" or "our") attaches great importance to the protection of your personal data. In this privacy policy we explain which data we collect, why we do so, with whom we share it and how we handle it.

This privacy policy applies to all Casemeister services, including our websites casemeister.nl and casemeister.com, and the Casemeister application (app.casemeister.com).

2. Controller

The controller for the processing of personal data is:

Processor role. The above applies to data that we process for ourselves (accounts, invoicing, website). For data that a law firm processes in Casemeister about its clients and opposing parties — including case files, documents, email and WhatsApp messages — the law firm is the controller and Neddev B.V. acts as processor under the data processing agreement.

3. What data do we collect?

We collect and process the following categories of personal data:

3.1 Account data

• Name and contact details (email address, telephone number)
• Company name and job title
• Login credentials (email address and encrypted password)
• Billing details (address, VAT number)
• Authentication data (two-factor authentication, passkeys)

3.2 Usage data

• IP address and browser information
• Login times and session duration
• Features used within the application

3.3 Case file data

• Data you enter into case files yourself
• Uploaded documents
• Email correspondence (if connected)
• Telephone call data (metadata, no recordings unless explicitly enabled; see also section 7b on the call log on your phone)

3.4 Payment data

• Subscription information (selected plan, status)
• Payment history and billing details
• Credit card or bank details are not stored by us but are processed by our payment provider

4. Purposes of processing

We process your personal data for the following purposes:

• Service delivery: Providing and improving our software
• Account management: Creating and managing your account
• Invoicing: Sending invoices and processing payments
• Support: Answering questions and providing assistance
• Communication: Sending service-related messages
• AI features: Generating documents, answering questions and analysing case file content with the help of AI (see section 7)
• Security: Securing our services and detecting fraud
• Legal obligations: Complying with legal obligations

5. Legal bases

We process your personal data on the basis of the following legal bases:

• Performance of the contract (Art. 6(1)(b) GDPR): For providing our services, including AI features that form part of the service
• Legitimate interest (Art. 6(1)(f) GDPR): For security, fraud prevention and improvement of our services
• Legal obligation (Art. 6(1)(c) GDPR): For tax and administrative obligations
• Consent (Art. 6(1)(a) GDPR): For marketing communications (where applicable)

6. Retention periods

We do not retain your personal data for longer than necessary:

Data type	Retention period	Explanation
Account data	Up to 2 years after termination	For any questions or claims
Case file data	Until deleted by the customer	Customer determines the retention period; 30-day export period after cancellation
Billing data	7 years	Statutory retention obligation (tax)
Log files	Maximum of 12 months	Security and troubleshooting
Backups	Maximum of 35 days, rolling	Disaster recovery

7. AI processing and data protection

Casemeister uses artificial intelligence (AI) for various features, including document generation, a digital assistant and speech recognition.

7.1 How do we protect your data during AI processing?

Before data is processed by AI services, it is pre-processed within our own environment in the EU. In doing so, we:

• Identify personal data (names, addresses, citizen service numbers (BSN), etc.) in documents
• Mask this data by replacing it with pseudonymised tokens
• Restore the original data only after the AI result has been received, within our own environment

As a result, identifiable personal data in principle does not leave the European Union. The AI service providers receive masked data only.

7.2 No automated decision-making

The AI features are used solely as a tool. No automated decision-making within the meaning of Article 22 GDPR takes place. All AI-generated output must be verified by the user.

7a. WhatsApp Business integration

When applicable. Only if a law firm connects its own WhatsApp Business account to Casemeister via Meta. Without such a connection, Casemeister does not process any WhatsApp data.

Roles. The law firm is the controller for the messages with its clients. Neddev B.V. (Casemeister) processes this data solely on behalf of the law firm (processor, Art. 28 GDPR). Meta Platforms Ireland Ltd. provides the WhatsApp Business Platform; the terms and privacy policy of WhatsApp/Meta also apply to it.

What data.

• telephone number and WhatsApp profile name of the client or other sender;
• content of messages (text) and attached media (photos, documents, voice messages) with time and delivery status (sent, delivered, read, failed);
• the link between a conversation and a contact and/or case file in Casemeister;
• account details of the law firm: WhatsApp Business Account ID, business ID, phone number ID, display name, quality rating and status of message templates;
• the access token that Meta issues to the law firm and the registration PIN (both stored encrypted);
• when the optional AI assistant is used: an audit record of its decisions and a hashed verification code.

Purposes. Receiving, displaying and replying to messages on behalf of the law firm; storing messages and media with the correct case file; managing and sending approved message templates; securing and managing the connection; optionally, initial handling by an AI assistant.

Legal basis. Casemeister processes as a processor on the instructions of the law firm. The legal basis for the processing itself is determined by the law firm (usually the performance of the engagement contract with the client, Art. 6(1)(b) GDPR, or a legitimate interest).

AI (optional, off by default). Only if the law firm switches on the WhatsApp assistant are messages processed by an AI service provider acting as processor (with a data processing agreement, processing within the EU), after personal data has been shielded as far as possible. The assistant does not provide any case file information before the identity of the sender has been verified and hands the conversation over to a staff member when necessary. The template assistant (help with drafting message templates) uses a similar AI service provider and receives only the description of the template and the name of the law firm — never messages or client data.

Retention periods. Messages and media are retained for as long as the law firm keeps them in the case file or the inbox and are deleted in accordance with section 6 (30-day export period after cancellation; backups expire within a maximum of 35 days). Upon disconnection, the access token is erased immediately. Meta retains messages in accordance with its own policy.

Transfers outside the EU. Casemeister stores WhatsApp data in data centres in Germany and the Netherlands. Messages pass through Meta's infrastructure, which may also process data outside the EU on the basis of the EU-US Data Privacy Framework and/or standard contractual clauses.

Security. Access token and PIN are stored encrypted; messages from Meta are checked for authenticity; strict separation between law firms; only administrators of the law firm can connect, disconnect or switch on the AI assistant; TLS for all traffic.

Data subject rights. Clients exercise their rights with the law firm with which they are in contact via WhatsApp; we assist the law firm in this. If you do not know which law firm is concerned, please email privacy@casemeister.com; we will forward the request. See also Data deletion.

7b. Call log on your phone (mobile apps)

What happens. Calls that you make or receive via the Casemeister app are added by your phone's operating system to the device's call log, with the name and number of the other party, the direction (incoming, outgoing or missed), the time and the duration. On Android this happens from Android 16 (QPR2) onwards in the call history of the Phone app; on iPhone in Recents in the Phone app. Group calls and calls without a callable number are not included.

Only on your device. This data is not sent to Casemeister and is not shared by us with third parties. Please note, however, that other apps with access to your call log can read it, that it may be included in your device's backup (on iPhone, Recents is synchronised via iCloud) and that it remains after you log out of Casemeister.

Switching off and deleting. The feature is switched on by default. You switch it off in the app: on Android via Naam tonen in auto en op horloge (Show name in car and on watch), on iPhone via Show calls in Recents. After that, no new calls are added. You delete existing entries in the Phone app. On Android you can also switch off the integration via Settings → Calling accounts → Integrated call logs → Casemeister; the system then also deletes the existing entries.

8. Sharing with third parties

We only share your personal data with third parties where this is necessary for providing our services. Data processing agreements have been concluded with all parties.

We use the following categories of sub-processors:

Category	Purpose	Location
Hosting provider	Servers, storage and infrastructure	EU (Germany)
Database provider	Storage of application data	EU
Payment processor	Processing of payments and subscriptions	EU (Netherlands)
Email provider	Sending transactional emails	EU
AI service providers	AI features (masked data, see section 7)	EU and US (with SCCs)
Email/calendar integration	Synchronisation of email and calendar (if enabled by the customer)	EU and US (with SCCs)
Document processing	Online editing of documents	EU

An up-to-date overview of the processors and sub-processors we engage is available on request via privacy@casemeister.com.

We never sell your data to third parties.

9. International transfers

The vast majority of your data is stored and processed within the European Union (data centres in Germany and the Netherlands).

For certain AI services and optional integrations, data may be transferred to the United States. The following safeguards apply in accordance with Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs): Standard contractual clauses approved by the European Commission have been concluded with all non-EU processors
• Pseudonymisation: Personal data is masked before it leaves the EU (see section 7.1)
• Encryption: All data is transmitted encrypted (TLS 1.2+)
• Data minimisation: Only strictly necessary data is transferred

10. Security

We take appropriate technical and organisational measures to protect your data:

• TLS encryption for all data traffic
• Passwords, access tokens (such as WhatsApp tokens) and sensitive fields (such as citizen service numbers (BSN)) are stored encrypted
• Storage with hosting providers in the EU, with access restricted to authorised systems and administrators
• Two-factor authentication (2FA) and passkey support
• Role-based access control with tenant isolation
• CSRF protection on all API endpoints
• Comprehensive audit logging
• Regular security audits
• ISO 27001 certified data centres

11. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15): You can request which data we process about you
• Right to rectification (Art. 16): You can have incorrect data corrected
• Right to erasure (Art. 17): You can request that your data be deleted
• Right to restriction (Art. 18): You can have the processing restricted
• Right to data portability (Art. 20): You can receive your data in a standard format. This functionality is built into the application.
• Right to object (Art. 21): You can object to certain processing

To exercise these rights, you can contact us via privacy@casemeister.com. We will respond to your request within 30 days.

12. Cookies

Our application uses only functional cookies that are strictly necessary for the operation of the service:

• Session cookie: For maintaining your login session
• Preference cookie: For storing your cookie consent

We do not use analytical cookies, tracking cookies or advertising cookies.

13. Changes

We may amend this privacy policy from time to time. In the event of significant changes, we will inform you by email or via a notification in the application. The current version is always available on this page.

14. Contact and complaints

Do you have questions about this privacy policy or about the processing of your personal data?

If you are not satisfied with the way in which we handle your data, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).