COVERFLEX APP PRIVACY POLICY
1. SCOPE
1.1. This Privacy Policy ("Policy") explains how personal data are processed in connection with the Coverflex application and the associated reserved web areas (together, the "Application"), operated under the Coverflex brand.
1.2. Consulting this Policy does not replace the Website Privacy Policy, which explains the processing carried out through the public website.
1.3. A person who only visits the public website and does not access the Application is a website visitor, not a User for the purposes of this Policy.
1.4. The Application enables eligible users and authorised Client administrators to access and manage the services selected by the Client. Depending on the relevant market and configuration, these may include employee benefits, allowances and budgets, meal benefits, insurance-related services, reimbursements, invoice or supporting-document validation, document storage, payroll-related reporting, Salary Transparency and Customer-activated Integrations. Not every feature is available to, or activated for, every Client or user.
1.5. Through the Application, users may view and use available benefit balances, submit reimbursement requests and supporting documents, access activity and expense records, manage permitted personal and household information, and contact support. Authorised Client administrators may access employer-facing functionality made available under the applicable service configuration.
1.6. This Policy applies to the Coverflex Group entities providing the Application across the jurisdictions identified in Section 10. The identity and role of the relevant entity depend on the processing activity and the country in which the services are provided. Jurisdiction-specific provisions apply where required.
2. DATA CONTROLLER AND PROCESSOR
2.1. The Coverflex Application is operated by the Coverflex Group.
2.2. Universal Cover, S.A. has a dual role within the Group. As parent company it centralises certain governance, compliance, privacy, information-security, technology, reporting and oversight functions; and it is also a Portuguese operating company that acts as controller for the processing activities it determines in Portugal. Universal Cover is therefore not a governance-only entity and is not a processor by default.
2.3. The role of each entity is assessed activity-by-activity, by reference to who determines the purposes and means of each processing activity, and is recorded in the Group Record of Processing Activities (RoPA). The local Coverflex entity is the controller for the activities it determines in respect of users in its jurisdiction:
2.3.1. Universal Cover, S.A. — for users located in Portugal
2.3.2. Coverflex España, S.L. — for users located in Spain
2.3.3. Evinrude Due S.r.l. — for users located in Italy
2.3.4. Coverflex Germany GmbH — for users located in Germany
2.4. Where a Coverflex Group entity receives personal data from another Group entity for its own purposes — such as governance, compliance, privacy, information security, risk management, internal controls, management reporting or corporate oversight — it acts as an independent controller, and the relationship is controller-to-controller; each entity remains responsible for the processing it controls.
2.5. Coverflex Group entities do not currently act as joint controllers for any processing activity under this Policy. Should a joint controllership arise in future, it would be governed by a separate arrangement under Article 26 GDPR, the essence of which would be made available to users.
2.6. Coverflex acts both as a Data Controller and as a Data Processor, depending on the nature and purpose of the processing activity.
2.6.1. As a Data Controller, Coverflex is responsible for processing for which it determines the purposes and essential means, including aspects of its direct relationship with users, operation and security of the Application, fraud prevention, compliance with legal obligations and support provided for its own purposes.
2.6.2. As a Data Processor, Coverflex processes personal data on behalf of its Clients, who act as Data Controllers, for employer-instructed activities such as receiving and updating workforce records, administering employer-assigned benefits and reimbursements, validating supporting documents against configured rules, supporting payroll reporting and document storage, and providing Salary Transparency or Integrations selected and configured by the Client.
2.7. Where Coverflex acts as a Data Processor, the Client determines the lawful basis, the data subjects and data concerned, the purposes and configuration, and is responsible for providing the required information to employees and other data subjects. Coverflex acts under the Client’s documented instructions and the applicable Data Processing Agreement ("DPA"), while remaining responsible for its own obligations as processor. The DPA governs the processing arrangement; it does not itself create the Client’s lawful basis. Coverflex does not require a separate consent merely to carry out the same processing as processor.
2.8. For Salary Transparency, the Client determines the workforce population, source files, mappings, comparator groups, review criteria and use of the outputs. For Integrations, the Client selects and configures the connection, authorised scopes, mapped fields, filters, routing and file specifications. In each case, Coverflex processes the relevant data to provide the activated service and does not acquire an independent right to use the Client’s workforce data for unrelated purposes.
2.9. The role of each party depends on the purpose of the activity, not solely on whether an account has been created or activated. Receiving data under the Client’s instructions does not, by itself, authorise Coverflex to use those data for its own purposes.
2.10. For German benefits, employer-instructed processing may include administering configured benefit modules, checking and storing supporting documents for reimbursement claims, maintaining relevant records and preparing payroll exports. The Client remains responsible for benefit eligibility, final approval, payroll and tax treatment, the applicable lawful basis and any required works-council information or consultation.
2.11. Where services, infrastructure or governance functions are centrally managed by Universal Cover, the role of each entity for the activity concerned is determined on the activity-by-activity basis described above and recorded in the Group RoPA.
3. PERSONAL DATA COLLECTED
3.1. The personal data processed depend on the selected services, the relevant market, the Client’s configuration and the way in which the Application is used. The categories below do not apply to every user or service.
3.2. Personal data may be:
3.2.1. provided by the Client or its authorised representatives, including through workforce files, HRIS, ERP or payroll systems;
3.2.2. provided directly by you when you register, use a feature, submit a reimbursement request or supporting document, or contact support;
3.2.3. received from benefit, insurance, payment or other service providers involved in a service you use; or
3.2.4. generated through use of the Application, such as transaction records, processing receipts, audit records and technical logs.
3.3. Where Coverflex obtains personal data directly from you for its own purposes, the information required by Article 13 GDPR is provided at collection. Where Coverflex obtains data indirectly as controller, Article 14 GDPR applies and the required information is provided within the applicable period, unless a lawful exception applies. Where Coverflex acts as processor, the Client is responsible for providing the information required for its processing.
3.4. Depending on the activated services, Coverflex may process:
3.4.1. identification data, such as name, username, employee or other internal identifier, tax identifier and, where necessary for an activated service, limited official identification data;
3.4.2. contact data, such as business or personal email address, postal address and telephone number;
3.4.3. demographic and professional data, such as date of birth, gender, nationality, employer, employment status, department, team, role, job title, profession, employment dates and eligibility information;
3.4.4. payroll, tax, compensation and benefits data, such as salary or pay-band information, working time, contract type, allowances, bonuses, benefits and other compensation components, where required for an activated service;
3.4.5. banking and payment-administration data, such as IBAN, funding or reimbursement details and limited payment or transaction references;
3.4.6. household, dependant, beneficiary and insured-person data, including data relating to minors where necessary for an activated childcare, insurance or other family-related benefit;
3.4.7. authentication, account and access-administration data;
3.4.8. benefit, allowance, budget, reimbursement, insurance and product-use data;
3.4.9. invoices, receipts, vouchers and other supporting documents, including merchant or provider, item or service, amount, date and tax information;
3.4.10. support communications and content you or the Client submit in connection with a support request; and
3.4.11. technical, device, usage, security and integration data, such as IP address, device configuration, authentication or connection metadata, synchronisation status, processing receipts, error reports, audit and troubleshooting logs. Cookies and similar technologies are addressed in the applicable Cookie Policy.
3.5. Where Salary Transparency is activated, the Client may provide workforce, job-architecture and compensation data required for the configured analysis. This may include employee identifiers; gender and date of birth; employer, department, team, role, job title or profession; employment and contract information; working time; qualifications or education level; salary, bonuses, allowances, benefits and total-compensation components; and Customer-selected classifications or comparator-group information. Coverflex may structure, validate, normalise and map those data and generate pay-gap, pay-equity, data-quality and related indicators, dashboards, reports and exports for authorised Client users. Those data may remain linked to named or otherwise identifiable employees and should not be assumed to be anonymised.
3.6. Where an Integration is activated, the Client determines which permitted fields are exchanged with its HRIS, ERP, payroll or other authorised environment. Depending on the configuration, this may include the categories described above, Customer-selected non-special-category custom fields, integration identifiers and records needed to map, route, validate, synchronise and troubleshoot the exchange. Activation of an Integration does not authorise the transfer of data outside the documented scope.
3.7. The fact that salary or working-time data may be processed for Salary Transparency or a Client-configured Integration does not mean that those data are used for every benefit. In particular, Coverflex does not use gross salary or contractual working hours to verify compliance of a German Salary Sacrifice arrangement with the statutory minimum wage, collective agreements or social-security requirements; the Client remains responsible for that assessment.
3.8. The employer-directed services are not designed or intended to receive social-security identifiers, data revealing trade-union membership, criminal-conviction or offence data, full payment-card data or biometric data as Client personal data. Clients and users must not submit those categories through the Services.
3.9. Limited health-related information may be revealed where an invoice, receipt or other supporting document submitted for reimbursement identifies a medical treatment, healthcare provider, medical centre or medicine. Coverflex processes that information only where the relevant medical benefit is available in the applicable jurisdiction and activated by the Client, and only to the extent necessary to validate the documented expense under the Client’s instructions. The Client is responsible for the applicable Article 9 GDPR condition, required notices and eligibility rules. Users should avoid including unrelated health information and, where feasible, redact it before submission.
3.10. Where data are necessary to administer an activated benefit or provide a requested service, not providing them may prevent that benefit or service from being provided.
4. ON WHAT BASIS AND FOR WHAT PURPOSES ARE MY PERSONAL DATA PROCESSED?
4.1. Salary Transparency outputs are decision-support information for the Client. They do not constitute legal advice or a determination of compliance, and Coverflex does not use them on the Client’s behalf to make solely automated decisions producing legal or similarly significant effects for individuals.
4.2. For configured reimbursement or invoice-validation services, the Application may apply documented, rule-based checks to supporting documents and may flag or decline a request where the configured criteria are not met. These checks are administrative and may be reviewed, corrected or overridden by the Client where supported by the service configuration. The Client remains responsible for defining eligibility and approval rules and for the operative decision and its legal, tax, payroll and accounting treatment.
5. FOR HOW LONG WILL MY PERSONAL DATA BE PROCESSED?
5.1. Coverflex retains personal data only for as long as necessary for the applicable purpose, taking account of the relevant service, the relationship with the User or Client, legal and regulatory requirements, the establishment or defence of legal claims, and documented retention schedules. When the applicable period ends, the data are deleted, securely disposed of or irreversibly anonymised, subject to lawful retention requirements and controlled backup lifecycles.
5.2. Where Coverflex acts as processor, including for benefit administration, Salary Transparency and Integrations, retention is governed by the DPA, the Client’s valid documented instructions, the service configuration and any applicable retention schedule. At the end of the relevant processing services, Client personal data are returned or deleted at the Client’s choice, including copies, unless Union or Member State law requires retention. Data may remain temporarily in protected backups until overwritten or deleted through the applicable backup lifecycle and are not used for ordinary processing during that period.
5.3. Salary Transparency source files, structured datasets, dashboards and exports, and Integration files, synchronisation records, processing receipts, error reports, audit or troubleshooting logs are retained only for the periods applicable to the configured service and the Client’s lawful instructions. Coverflex does not state a single retention period for those records because the appropriate period depends on the selected service, market, configuration and applicable law.
5.4. Data processed by Coverflex as controller are subject to the period or criteria applicable to the relevant purpose. Data necessary for billing are generally retained for ten years, except where a different national period applies. In Germany, invoices subject to Section 14b UStG are generally retained for eight years from the end of the calendar year in which they were issued, subject to any applicable statutory extension. These billing periods are not general retention periods for all employee, account or service data.
5.5. You may request additional information about applicable retention periods by contacting [email protected].
6. WHO ARE THE RECIPIENTS OF MY PERSONAL DATA?
6.1. Personal data are disclosed only where necessary for the relevant purpose and in accordance with the role allocation described in Section 2. Recipients may include Coverflex Group entities, service providers, benefit or product partners, regulated payment or insurance providers, professional advisers, competent authorities and other persons authorised or required by law.
6.2. Where a third party determines its own purposes and essential means — for example, a regulated payment institution, insurer, educational institution or merchant — it acts as an independent controller and provides information about its own processing. Where a provider processes personal data on Coverflex’s behalf, it acts as a processor. Where Coverflex processes personal data for a Client, a provider engaged for that processing acts as a subprocessor and is subject to the applicable DPA.
6.3. Within the Coverflex Group, personal data may be disclosed to another Group entity for governance, compliance, privacy, information-security, risk-management, internal-control, management-reporting or corporate-oversight purposes. Where the receiving entity determines those purposes, it acts as an independent controller and is responsible for the processing it controls. This does not create joint controllership.
6.4. Depending on the activated service and jurisdiction, recipients may include:
6.5. The providers used for employer-instructed processing depend on the services activated by the Client. Changes to subprocessors are handled in accordance with the DPA, including the applicable notice and objection process.
7. ARE THERE INTERNATIONAL DATA TRANSFERS?
7.1. Coverflex seeks to process personal data within the European Economic Area ("EEA") where appropriate for the relevant service and configuration. Card-issuing and electronic-money services used for EEA programmes are provided by regulated entities established in the EEA.
7.2. Where personal data are transferred to, or accessed from, a country outside the EEA, Coverflex applies a transfer mechanism recognised under Chapter V GDPR, as applicable to the relevant transfer. This may include an adequacy decision, the European Commission’s Standard Contractual Clauses, participation in an approved data-privacy framework, binding corporate rules or another legally recognised safeguard, together with supplementary measures where required by the circumstances.
7.3. The applicable mechanism depends on the recipient, processing location and service configuration. You may request information about the safeguards relevant to your personal data by writing to [email protected].
8. WHAT ARE MY DATA PROTECTION RIGHTS AND HOW CAN I EXERCISE THEM?
8.1. Under applicable legislation, you may request, at any time, the following data protection rights:
8.1.1. Right of Access: the right to obtain confirmation as to whether or not personal data concerning the User are being processed and, if so, the right to access their personal data and certain information.
8.1.2. Right to Rectification: the right to rectify inaccurate personal data concerning the User or to have incomplete personal data completed.
8.1.3. Right to Erasure: the right to obtain the erasure of your personal data without undue delay provided that there are no valid grounds for its retention, such as cases where they must be retained to comply with a legal obligation or because a judicial process is underway.
8.1.4. Right to Restriction of Processing: the right to request the restriction of processing of your personal data, in the form of suspension of processing or limitation of the scope of processing to certain categories of data or processing purposes, as established in Article 18 of the GDPR.
8.1.5. Right to Data Portability: the right to receive the personal data concerning you, which you have provided, in a structured, commonly used and machine-readable format and/or the right to have those data transmitted to another controller.
8.1.6. Right to Object: the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, unless there are compelling legitimate grounds that override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims. Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out while the consent was in force.
8.2. You also have the right to lodge a complaint with the competent data protection authority in your jurisdiction, as identified in Section 10 (Applicable Law, Supervisory Authorities and Jurisdiction).
8.3. You may exercise your rights at any time by contacting [email protected]. Coverflex handles requests concerning the activities for which it acts as controller. For activities carried out on your employer’s behalf, your employer is responsible for the response; Coverflex forwards relevant requests to it promptly and provides the assistance required under the DPA. You may also contact your employer directly about those activities.
8.4. Additionally, for the purposes of verifying the identity of the User as the holder of the personal data, the communication should contain, whenever possible, the following elements: name, email address, and the right you wish to exercise.
8.5. Note that, if an authorized representative exercises any right on your behalf, proof of such authorization will be required.
8.6. Where Coverflex is responsible for the response, it will respond without undue delay and within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. Coverflex will inform you of any extension and its reasons within the first month. Electronic requests are answered electronically where possible, unless you request otherwise.
8.7. Where a Salary Transparency indicator, Integration record or rule-based validation result concerns processing carried out on the Client’s behalf, you may contact the Client about the source data, criteria, correction or review of the relevant employment or benefit decision. Coverflex will assist the Client in accordance with the DPA. Coverflex handles directly any request that concerns processing for which it acts as controller.
9. HOW ARE MY PERSONAL DATA PROTECTED?
9.1. Coverflex maintains technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures are selected having regard to the nature, scope, context and purposes of the processing and the risks to individuals, and may include access controls, confidentiality obligations, encryption, logging and monitoring, vulnerability management, secure development, incident response, business continuity, backup and supplier-security controls.
9.2. Access to personal data is limited to authorised personnel and service providers on a need-to-know and least-privilege basis, subject to appropriate confidentiality and security obligations. Security measures are reviewed and updated in a risk-based manner. No system can be guaranteed to be completely secure, and these measures are designed to reduce and manage risk rather than to warrant that every security incident can be prevented.
9.3. Coverflex holds ISO/IEC 27001:2022 certification for its Information Security Management System within the scope defined in the applicable certificate, subject to ongoing surveillance and continued conformity.
10. APPLICABLE LAW, SUPERVISORY AUTHORITIES AND JURISDICTION
10.1. The processing of personal data under this Privacy Policy is governed by Regulation (EU) 2016/679 (GDPR), complemented by the national legislation applicable in the jurisdiction of the relevant Coverflex entity acting as data controller.
10.2. Depending on the user’s location and the contracting entity, the following applies:
10.3. Portugal
10.3.1.1. Controller: Universal Cover, S.A.
10.3.1.2. Applicable law: Portuguese data protection law and Law 41/2004 (ePrivacy)
10.3.1.3. Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD)
10.3.1.4. Jurisdiction: Portuguese courts
10.4. Spain
10.4.1.1. Controller: Coverflex España, S.L.
10.4.1.2. Applicable law: Spanish data protection law, including Ley Orgánica 3/2018 (LOPDGDD) and Ley 34/2002 (LSSI)
10.4.1.3. Supervisory authority: Agencia Española de Protección de Datos (AEPD)
10.4.1.4. Jurisdiction: Spanish courts
10.5. Italy
10.5.1.1. Controller: Evinrude Due Srl
10.5.1.2. Applicable law: Italian data protection law
10.5.1.3. Supervisory authority: Garante per la protezione dei dati personali
10.5.1.4. Jurisdiction: Italian courts
10.6. Germany
10.6.1.1. Controller: Coverflex Germany GmbH, c/o Osborne Clarke, Lilli Palmer Straße 2, 80636 München, Germany
10.6.1.2. Applicable law: German data protection law, including the Federal Data Protection Act (BDSG), and the Telecommunications Digital Services Data Protection Act (TDDDG); Section 7 UWG applies to electronic marketing
10.6.1.3. Supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), without prejudice to the right to complain to another competent supervisory authority under the GDPR
10.6.1.4. Jurisdiction: German courts, subject to mandatory GDPR jurisdiction rules
10.7. The relevant local Coverflex entity is the primary point of contact for data subjects and acts as controller for the processing activities it determines, as recorded in the Group RoPA. Coverflex Group entities do not currently act as joint controllers; any future joint controllership would be governed by a separate arrangement under Article 26 GDPR.
11. FINAL PROVISIONS
11.1. Cookies
11.1.1. The use of cookies and similar technologies is subject to applicable ePrivacy legislation, including Law 41/2004 in Portugal, Law 34/2002 (LSSI) in Spain and Section 25 TDDDG in Germany.
11.2. Minors
11.2.1. Application accounts and self-service functionality are intended for eligible workers and other authorised adult users, not for use by children. Data relating to a minor may nevertheless be processed where necessary for an activated childcare, insurance, dependant or other family-related benefit. This may include, for example, the child’s name, tax identifier, date of birth, relationship to the User and supporting documents required for the benefit.
11.2.2. Where Coverflex performs that processing on the Client’s instructions — including for Coverflex Child or an activated German KITA benefit — the Client is responsible for the lawful basis, required information and eligibility rules. Coverflex limits the processing to the activated service and does not rely on the commercial agreement with the Client as an Article 6(1)(b) basis in relation to the child.
11.3. Law and Jurisdiction
11.3.1. Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the courts of the country where the relevant Coverflex entity acting as data controller is established, without prejudice to any mandatory legal provisions.
11.4. Changes to the Privacy Policy
11.4.1. Coverflex may change this Privacy Policy at any time. These changes will be duly advertised through the pages of the Website and, should they imply a substantial change regarding how data will be processed, Coverflex will notify such changes, through the contact details that have been provided.
11.5. DPO
11.5.1. A single Data Protection Officer (DPO) has been appointed at group level, in accordance with Article 37(2) GDPR, and is responsible for all Coverflex entities.
11.5.2. The DPO can be contacted at: [email protected]
11.6. Questions
11.6.1. If you have any questions related to the processing of your personal data and the exercise of the rights conferred on you by applicable legislation and, in particular, referred to in this Policy, contact us through the email address [email protected]
