1. Who we are
Custodi Life is the trade name of Custodi Life B.V., registered with the Dutch Chamber of Commerce (KvK) under number 99763699, located at Utrecht, Nederland (‘Custodi’).
Custodi provides software to notary practices and funeral organisations (partners) and to executors. With Custodi Na (after death), an authorised executor makes an inventory of the deceased’s online accounts and subscriptions. With Custodi Vooraf (in advance), a notary practice records the testator’s consent and wishes when the will is made.
Privacy questions: custodilife@gmail.com.
2. Our role per processing activity
Whether Custodi is a controller or a processor depends on the processing activity:
| Processing activity | Custodi’s role |
|---|---|
| Website and demo requests | Controller |
| Accounts of partners and executors, invoicing | Controller |
| Dossiers through a notary practice or other partner (Custodi Na) | Processor for that practice. See the data processing agreement. |
| Dossiers Custodi enters into directly with an executor | Controller |
| Registrations made with the will (Custodi Vooraf) | Processor for the notary practice that records the registration. The practice records and manages it. |
Where Custodi is a processor, the notary practice or partner determines the purpose and means. This policy then describes how Custodi works on its instructions; the practice informs its own clients.
3. Which data
Visitors and demo requesters
- What you enter in the demo form: name, organisation, role (optional), email address, phone number (optional), organisation type and message (optional).
- Technical data processed by our hosting provider on every website visit, such as IP address, time and browser details in server logs.
Partners and executors (clients)
- Name, email address and, for partners, the name of the practice; the account password is stored only in hashed form.
- Proof of the executor’s authority: the type of document (certificate of executorship, certificate of inheritance, or instruction from all heirs jointly), the date of the document and who checked it. Custodi does not keep the document itself.
- Invoicing details.
The deceased
- Name, date of death and (optionally) date of birth.
- The email address of the scanned mailbox.
- From email header data: for each service found, the sender domain (for example netflix.com), the type of message (for example an invoice or sign-in notice) and the date.
Custodi does not process bank statements.
Third parties who emailed the deceased
During the scan, Custodi reads only the sender, subject and date of each message. Messages from individuals (senders on domains such as gmail.com, hotmail.com or kpnmail.nl) and from healthcare senders are removed before processing: nothing is done with them and only their number is counted. Messages from unknown senders are used only if the subject indicates a business message, such as an invoice or a welcome message. Subject lines are not stored and do not appear in the report. Only the domain of business senders is kept.
Testators (Custodi Vooraf)
- Name and (optionally) date of birth.
- Email addresses that may be inventoried later.
- The appointed digital executor: name and (optionally) email address.
- Wishes per category (social media, email, photos and files, financial and crypto accounts), the date of the deed, the notary and the time of recording.
4. What we never process
- Passwords of the deceased and of their accounts: Custodi never stores them. The mailbox app password is not stored either (see section 8). For a partner’s or executor’s own Custodi account, we keep only a hashed version of the login password.
- The content of messages.
- Attachments.
5. Purposes and legal bases
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Responding to demo requests | Legitimate interest (f): responding to a request for contact. |
| Accounts, services to partners and executors, invoicing | Performance of the contract (b). |
| Keeping records | Legal obligation (c), such as the tax retention obligation. |
| Processing header data of third parties for the inventory | Legitimate interest (f), see the balancing test below. |
| Non-functional cookies | Consent (a). Custodi does not place such cookies (see section 14). |
Balancing test for legitimate interest (third-party header data)
The interest is the correct settlement of the estate: the executor needs to know which services the deceased used, in order to stop costs, prevent misuse and describe the estate. Third parties are protected by data minimisation (sender, subject and date only), filtering of individuals and healthcare senders before processing, not storing or showing subject lines, and a short retention period (see section 10). We therefore consider the impact on third parties to be limited.
6. Special categories of data
Custodi does not intend to process special categories of personal data, such as health data. Messages from healthcare senders are therefore removed before processing: known healthcare domains (such as secure healthcare mail, hospitals and health insurers) and domains containing a healthcare term (such as hospital, GP, pharmacy or mental healthcare, in Dutch). Messages from individuals are also removed before processing. No filter is perfect; that is why subject lines are never stored or shown.
7. Deceased persons
The GDPR formally does not apply to the data of deceased persons (Recital 27 GDPR). Custodi treats this data with the same care as data of living persons.
8. How mailbox access works
- A scan starts only after the practice has recorded the executor’s authority, and only at that executor’s request. The executor gives explicit consent in the software.
- Access uses IMAP with an app password that the executor creates with the mail provider (Gmail, iCloud Mail or Yahoo Mail). Custodi does not use OAuth and does not request a token for continued access.
- Custodi uses the app password only to log in once. It is not stored and not logged.
- The mailbox is opened read-only. For each message, Custodi retrieves only the sender, date and subject, without marking messages as read.
- After the scan, Custodi closes the connection. Consent, the start of the scan and the end of access are recorded in the dossier log.
- The app password remains valid with the provider until the executor revokes it. Custodi asks the executor to do so after the scan and records the confirmation. Because Custodi does not keep the password, Custodi cannot reuse it.
9. Recipients and sub-processors
For the website and demo requests, Custodi uses these parties:
| Party | Purpose | Location | Safeguard for transfers outside the EU |
|---|---|---|---|
| Vercel Inc. | Website hosting and processing of the demo form | United States (company); the form function is set to the Frankfurt region (EU) | EU-US Data Privacy Framework and standard contractual clauses |
| Resend | Sending emails about demo requests | United States | EU-US Data Privacy Framework and standard contractual clauses |
| Google LLC (Gmail) | Receiving and answering email | United States and other countries | EU-US Data Privacy Framework |
Dossiers (Custodi Na) and registrations (Custodi Vooraf) are stored and processed in the EU: in Custodi’s own software, on its own equipment in the Netherlands. Custodi uses no sub-processors for this. During a scan, the software connects to the deceased’s mail provider; that is the source of the data, not a recipient.
Custodi does not sell personal data and does not use it to train AI models.
10. Retention periods
| Data | Retention period |
|---|---|
| Email header data (sender, subject, date) | Not stored. It is used only in working memory during the scan. For each service found, the sender domain, the type of message and the date are kept as part of the dossier. |
| Dossiers and reports | As long as the partner decides, up to 24 months after closure. The software then deletes closed dossiers automatically. |
| Log of authority, consent and scan | As long as the dossier exists. After deletion, only a record that the dossier was deleted remains, without data about the deceased or third parties. |
| Registrations (Custodi Vooraf) | As long as the notary practice keeps the registration. The practice can have it deleted at any time. |
| Demo and contact details | 12 months after the last contact. |
| Financial records | 7 years (tax retention obligation). |
11. Security
- Encrypted connections: the website over HTTPS, the connection to the mail provider over TLS.
- Role-based access: a partner sees only its own dossiers, an executor only the dossiers for which they are authorised.
- Account passwords are stored only in hashed form; mailbox app passwords are not stored.
- A log per dossier of authority, consent, the scan, the end of access and exports.
- The dossier software is accessible only on Custodi’s own equipment.
- Deleted data is overwritten in the database.
12. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Send your request to custodilife@gmail.com. We respond within one month and may ask you to verify your identity.
If your request concerns a dossier or registration handled through a notary practice or other partner, that practice is the controller. Custodi will forward your request to the practice and assist it in handling the request.
13. Complaints
If you have a complaint about how we handle personal data, please contact us first. You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
15. Changes
We may update this policy when our service or the law changes. The version and date are shown at the top. We inform partners in advance of material changes.