The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
A marketing agency manages two kinds of keys that rarely end up in the same risk analysis. The first is spending power: advertising accounts, payment methods and bidding strategies with which a campaign budget can be burned through within a weekend. The second is the client data in your email platform, CRM and tracking tools, for which you are almost always the processor.
If an advertising or social media account is hijacked, the bill arrives in two places: the media spend burned through and the posts that went out into the world in your client's name. The first is financial loss, the second reputational damage for which your client holds you responsible. The cyber policy treats those two very differently, so it pays to know in advance which section picks up what.
If you also build or manage websites for the same clients, look at the cyber insurance for web agenciesas well; if your emphasis is on selling, the one for webshops is a better fit.
What does cyber insurance for marketing agencies cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
A hijacked advertising account costs money first and trust second
Anyone who gets into an advertising account does not need to steal anything: he switches on campaigns using your client's payment method. The defence is a matter of management, two-factor authentication on every platform account, access separated per client, budget ceilings and alerts on unusual spending. Be aware that the media spend that has drained away is usually not a covered loss: that is financial loss through misuse, a section you have to include separately and that not every insurer offers.
You are the processor of someone else's mailing list
Your email marketing and CRM tools hold your clients' customer files, including behavioural data from tracking pixels. If such a file leaks, your client reports it to the Autoriteit Persoonsgegevens (the Dutch data protection authority) and recovers the costs from you. Your data processing agreement determines how much. Record which tool holds which data and for how long, because after a breach you have to be able to say within days whose data it contained. Fines from the regulator cannot be insured, claims from those concerned generally are.
Not every publication loss is a cyber loss
If an attacker publishes something through a hijacked channel that harms your client, you are in the liability section of the cyber policy. If your own team accidentally publishes an image without a licence, a misleading claim or a statement that breaches the Dutch advertising code, that is a professional error and the claim belongs with your professional indemnity insurance (BAV). Copyright infringement and contractual penalties are excluded on almost every cyber policy, even where they come to light after an incident.
Your downtime counts differently from a shop's
If your own environment is down, your turnover does not stop immediately: hourly rates keep running, deadlines shift. The loss lies in overtime, missed delivery dates and campaigns that had to go live on a fixed date. So discuss how the business interruption cover calculates your loss of turnover and what waiting period applies, because below that threshold nothing is paid. Costs incurred to get running again sooner are often covered, provided you agree them in advance.
What does your premium depend on?
Media budget managed. How much is spent through your accounts determines what a hijacked platform account can do in a short time.
Number of client files in your tools. The total of email addresses and profiles in your mailing and CRM environments weighs more heavily than the size of your staff.
Access control on platform accounts. Two-factor authentication, access separated per client and immediate withdrawal of rights when staff leave.
Number of external tools and integrations. Every connected analytics, automation or tracking service is another place where data sits and access exists.
Data processing agreements and liability limits. What you have taken on contractually towards clients caps or increases the claims that reach the policy.
Freelancers and home workplaces. Contractors who reach client accounts on their own equipment are a separately assessed point of access.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
An attacker has spent my client's advertising budget. Does the policy pay for that?
The investigation, the restoration of the accounts and the claim your client brings against you generally fall within the cover. The budget burned through is itself financial loss through misuse and is only on the policy if you expressly included that section. Ask for it when getting a quote, together with the requirement that the platform enforces two-factor authentication. Without that measure insurers rarely offer this extension.
Who reports a data breach if my client's file leaks?
Your client, because he is the controller. You have to inform him without delay so that he meets his 72-hour deadline, and you supply the facts: which system, which data, how many records. The costs of that investigation and of informing those concerned fall under the notification costs cover, provided you report the incident to the insurer in good time as Article 7:941 of the Dutch Civil Code requires.
Does cyber insurance cover a claim about copyright in images?
No. Infringement of copyright, trade mark or image rights is a consequence of the substance of your work, not of a security incident, and appears as an exclusion on almost every cyber policy. Such claims belong with professional indemnity insurance (BAV) for communications agencies. When advising, we look at both policies together, so that the boundary between a substantive error and a security incident does not create a gap.
Our people work on their own laptops. Is that a problem for the cover?
It need not be an obstacle, but it is something the application asks about. Insurers want to know whether personal equipment is centrally managed, whether disks are encrypted and whether access to client accounts is withdrawn immediately on departure. What you enter about that is a disclosure within the meaning of Article 7:928 DCC. If it is not correct, the payout may be reduced under Article 7:930 DCC.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
