The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
A shop's risk is rarely a large body of data. It lies in the chain from till to card terminal to internet. If the network is not working, the card terminal cannot take payment. If the till is not working, you no longer know the prices or the stock. The customer in the shop does not wait and does not come back later.
Till systems are, moreover, often the oldest equipment on the premises. They run for years on an operating system that no longer receives updates, sit on the same network as the guest wifi and are maintained remotely by the supplier. That is exactly the profile ransomware comes in on, and what insurers ask about in the application.
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Outdated till software is the question asked most often
A till system lasts ten years, an operating system does not. If your till runs on a version that no longer receives security updates, that is a weighty consideration for an insurer and sometimes a reason to refuse or to set further requirements. In any event, keep the till network separate from the guest wifi. What you enter about this is a disclosure within the meaning of Article 7:928 of the Dutch Civil Code; if the stated measure is missing, the insurer may reduce the payout under Article 7:930 DCC.
Your interruption loss is shorter but starts sooner
Unlike at an office, the loss is visible immediately: no till means no sales. At the same time the outage is often short, and that is precisely when it falls below the waiting period of the business interruption cover, below which nothing is paid. So discuss what waiting period applies, how turnover per day is calculated and whether a peak period such as December is weighted separately. Additional costs of being able to take payments again quickly are sometimes covered.
Till hardware and card equipment fall outside the cover
If a till, scanner or card terminal is physically broken, or everything stops because of a power or internet failure without an attack, that is not a cyber loss. It belongs with your business contents or electronics insurance, or with the arrangements with your payment service provider. Theft of cash and loss of stock are also excluded. The cyber policy starts with a security incident: ransomware, a break-in on the till network or a data breach.
A loyalty card and cameras do make you a processor
Loyalty data, purchase history, a customer list for the newsletter and camera images in the shop are all personal data. If that leaks, the duty to report applies, and with camera images there is the further question of whether the use of cameras was lawful in the first place. Keep no more than you need and switch on automatic deletion. Fines from the Autoriteit Persoonsgegevens (the Dutch data protection authority) are not insurable; investigation, notification costs and claims from customers generally are.
What does your premium depend on?
Number of branches and tills. More points of sale on one central till environment means that a single infection hits every branch at once.
Daily turnover per branch. Turnover per trading day is the basis of calculation for interruption loss when the till or network fails.
Age of the till software. A till on an operating system that is no longer supported is the most weighty objection for insurers.
Network separation in the shop. Is the till network kept apart from guest wifi and from suppliers' equipment, or does everything hang on the same network?
Size of your customer and loyalty file. The number of customers with a loyalty card or newsletter subscription determines the duty to report after a breach.
Remote maintenance by suppliers. Remote access to the till system is a convenience that is also a way in for attackers.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Our till was down for half a day. Do we get the lost turnover paid?
Only if the cause is a covered security incident and the outage lasted longer than the waiting period. For shops that is the trickiest point: many outages last less than the threshold and then produce nothing. So have the waiting period quoted expressly and compare it between insurers, because there is more difference in that than in the premium itself.
We hardly process any customer data. Is cyber insurance worthwhile then?
For a shop the value often lies not in the data breach cover but in the immediate help and the interruption. If the till system is down through ransomware, you need specialists within hours to establish what has happened and help with recovery. That is work you cannot organise yourself while the shop is shut and the staff are still being paid.
Our card terminal was skimmed. Is that covered?
Manipulation of a card terminal is first and foremost a matter for the bank and your payment service provider. The terminal is their equipment and they apply their own liability rules. The cyber policy is aimed at your own systems and data. If customer data from your till or loyalty environment also falls into the wrong hands, that part does reach the policy.
The till system is managed by the supplier. Who is responsible?
For the customer data you remain the controller, even if the supplier manages the system. For the interruption it depends on your contract and the limitation of liability in it, which in practice is almost always strict. Check whether your policy includes failure at a service provider. Without that extension a fault at the supplier falls outside the cover.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
