Mozard Suite

On the citizen portal Mozard sets a session cookie, a CSRF token cookie and an authentication cookie after sign in (DigiD, eHerkenning or local accounts). All three are first party and strictly necessary for the portal to function. Optional modules may add an analytics cookie (typically Matomo), a chat cookie and a customer satisfaction cookie, which are non strictly necessary and require consent.

Consent is not required for the strictly necessary cookies (session, CSRF, authentication). Consent is required for the optional analytics, chat and survey cookies, which must remain blocked in the CMP until the visitor opts in. The DigiD or eHerkenning authentication flow itself is regulated by separate Dutch government requirements and does not depend on cookie consent in the ePrivacy sense.

Public task and legal obligation (Articles 6(1)(c) and 6(1)(e) GDPR) cover the core processing of case files by the public body. Contract performance (Article 6(1)(b) GDPR) can support citizen self service accounts. Consent (Article 6(1)(a) GDPR) covers optional analytics and engagement cookies. The Dutch UAVG and sector specific laws (Awb, Archiefwet, WOO) define additional obligations and bases for the public body.

In the standard configuration, no. Mozard B.V. hosts the platform on Dutch data centres and uses EU established sub processors. The DPA published by Mozard lists the sub processors, all of which are typically located in the EU. Transfers outside the EEA can occur only if the customer activates optional modules with non EU sub processors, in which case Standard Contractual Clauses or the EU US Data Privacy Framework apply.

Yes, in practice. Dutch public bodies must perform DPIAs for systematic processing of personal data in case management systems, especially when the data includes citizen identifiers (BSN), social or financial information, or sensitive data. The DPIA should cover the citizen portal, the back office case workflow, the integration with base registries and the optional modules.

Sign the Mozard data processing agreement, document the public task and legal obligation as the legal basis, run a DPIA, integrate the Mozard cookies in your CMP (strictly necessary always on, analytics consent gated), configure retention according to the Archiefwet and the WOO, and enforce role based access control with regular reviews. Align the deployment with BIO controls and document the alignment in your security policy.

For Dutch public sector case management, alternatives include Decos JOIN, Centric Key2Klantcontact, Atos Engage Smart Government, Cobra Suite, Civision Geo, e Suite by Atos and the open source GEMMA based Open Zaak. From a GDPR perspective they are broadly comparable because they target the same regulatory environment; the choice usually depends on functional fit, ecosystem integration and pricing.

List the strictly necessary cookies (session, CSRF, authentication) with their names and durations and explain the ePrivacy exemption. List the optional analytics, chat and survey cookies with purpose, duration and recipient, and link to your CMP. Mention Mozard B.V. as processor in the privacy notice, reference the DPA and confirm that personal data stays in the Netherlands by default.