Data Privacy

ALLIANZ GLOBAL CORPORATE & SPECIALTY SE (“we, “us” “our”), a part of the Allianz Group, is an German authorised insurance company providing insurance products and services on a cross-border basis.  Protecting your privacy is a top priority for us. This privacy notice explains how and what type of personal data will be collected, why it is collected and to whom it is shared or disclosed. Please read this notice carefully.

1. Who is the data controller?

 A data controller is the individual or legal person who controls and is responsible to keep and use personal data. ALLIANZ GLOBAL CORPORATE & SPECIALTY SE (AGCS) is the data controller as defined by relevant data protection laws and regulation. 

2. What personal data will be collected?

We may collect and process various types of personal data about you as follows:  

• Surname, first name
• Address
• Date of birth
• Gender
• Identification document number
• Telephone numbers
• Email address
• Credit/debit card and bank account details
• Lifestyle

We may also collect and process “sensitive personal data” about you such as, for example data resulting from medical reports or your claims history. 

3. For what purpose do we use your personal data?

We will collect and use the personal data that you provide to us and that we receive about you (as explained below) for a number of purposes as stated below.

The collection and processing of personal data that you transmit to us or that we receive about you are made in accordance with the legislation on the protection of personal data and based either on the laws applicable to insurance and the insurance contract, or on your explicit consent, unless the applicable laws and regulations exempt us from collecting it.

As mentioned above, for the purposes indicated above, we may process the personal data we receive about you from public databases, third parties such as brokers and business partners, other insurers, credit reference and fraud prevention agencies, advertising networks, analytics providers, search information providers, loss adjustors, surveyors, intermediaries, premium finance companies, delegated authorities, lawyers.

4. What is the legal basis for the processing of personal data?

The processing of your personal data is based on the following legal grounds:

1. for the performance of the contract with you;
2. legal obligations (e.g. tax legislation); and
3. for the purpose of our legitimate interests;
4. consent given by you.

For the processing of personal data that does go beyond what is strictly necessary for the provision of our services, which is not based on a statutory duty, nor on your consent, we rely on what is called a "legitimate interest". That legitimate interest lies in everything that is necessary for the normal management and continuity of our business operations, among which direct marketing, prevention of fraud and credit scoring purposes. When we process your personal data based on our legitimate interest we consider that such interests are not overridden by your interests or fundamental rights and freedoms which require protection of your personal data, in particular where the data subject is a child. If you feel that we are violating your privacy, you are free to file a complaint (see below).

5. Mandatory provisions

When we ask you for personal data, we will state for each situation whether the provision of the data is necessary or mandatory and what the (possible) consequences are if the data is not provided. The basic principle here is that we will not process more personal data than necessary for the purposes described above.

6. Who will have access to your personal data?

We will ensure that your personal data is processed in a manner that is compatible with the purposes indicated above.

For the stated purposes, your personal data may be disclosed to the following parties who operate as third party data controllers only on a “need to know”-basis:

• Public authorities, other Allianz Group companies, other insurers, co-insurers, reinsurers, insurance intermediaries/brokers, experts, lawyers, medical doctors and banks.

For the stated purposes, we may also share your personal data with the following parties who operate as data processors under our instruction and limited to “need to know”:

• Other Allianz Group companies, technical consultants, loss adjustors, repairers and service companies to discharge operations (claims, IT, postal, document management); and
• Advertisers and advertising networks to send you marketing communications, as permitted under local law and in accordance with your communication preferences. We do not share your personal data with non-affiliated third parties for their own marketing use without your permission.

Finally, we may share your personal data in the following instances:

• In the event of any contemplated or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in any insolvency or similar proceedings; and
• To meet any legal obligation, including to the relevant ombudsman or applicable supervisor authority if you make a complaint about the product or service we have provided to you.

Your personal data may be processed both inside and outside of the European Economic Area (EEA) by us or the parties specified in section 4 above. Where we share your personal data with any entity outside the EEA, we will put appropriate legal frameworks in place in order to cover such transfers. We will not disclose your personal data to parties who are not authorized to process them.

First of all, transfers of personal data to a third country may take place on an adequacy decision of the European Commission. This means you can transfer personal data to third countries who are recognized as providing adequate protection. Click here to find out which countries outside the EU offer an adequate level of data protection.

Transfers to third countries, which cannot be based on an adequacy decision, will only take place based on Binding Corporate Rules or Standard Contractual Clauses. When the transfer cannot be based on an adequacy decision, we have to provide appropriate safeguards to transfer personal data to a third country. Whenever we transfer your personal data for processing outside of the EEA by another Allianz Group company, we will do so on the basis of Allianz’ approved binding corporate rules known as the Allianz Privacy Standard (Allianz’ BCR) which establish adequate protection for personal data and are legally binding on all Allianz Group companies. Allianz’ BCR and the list of Allianz Group companies that comply with them can be accessed here.  You can find out what safeguards we rely upon for such transfers (for example, Standard Contractual Clauses) by contacting us as detailed in section 14 below.

8. How do we make use of automated decision making and profiling?

We use automated decision-making and / or profiling to evaluate an individual's personal aspects, such as their creditworthiness or future behavior. By using these techniques, we can make an appropriate offer based on the results and determine how it can approach the customer in an appropriate way. We also use internal statistical and analytical data for the evaluation. Do you have questions about your specific evaluation or do you disagree? Please contact us. You will find the contact details at the bottom of this document.

9. What are your rights in respect of your personal data?

You have the right to:

• Access your personal data held about you and to learn the origin of the data, the purposes and ends of the processing, the details of the data controller(s), the data processor(s) and the parties to whom the data may be disclosed;
• Withdraw your consent at any time where your personal data is processed with your consent;
• Oppose to the treatment, especially when your personal data are not useful or are no longer necessary to our contractual relationship;
• Update or correct your personal data if inaccurate or incomplete; 
• Delete your personal data from our records in certain circumstances, such as when the retention period of your personal data is exceeded or when they are no longer necessary for the purpose of their collection and processing;
• Restrict the processing of your personal data in certain circumstances, for example where you have contested the accuracy of your personal data, for a period enabling us to verify its accuracy;
• Obtain your personal data in an electronic format for you or for your new insurer; and
• The right to the portability of your personal data, that is to say the right to receive your personal data in a structured, commonly used and machine-readable format or to have them transmitted directly to another controller;
• File a complaint with us and/or the Dutch Data Protection Authority (the Autoriteit Persoonsgegevens: https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/gebruik-uw-privacyrechten/klacht-melden-bij-de-ap)
• AGCS processes personal data in accordance with the Dutch Code of Conduct for the Processing of Personal Data, which can be downloaded on www.verzekeraars.nl.

10. How can you object to the processing of your personal data?

Where permitted by applicable law or regulation, you have the right to object the processing of your personal data (including for purposes of direct marketing). Once you have informed us of this request, we shall no longer process your personal data unless permitted by applicable laws and regulations.

You may exercise this right in the same manner as for your other rights indicated in section 9 above.

11. Supervisor

The Dutch Data Protection Authority (DPA) is the independent supervisor for compliance with the privacy legislation. You have the right to file a complaint with the DPA. You can also contact the DPA regarding questions about the privacy legislation. More information about the DPA and the contact details of the DPA can be found via www.autoriteitpersoonsgegevens.nl/en.

12. How long do we keep your personal data?

According to our Record Retention Policy, we will retain your personal data generally for 10 [ten] years from the date the insurance policy or product expires, a claim has been settled or the business relationship ends basically, unless a longer retention period is required or is permitted by law and necessary from our side.

We will not retain your personal data for longer than necessary and we will hold it only for the purposes for which it was obtained.

13. Data Protection Officer (DPO)

We have appointed a data protection officer (DPO). The DPO supervises compliance with privacy legislation and advises us on privacy legislation.

The DPO is independent and benefits from legal dismissal protection. The DPO reports directly to the top manager of Allianz Global Corporate & Specialty SE.

The DPO is also the contact person for all questions about privacy, both for you as a data subject and for the supervisor.

14. How can you contact us? 

If you have any queries about how we use your personal data, you can contact us by, post or email as follows: 

• By email: AGCS-DATA-PROTECTION-MED@allianz.com
• By post:
  Allianz Global Corporate & Specialty SE
  Data Protection
  1, cours Michelet
  Case Courrier S 1205
  CS 30051
  92076 Paris La Défense Cedex
  France

15. How often do we update this privacy notice?

We regularly review this privacy notice. We will ensure the most recent version is available on our website https://www.agcs.allianz.com/global-offices/netherlands/data-privacy.html.

This privacy notice was last updated on May 25th, 2018.