Privacy Policy - Smart Services PORTAL
Privacy Policy
- The personal information we use
- Information we collect about you
- Sources of the information we collect
- How we use your personal information and the basis on which we use it
- Your rights over your personal information
- Automated decisions about you
- Information Sharing
- Information Security and Storage
- International Data Transfer
- Non Personal Confidential information
- Contact Us
- Changes to the Policy
XL Catlin Services SE, XL Global Services Inc and their affiliates (collectively “DIGITAL COMMERCIAL PLATFORM” or “we” or “us”) are committed to compliance with data protection laws. This Privacy Notice describes how DIGITAL COMMERCIAL PLATFORM collects, uses, shares and secures your personal information and non-personal confidential information when we provide our services. It also describes your choices regarding use, access and correction of your personal information. Personal information is information, or a combination of pieces of information that could reasonably allow you to be identified.
1. Personal information we use
We may be required by law to collect certain personal information about you, or as a consequence of any contractual relationship we have with you. Failure to provide this information may prevent or delay the fulfilment of these obligations. We will inform you at the time your information is collected whether certain data is compulsory and the consequences of the failure to provide such data.
1.1 Information we collect about you
The type of information we may collect and process about you will depend upon the type of services we are offering. It may include personal details (e.g. name, surname, etc.), contact and professional information (e.g. email address).
From the information we collect about you, we may also derive or generate further information such as risk ratings. Some of this information is generated through profiling (see the section below on "Do we use personal information for profiling and automated decision making?").
1.2 Sources of the information we collect
We collect personal information from you directly when you voluntarily provide it to us, for instance if you submit forms, surveys or contact us.
We also collect your personal information from a variety of sources:
- From other insurance companies that we work with
- From our business partners with whom we work
- From public sources, such as public databases (where permitted by law)
- From third party providers
Occasionally we may collect your personal information from a third party, in particular from authorised, regulatory, public sources such as government regulators, industry self-governing bodies and other publicly available records. This will be most common when we are complying with our legal obligations regarding money laundering and other financial crimes. If appropriate, in these circumstances we will either notify you of our sources or seek your consent to their use.
2.How we use your personal information and the basis on which we use it
We use your personal information to:
(a) to provide our services and fulfil our contractual obligations to you and other third parties. For example, for “Wildfire prevention” service, the risk exposure diagnosis involves the use of your site's location data.
(b) to conduct data analysis, which helps us assess risks, price our products appropriately and improve our services
(c) to help us prevent and detect fraud, money laundering, terrorism and other crimes
(d) to help develop new, and improve existing, services
(e) to operate and expand our business activities
(f) to perform administrative activities in connection with our services
(g) to exercise, defend and protect our legal rights or the rights of third parties
(h) to comply with legal obligations and to cooperate with regulatory bodies to which we are subject
(i) for research and development of new insurance products
(j) to audit our business
(k) for marketing purposes.
(l) to manage access to the customer area.
We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:
(a) to complete necessary pre-contractual checks to ensure that we can assess your suitability for our services we offer
(b) to fulfil our contractual obligations to you, for example to provide the services you request and to ensure that invoices are paid correctly. Failure to provide this information may prevent or delay the fulfilment of these contractual obligations
(c) to comply with our legal obligations, such as due diligence and reporting obligations, and responding to binding requests from regulators, law enforcement authorities or other government authorities
(d) to meet our legitimate interests, for example to improve our services, to ensure we price our products appropriately, to manage risk, to manage our business efficiently, to perform audits, and to maintain accurate records. When we process personal information to meet our legitimate interests, we always balance these against your fundamental rights and freedoms and put in place robust safeguards to ensure that your privacy is protected
(e) to exercise our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims or violations of law.
If it is necessary that we process your sensitive personal information for one of the purposes listed above, we will only do so where one of the following applies:
(a) We have obtained your explicit consent
(b) We need to process your sensitive personal information to establish, exercise or defend a legal claim
(c) We need to process your sensitive personal information for reasons of substantial public interest, for example to prevent or detect unlawful acts or fraud or for an insurance purpose
(d) We are otherwise authorised by local law to process your sensitive personal information.
We may obtain your consent to collect and use certain types of personal information when we are required to do so by law (for example, in relation to our direct marketing activities, cookies and tracking technologies or when we process sensitive personal information). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Notice.
(a) We have obtained your explicit consent
(b) We need to process your sensitive personal information to establish, exercise or defend a legal claim
(c) We need to process your sensitive personal information for reasons of substantial public interest, for example to prevent or detect unlawful acts or fraud or for an insurance purpose
(d) We are otherwise authorised by local law to process your sensitive personal information.
We may obtain your consent to collect and use certain types of personal information when we are required to do so by law (for example, in relation to our direct marketing activities, cookies and tracking technologies or when we process sensitive personal information). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Notice.
3. Your rights over your personal information
You have certain rights regarding your personal information, subject to local law. These include the following rights to:
- access your personal information
- rectify the information we hold about you
- erase your personal information
- restrict our use of your personal information
- object to our use of your personal information for prospecting purposes. Insofar as we process your data for the purposes of our legitimate interests, you may also object to such processing if your particular situation gives rise to grounds for objecting to such data processing.
- receive your personal information, provided by you, in a structured, common and machine-readable format and transfer this data to other data controller (right to data portability)
- lodge a complaint with your local data protection authority.
If you would like to discuss or exercise such rights, please contact us at the details below.
We encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate.
We will contact you if we need additional information from you in order to honor your requests.
4. Automated decisions about you
The way we analyze personal information for the purposes of e.g. risk assessment or fraud prevention may involve profiling, which means that we may process your personal information using software that is able to evaluate your personal aspects and predict risks or outcomes. We may also use profiling, or otherwise employ solely automated means, to make decisions about you that relate to the basis on which we provide our services to you. This is known as "automated decision-making" and is only permitted when we have a legal basis for this type of decision-making.
We may make automated decisions about you:
- Where such decisions are necessary for entering into a contract.
- Where such decisions are required or authorised by law, for example for fraud prevention purposes
- Where you give your consent to us carrying out automated decision-making.
Subject to local legal requirements and limitations, you can contact us to request further information about automated decision-making, object to our use of automated decision-making, or request an automated decision to be reviewed by a human being.
5. Information Sharing
We may share your personal information with third parties under the following circumstances:
- AXA group companies. We operate as a global business, so we may share your personal information with group companies who may use this information for the purposes described in this privacy notice.
- Insurance companies, cover-holders, intermediaries, financial institutions, retrocessionaires and business partners. We may share your personal information with insurance companies, intermediaries, financial institutions, retrocessionaires and business partners that use your personal information in connection with the provision of the service.
- Service providers. We may share your personal information with service providers that perform services and other business operations for us, for example, IT and analytics providers, actuarial service entities, auditors and advisers.
- Any law enforcement agency, court, regulator, government authority or professional body. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
- Asset purchasers. We may share your personal information with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this privacy notice.
- Customer companies. We may share our personal information with your company or employer in certain circumstances.
Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section "International Data Transfer" below for more information.
6. Information Security and Storage
We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.
We will keep your personal information for as long as we have a relationship with you, and for a period thereafter no longer than is necessary for the purposes for which they are processed and in line with our Global Records Management Policy. Insofar as we retain your data beyond this period, this is done either in the context of compliance with the legal retention periods applicable to us (for example due to tax, commercial or social law regulations) or because your data may be necessary for the establishment, exercise or defence of legal claims. In the latter case, the retention period is determined by the statutory limitation period.
7. International Data Transfer
Your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information under European Union law or by the European Commission. We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.
Where we transfer personal data from EU countries to AXA companies and service providers outside the European Economic Area (EEA), We provide safeguards to ensure the security and the confidentiality of your personal data, by framing the transfer through either (i) the Standard Contractual Clauses adopted by the European Commission or (ii) through Binding Corporate Rules when your personal data is transferred to other entities of the AXA Group. In addition, we have put in place additional contractual, organisational and technical measures to ensure that recipients comply with their obligations under the Binding Corporate Rules and Standard Contractual Clauses and that these can be enforced against them.
8. Non Personal Confidential Information
The provisions of sections 4 and 5 of this Privacy Policy also apply to any non-personal confidential information we hold about you.
9. Contact us
If you have questions about your rights or concerns regarding the way in which your personal information has been used, please contact our local Data Protection Officer at dataprivacy@axaxl.com.
We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the relevant data protection authority.
10.Changes to the Privacy Policy
You may request a copy of this Privacy Notice from us using the contact details set out above. We may modify or update this Privacy Notice from time to time.
If we change this Privacy Notice, we will notify you of the changes. Where changes to this Privacy Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).