INTERASCO S.A.G.I. GENERAL INSURANCE COMPANY (INTERASCO S.A.G.I. or the Company), with headquarters in Chalandri, Attica, at 44 Vas. Georgiou B & Kalvou street, Postcode 15233, tel.: +30 2106776100, email:
[email protected] (the contact details),
hereby informs you, in accordance with the provisions of General Data Protection Regulation 679/2016 (GDPR), in its capacity as Data Controller, on the appropriate and lawful use of your personal data (data), which you provide us, either with the insurance application or by submitting an insurance proposal, either as a party/policyholder or as an insured party / insurance beneficiary, and pursuant to the provisions of L. 2496/1997, which we process solely for the following purposes.
1. Source of information and types of data.
1.1. When submitting your application, at a pre-contractual stage or during the term of your insurance contract, as part of its management, execution or renewal, as well as at the insurance compensation settlement stage, the necessary information is collected for the execution of the contract and the satisfaction of any relevant request. This information is contained in the relevant application, in your insurance policy and in their accompanying questionnaires, documents, and supporting documents, as you have provided or disclosed it to us, when required, orally or in any other way, in writing or electronically, through our authorized employees and/or our collaborating brokers.
1.2. The information collected as above may fall into the following categories of data: a) Identification and contact details (e.g. Full name, occupation, Tax Identification Number, Tax Authority, Social Security Number, identity card number, passport number, insurance fund, date of birth, gender, address, landline and mobile phone number, email), b) payment data (e.g. payment methods, bank accounts, credit and other cards), c) insurance data, special categories, including sensitive health data, whether or not necessary for insurance assessment, conclusion and management of the insurance contract (e.g., insurance coverage history, complete medical history, information on financial condition / assets, interests, hobbies, lifestyle), d) settlement data necessary to manage compensation or insurance claims, and any additional details, information or supporting document, which, based on the occurrence of an insurance risk, is considered expedient as it relates to the incident and the circumstances in which it occurred, and may include your personal information.
2. Processing purposes.
The purposes for which your data is processed consist of:
a. the risk assessment, before concluding the contract or even during the term of the insurance contract, the determination of the general and special insurance terms and the corresponding insurance premium,
b. the management of the insurance contract, during its term or after its expiration, including the assessment, audit, settlement of the insurance compensation on the occurrence of the insurance risk or the payment of the amount (insured amount) provided in the terms of the contract,
c. the compliance of our Company with the obligations imposed by the applicable legislative and regulatory framework and the avoidance of insurance fraud,
d. the investigation that may be carried out by the Company in relation to other, past or future, insurance applications submitted by the subject,
e. the ability of our Company to contact you in order to update your details, to respond to your request, as well as to inform you about the provision of upgraded insurance services and promote new insurance products.
3. Recipients:
a. our Company and its authorized personnel.
b. natural or legal third parties collaborating with the Company within the framework of its legal operation and execution of the insurance contract, which, in the capacity of data processors on our instructions, are contractually bound by appropriate terms to protect your data, such as insurance brokers, assistance providers, healthcare providers, including in particular Mednet S.A., which provides our Company with all of our health plan support services, record keeping and management providers, postal and courier services, including the Hellenic Post, lawyers, researchers, experts,
c. Banks, as part of our standard direct bank debit / credit card, DIAS SA, Services and Organizations, in fulfilling our relevant legal and contractual obligations,
d. Our parent company HAREL Insurance Investments & Financial Services Ltd.,as our Company belongs to its Group, to which general personal data, and not personal data of special categories, are transferred, to the extent required for reporting and contracting purposes,
e. other (re) insurance companies, upon legal request, in the framework of respective partnerships that we have concluded on terms providing for the protection of your data, f. public/judicial authorities.
The Company shall not in any way disclose your personal data to third parties that are not related to the provision of coverage and services associated with and deriving from your insurance policy, unless required by law or a legal request or an order issued by a public authority.
4. Transfer to third countries: Only where it is absolutely necessary, the Company may transfer certain personal data outside the EEA and more particularly to its parent company HAREL Insurance Investments & Financial Services Ltd., subject to the provisions of Articles 44 et seq. of the GDPR, given that the appropriate safeguards are provided and your data will continue to be protected based on a European Commission decision or through the standard contractual clauses, in a form approved by the European Commission.
5. Retention time: Throughout the term of the insurance contract, or any other contractual relationship between us, and for the required time, not exceeding 20 (twenty) years after the term expires. Where an insurance contract is not concluded, we retain your data for up to 5 (five) years from the date when you informed us that a contract will not be concluded. If a legal dispute is yet to be resolved, the aforementioned times may be extended beyond the aforementioned processing times and until terminated by a final court decision.
6. Automated decision making: In order to assess the risk profile and decide on the insurance application, the Company processes your data with the support of automated procedures, in particular with the aim to assess the undertaken risk and to determine (i) if your application for insurance is acceptable or rejected, (ii) if accepted, the appropriate and proportionate premium and any special terms under which you the desired insurance plan may be concluded.
More specifically, these automated procedures are based on mathematical/statistical analyses of the critical insurance parameters that enable the objective risk assessment and its integration into a homogeneous risk group depending on the frequency and extent of the damage that may be suffered, as well as its proper pricing.
During the term of the insurance contract, automated procedures may be used to conduct checks for money laundering, fraud prevention and our compliance with the law on automatic exchange of financial account information and the law in general.
In the context of the above Processing, you reserve the right to express your opinion on a decision made based on such processing or to challenge such a decision, as well as to object to any such decision, if it relies solely on automated processing and produces legal effects concerning you or affecting you significantly.
7. Rights of the data subject: According to the provisions of the GDPR, you have the following rights:
Right to receive information on how your personal data is used.
Right to access (Article 15 of the GDPR) your personal data collected from you and processed under the insurance contract. Please note that we will provide you with a copy of the personal data upon request, reserving our right to charge you with the reasonable cost for any additional copies.
Right to rectify (Article 16 of the GDPR) any inaccurate or to complete any incomplete personal information or details of the policyholder / insured party.
Right to erasure ("right to be forgotten") (Article 17 of the GDPR) where its processing is not necessary in order to pursue the purposes for which it was collected. The right to erasure is not applicable to the extent that the processing on the part of the Company is necessary in order to comply with a legal obligation imposed by EU or national law, especially in the cases of compliance with L. 4428/2016 and 4493/2017, for for the establishment, exercise or defence of legal claims and/or defence against existing or potential legal claims raised by the Subject or any third parties, for archiving, scientific or historical research purposes or statistical purposes, provided that the data is encrypted, for preventing insurance fraud.
Right to restriction of use of your personal data (Article 18 of the GDPR), e.g. in the case of questioning their accuracy.
Right to object (Article 21 of the GDPR) to the processing of your personal data.
Right to data portability, to receive the data you have provided yourself in a structured, commonly used format.
Right to withdraw your consent at any time (Article 7 of the GDPR), that is, at any time you have the right to withdraw the consent for processing carried out under the consent, which you already give us hereunder. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. However, please be advised that if you withdraw your consent for processing data which is absolutely necessary for the execution of the insurance contract, we reserve the right to terminate the contract, as we will no longer be able to provide our services, and if your consent is withdrawn at the pre-contractual stage, we have the right to refuse to conclude the contract.
For more information and to exercise your rights, you may visit our website at
www.interasco.gr or contact us using the Company's contact details referred to on page 1 above or contact our Data Protection Officer (DPO) ) at:
[email protected] or by fax to +30 210 6776281.
If you exercise any of your rights, we shall take all possible steps to satisfy your request within thirty (30) calendar days of its receipt, giving written notice of its satisfaction or presenting the reasons why the right cannot be exercised.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority 1-3 Kifissias Ave., Athens, Postcode 115 23, +30 210 6475600,
www.dpa.gr)