VERSPIEREN PORTUGAL, Corretores de Seguros, S.A., with registered office at Avenida Duque D'Ávila, 116 B, 1050-084 Lisbon, holder of legal-person identification card no. 500 938 326, registered with the Lisbon Commercial Registry under no. 54586, with a share capital of €119,620.00, an insurance intermediary registered with the ASF – Autoridade de Supervisão de Seguros e Fundos de Pensões in the category of Insurance Broker under no. 607155051, granted on 27 January 2007, authorised to carry on insurance mediation in the Life and Non-Life classes, and as a Reinsurance Intermediary under no. 815421316, which may be verified and confirmed at www.asf.com.pt.
To honour its commitment to the privacy of data subjects, VERSPIEREN PORTUGAL has adopted best practices for the security and protection of personal data, in accordance with the General Data Protection Regulation in force.
Processing activity: management of the pre-contractual and contractual insurance relationship.
1. Personal data
Personal data means any information relating to an identified or identifiable natural person, of any nature and regardless of the medium.
An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (e.g. an identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person).
Depending on the purpose of collection identified above, the following information may be gathered:
Identification data;
Contact data (address, e-mail address, telephone numbers);
Personal data contained in insurance proposals and other contract-execution documents, in particular claim notifications, and any amendments thereto.
2. Data controller and Data Protection Officer
VERSPIEREN PORTUGAL is the entity responsible for collecting and processing personal data for the stated purposes.
To advise VERSPIEREN PORTUGAL on data protection matters, Dr. Paulo de Jesus Correia, lawyer, has been appointed Data Protection Officer and may be contacted in writing at the following addresses:
E-mail: [email protected]
Post: VERSPIEREN PORTUGAL, Avenida Duque D'Ávila, 116 B, 1050-084 Lisboa, Portugal
If you consider that the information in this policy is not sufficiently clear and/or transparent, or for any other reason you consider relevant, please contact us by e-mail at [email protected].
3. Purpose of processing personal data
The collection and processing of personal data by VERSPIEREN PORTUGAL is intended for the pursuit of its mediation activity between clients and insurers (in the various classes authorised by the ASF), including in particular:
Collecting, analysing and using personal data to approach the market with a view to advising on insurance contracts;
Running simulations on insurers' platforms; and
Transferring data to insurers so that they can quote and present an insurance proposal.
Completing the forms corresponding to each of these purposes and/or sending personal data to us by any other means constitutes the data subject's prior and express consent to the processing of the personal data transmitted.
In light of the above, VERSPIEREN PORTUGAL clarifies that personal data concerning philosophical or political beliefs, religious faith and private life, as well as data concerning health and sex life, including genetic data, that may be collected and/or inferred from the data provided by data subjects, will be processed exclusively for the purposes indicated above and may not be processed in a manner incompatible with those purposes.
Accordingly, should unsolicited personal data be transmitted to VERSPIEREN PORTUGAL, it cannot be held responsible for their processing under this policy.
Without prejudice to other means of contacting VERSPIEREN PORTUGAL, a data subject's failure to provide personal data prevents VERSPIEREN PORTUGAL from considering them for the insurance mediation services listed, as applicable.
4. Retention of personal data
The period for which personal data are stored and retained varies according to the purposes referred to above.
Personal data whose purpose relates to:
Processing necessary for the mediation, performance and management of the insurance contract, or for pre-contractual steps, with the involvement of VERSPIEREN PORTUGAL, are retained until the statutory limitation period for all obligations arising from the insurance contract and the related mediation activity has elapsed. For prospecting and commercial action, they are retained until one year after the end of the contractual and legal relationship.
Compliance with legal obligations, in particular towards supervisory, tax or judicial authorities, among others, are retained for the legal period applicable at any given time to each legal obligation, or until the limitation or expiry period for exercising a right has elapsed.
5. Right of access, rectification, erasure, restriction of processing and right to data portability
Data subjects are guaranteed, at any time, the right of access to their personal data, as well as the right to rectification, portability, restriction and/or objection to processing. Any of these rights may be exercised by writing to VERSPIEREN PORTUGAL at its registered office or at the following e-mail address: [email protected].
In addition, data subjects may at any time lodge a complaint with the competent supervisory authority.
6. Security of personal data processing
Personal data are processed and stored on computer and paper media. VERSPIEREN PORTUGAL undertakes to guarantee the security and protection of the personal data made available to it and has adopted the appropriate and necessary measures for that purpose, in particular:
Physical security measures
Physical access to processing operations is restricted to VERSPIEREN PORTUGAL staff.
IT security measures
A code of conduct governs the use of IT resources and services;
System access requires password authentication;
Passwords are personal;
A secure copy of the data is kept (secure servers);
The system is protected against unauthorised access to personal data;
The system can log the activities performed and who performs them (audit trail);
The system is protected against viruses and malware and is updated systematically;
Operating systems are not obsolete and are updated almost systematically so as not to contain known/published vulnerabilities;
Use of a firewall;
Secure data transmission protocols (https);
Encryption of information on mobile devices;
Secure disposal of equipment;
Access profiles according to job function;
Use of VPN for remote access to the internal infrastructure;
Regular backups.
Organisational measures
Data subjects' data are not transferred outside the European area;
Physical access to the places where data are processed is restricted;
No personal data are stored in computer memory;
Staff contracts include long-term confidentiality duties;
All staff are informed of the applicable policies and rules;
Personal data are processed exclusively within the agreed purposes;
Information duties towards data subjects are fulfilled and consent is obtained;
Conduct is aligned with the data controller's data protection policies and procedures;
The data processed are always strictly limited to what is necessary for the purpose in question;
The level of compliance with requirements is assessed periodically (audit).
VERSPIEREN PORTUGAL informs that these security measures are reviewed and updated according to the needs and requirements of these matters.
Should, for any reason, a security breach occur that accidentally or unlawfully causes the destruction, loss, alteration, unauthorised disclosure of or access to personal data, VERSPIEREN PORTUGAL undertakes, under the applicable legislation, to notify the competent authorities without undue delay and, where possible, within 72 hours of becoming aware of it.
In addition, and as set out in the preceding paragraph, VERSPIEREN PORTUGAL undertakes to communicate the personal data breach to the data subject concerned, in accordance with the applicable legislation.
7. Disclosure of personal data to third parties
In the course of its activity, VERSPIEREN PORTUGAL may use third parties to provide certain services (located inside or outside the European Union), which may in some situations involve access by such entities to the data subject's personal data.
In such a scenario, VERSPIEREN PORTUGAL undertakes to take the necessary and appropriate measures to ensure that the entities with access to such personal data are reputable and offer high guarantees in this respect, which will be duly enshrined and safeguarded in a written contract between VERSPIEREN PORTUGAL and the third party(ies).
Any entity subcontracted by VERSPIEREN PORTUGAL will process the data subject's personal data on its behalf and under its instructions, undertaking to adopt the technical and organisational measures necessary to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and any other form of unlawful processing.
In any event, VERSPIEREN PORTUGAL remains responsible for the processing of personal data.
Where necessary, and in the context of contracting third parties, VERSPIEREN PORTUGAL may transfer personal data outside the European Union under the terms and conditions permitted by the applicable legislation.
8. Right to be forgotten
Data subjects have the right to obtain from the controller the erasure of their personal data, and the controller is obliged to erase them, whenever one of the following grounds applies: (i) the data are no longer necessary for the purpose for which they were collected or processed; (ii) the data subject withdraws consent, where consent is the legal basis, or objects to the processing and there are no overriding legitimate grounds for keeping them.
9. Changes
VERSPIEREN PORTUGAL reserves the right to adjust or amend this policy at any time; any such changes will be duly communicated to data subjects.
The version communicated here is the one currently in force.