Data Protection Declaration for Services of Zurich Insurance Company Ltd

"Personal data" is data relating to an identified or identifiable person, in other words, the data or cor-responding additional data can be used to make inferences about their identity. "Sensitive data" (also "special categories of personal data") is a category of personal data whose processing may be subject to special requirements. Sensitive personal data may include data from which ethnic origin can be discerned, data relating to health, data concerning religious or philosophical beliefs, biometric data for identification purposes and data concerning trade union membership. In sub-paragraph 3, you will find details of the data that we process within the scope of this Data Protection Declaration. 
"Processing" (also "handling") means any handling of personal data, e.g. obtaining, storing, using, dis-closing and deleting. 

For each data processing operation, there are one or more bodies who bear primary responsibility for ensuring that the data processing complies with the requirements of data protection law. This body is referred to as the "data controller". It is responsible, among other things, for responding to requests for information (sub-para. 10) or for ensuring that personal data is secure and not used in a way that devi-ates from what we tell you or from what is permitted by law. Details of third parties with whom we cooperate and who are responsible for their own processing can be found in sub-paragraph 3 and in sub-paragraph 6.

Master data primarily includes information such as your name, address, email address, telephone number and other contact details, date and   place of birth, age, gender, nationality and hometown, details from identification documents (such as from your passport or ID card), your customer number and other details such as your tax number or tax country.

Information on relationships with third parties who are affected by the data processing is also part of this data, e.g. on beneficial owners of assets, recipients of correspondence and other persons involved in the contract and, if applicable, on family members.

In the case of customers and other contractual partners who are companies, we process data concern-ing our contact persons, this may include name and address, details of titles, position in the company, qualifications and, where applicable, details of supervisors and employees. Depending on the area of activity, we are also required to check the company in question and its employees more closely, for example, by carrying out a security audit. In this case, we collect and process additional data, if neces-sary also from third-party providers. 

We often obtain master data from you, for example in application documents, but we may also obtain data from third parties such as providers of address updates or the commercial register. 

This data includes information about contract conclusion, about contracts, for example, the type and date of contract conclusion, and information from the application process and other information about the contract in question, as well as information from the administration, processing and enforcement of contracts (e.g., information related to invoicing, consulting and customer service as well as pay-ments, reminders, debt collection and enforcement). Contract data also includes information on com-plaints about and adjustments to a contract, as well as information about customer satisfaction, which we may collect, for example, by means of surveys.

Behavioral data is information about certain actions, for example, payments, your use of electronic communications (such as whether and when you opened an email), your use of our websites (such as your location and other information when you use a website of ours; please see the relevant separate data protection policies), your purchases of products and services from us, your interaction with our social media profiles, contacts with intermediaries and your participation in events, competitions, con-tests and similar events.

Preference data tells us, for example, what your likely needs are, what products or services might be of interest to you, or when and how you are likely to respond to messages from us; this helps us to get to know you better, tailor our advice and offers more accurately to you and generally improve our offers. We obtain this information from the analysis of existing data such as behavioral data. In order to improve the quality of our analyses, we may combine this data with other data that we also obtain from third parties, such as address data providers, websites and government offices; this may include information on your household size, income class and purchasing power, shopping behavior, contact details of relatives and anonymous information from statistical offices.

Communication data includes your name and contact details, the manner, place and time of the com-munication and its content, such as details in emails or letters from you or to you or from third parties or to third parties, if the latter also relate to you. We collect communication data, for example, when you contact us via our Customer Service or a Customer Consultant or via a website or app, or chatbot on the internet.

For example, data (such as files or evidence) accrues in connection with official or judicial proceedings, and some of this data may also relate to you. We may also collect data for health protection reasons (for example, in the context of protection concepts). We may obtain or produce photographs, videos and audio recordings in which you may be identifiable (for example, at events, via security cameras etc.). We may also collect data about who enters certain buildings and when (including in the case of access controls, on the basis of registration data or visitor lists, etc.), who participates in events or campaigns (such as contests) and when or who uses our infrastructure and systems.

These areas may include other Zurich Group companies and intermediaries, credit reporting agencies, media monitoring companies, financial service suppliers and banks from which you transfer assets to us or make transfers to us, address data providers, internet analysis services, public authorities, other insurers, parties to proceedings and publicly available sources such as the commercial register, media and sources on the Internet, public registers, media, etc.

We only make certain offers available to you – such as the use of a Zurich online portal or that of one of our partners, or participation in a virtual event – when you provide us with registration data, be-cause we or our contractual partners want to know who is using our services or has accepted an invita-tion to an event, because it is technically necessary or because we want to communicate with you. If you or someone you represent (such as your employer) wish to enter into or perform a contract with us, we need to collect relevant master, contract  and communication data from you, and we process technical data when you use our website or other electronic offers. If you do not provide us with the data required to conclude and perform the contract, you must expect that we will refuse to conclude the contract, that you will be in breach of contract or that we will be unable to perform a contract. Likewise, we can only send you a response to a request you have made if we process the relevant communication data and, if you communicate with us online, technical data as well. Using our website without providing us with technical data is not possible. And when you interact with us or we interact with you, behavioral data is generated.

In particular, we process your personal data for the following purposes, which must be agreed upon:

We process personal data to fulfill legal and regulatory requirements and to comply with laws, directives and recommendations imposed by authorities, as well as internal regula-tions (Compliance).

In the course of contract initiation and contract conclusion, personal data – in particular master data, contract data and communication data – are collected about potential customers for the purposes of consulting and risk assessment (e.g. in an application form and generally via our sales organization). Our sales partners include independent general agencies, intermediaries and brokers. The information received during contract initiation and contract conclusion is reviewed for compliance with legal re-quirements (such as compliance with anti-money laundering and anti-fraud regulations). When initiat-ing and concluding a contract, under certain circumstances we also process particularly sensitive data, such as health data for consultation, risk assessment and premium calculation. 

When processing contractual relationships, we process data for the provision and receipt of services, for the administration of the customer relationship and for customer support (including for the as-sessment and documentation of compensation of sales partners). The enforcement of legal claims stemming from contracts (debt collection, court proceedings, etc.) also forms part of the processing, as do accounting, termination of contracts and public communication.

In order to conclude contracts and process contractual relationships, we involve third parties, such as IT and logistics companies, advertising service suppliers, banks, insurance companies or credit refer-ence agencies, who may in turn provide us with data.

When cooperating with companies and business partners, such as partners in projects or parties in legal disputes, we also process data to initiate and execute contracts, for planning, for accounting pur-poses and other purposes related to the contract.

For these purposes, we process, in particular, master and contract data, but also behavioral and com-munication data. We may also create and process profiles (see sub-paragraph 5) for the above purpos-es and in order to protect you and us from illicit or abusive activities.

We strive to continuously improve our products and services and to be able to react quickly to changing needs. We therefore analyze, for example, which products are used by which groups of people in what way and possible designs for new products and services. This gives us an indication of the acceptance of existing products and services in the market and the market potential of new ones. To this end, we process, in particular, your master data, behavioral data and preference data, as well as communication data and information from customer surveys, polls and studies and other information, such as from the media, from social media, from the Internet and from other public sources. As far as possible, however, we use pseudonymized or anonymized data for these purposes. We may also use media monitoring services or perform media monitoring ourselves, whereby we process personal data in order to carry out media work or to understand and respond to current developments and trends.

For example, we may send you information, advertising and product offers provided by us and third parties in the insurance and other sectors as well as newsletters and other periodic communications, in print or by telephone. Such communications are also made as part of individual marketing campaigns (e.g. events, contests, etc.). We personalize some of these communications in order to provide you with customized information and offers that meet your needs and interests. To do this, we link data that we process about you, determine preference data and use this data as the basis for personalization (see sub-paragraph 3). We may also carry out profiling for marketing purposes (see sub-paragraph 5). We also process data in connection with contests, prize drawings and similar events. Customer care also includes addressing existing customers – in a manner that may be personalized on the basis of behavioral and preference data or data from customer surveys – and organizing customer events (such as sponsoring , sports and cultural events and promotional events). In the case of customer events, we process personal data to carry out the events, as well as to inform the participants and to provide them with information and advertising before, during and after the event.

All of this processing is important to allow us to promote our offers in a way that is most relevant to your needs, to personalize our relationships with customers and other third parties and to use our resources efficiently.

We continuously review and improve the appropriate security of facilities and buildings and our IT. In doing so, we process data, among other reasons, in connection with the surveillance of buildings and publicly accessible premises. Ensuring adequate security is also very important, especially for digitized products. Like all companies, we cannot rule out data breaches with absolute certainty, but we do our best to reduce the risks. We therefore process data, for purposes such as monitoring, control, analysis and testing of our networks and IT infrastructures, to carry out system and error checks, for documentation purposes and in the context of security copies.

These other purposes may include training and educational purposes, administrative purposes (such as the administration of master data, accounting and data archiving or the administration of real estate and the testing, administration and ongoing improvement of IT infrastructure), the protection of our rights (for example, to enforce claims in or out of court and before authorities in Switzerland and abroad or to defend ourselves against claims, for example by preserving evidence, through legal clarifications and by participating in judicial or official proceedings), the evaluation and improvement of internal processes and the general preparation of anonymous statistics and evaluations. In the course of developing our business, we may also sell or acquire businesses, operations or companies to or from other companies or enter into partnerships, which may also result in the exchange and processing of data (including from you, for example, as a customer or supplier or as a supplier representative). This also includes the protection of other legitimate interests, which cannot be named exhaustively.

Profiling is the automated processing of data for analysis and forecasting purposes. The most important examples are profiling to combat money laundering and terrorist financing, to combat misuse, to check creditworthiness, for customer care and for marketing purposes. For the same purposes, we may also create profiles, i.e. we may combine behavioral and preference data, as well as master, contract data and technical data assigned to you, in order to better understand you as a person and your different interests and personal needs. In both cases, we pay attention to the appropriateness and reliability of the results and take measures against misuse of these profiles or profiling.

In each individual case, we will inform you if an automated decision creates negative legal consequences or a comparable significant impairment. In this case, you shall have the rights set out in sub-paragraph 10 if you do not agree with the outcome of the decision.

In addition to master data, this may include information on the period of insurance, the performance and  termination of the contract, information on the assessment and documentation of compensation and information for the marketing of our products, which may include personalized marketing. Contractual partners are required by law and contract to comply with the provisions of the Swiss Data Protection Act.

We may involve third parties to carry out address verification, credit checks and for debt collection purposes, and in the process disclose data to them, such as that concerning outstanding debts and your payment history.

If necessary, we may pass on your data to other companies belonging to the Zurich Group. In order to offer you individualized financial solutions, we may disclose your data – in particular your master data, contract data and registration data as well as behavioral and preference data – to other companies belonging to the Zurich Group for the purpose of offering products and services tailored to your individual needs.

In the context of exercising rights, defending against claims and fulfilling legal requirements, we may disclose personal data to public authorities, agencies, courts and other public bodies, for example in the context of official, judicial and pre- and extra-judicial proceedings and in the context of legal obligations to provide information and to cooperate. Data is also disclosed if we obtain information from public authorities. Public authorities are responsible for processing data about you that they receive from us.

We may disclose data, for example, to individuals involved in proceedings before courts or authorities, as well as potential purchasers of companies, receivables and other assets and, in the case of securitizations, to financing companies and to other third parties, about whom we will inform you separately where possible, for example, in declarations of consent or special data protection policies. Other individuals include, in particular, payment recipients, authorized representatives, correspondent banks, other financial institutions and other bodies involved in a legal transaction.

We procure services from third parties to ensure that we can deliver our products and services securely and cost-effectively and that we can concentrate on our core competencies. These services include, for example, sales via other sales partners (see sub-paragraph 4) IT services, the dispatch of information, marketing, sales, communication or printing services, facility management, security and cleaning, the organization and holding of events and receptions, debt collection, credit agencies, anti-fraud measures and services provided by consulting firms and auditing firms. In each case, we provide service suppliers with the data necessary for their services. One example is hosting service suppliers who store electronic data on our behalf, which may include sensitive data such as health data. Our service suppliers are each subject to contractual and/or statutory confidentiality and data protection obligations. They may use such data for their own purposes in justified, exceptional cases, for example, information on outstanding debts and your payment history in the case of credit agencies or anonymized information for the purpose of improving services.

In many cases, it is also necessary to disclose confidential data in order to process contracts or provide other services. Even non-disclosure agreements generally exclude neither this type of data disclosure, nor disclosure to service suppliers. However, given the sensitivity of the data and other circumstances, we take care to ensure that these third parties handle the data in an appropriate manner.

Many countries outside Switzerland or the EU and EEA currently do not have laws that guarantee an adequate level of data protection from the perspective of the Swiss Federal Act on Data Protection or the GDPR. The contractual arrangements mentioned above may partially compensate for this weaker or missing statutory protection. However, contractual precautions cannot eliminate all risks (with particular regard to state intervention abroad). You should be aware of these residual risks, even though the risk may be low in individual cases and we have taken additional measures (such as pseudonymization or anonymization) to minimize it.

Therefore, the period for which we retain data depends on legal and internal regulations and on the purposes of processing (see sub-paragraph 4), which also include the protection of our interests (for example, to enforce or defend claims, for archiving purposes and to ensure IT security). 
Documentation and evidence purposes include our interests, processes, interactions and other facts in the event of legal claims and other discrepancies, for IT and infrastructure security purposes and to provide evidence of good corporate governance and compliance. Retention may be technically necessary if certain data cannot be separated from other data, and we therefore need to retain it with this other data (such as in the case of backups or document management systems).

Our security measures include measures such as encrypting and pseudonymizing data, logging, access restrictions, storage of backup copies, instructions to our employees, confidentiality agreements, audits, etc. We also require our contracted data processors to take appropriate security measures. In general, however, security risks cannot be completely ruled out; certain residual risks are unavoidable. 

When your data is transmitted via our web pages, we protect it during transport using suitable encryption mechanisms. However, we can only secure areas that are under our control. 
If you contact us by email, you do so at your own risk and agree that we may respond to you at the sender's address via the same channel. If you send us emails via the Internet in unencrypted form, third parties may be able to access, view and manipulate them. 

In particular, we may need to process and store your personal data in order to perform a contract with you, to protect our legitimate interests, such as the assertion, exercise or defense of legal claims, or to comply with legal obligations. To the extent legally permissible, in particular to protect the rights and freedoms of other data subjects and to safeguard sensitive interests, we may therefore also reject a data subject’s request in whole or in part (for example, by blacking out certain content relating to third parties or our trade secrets).