The Controller of personal data is Colonnade Insurance S A operating in Poland through Colonnade Insurance Société Anonyme Branch in Poland (hereinafter: Colonnade or Controller). Colonnade cooperates with Europ Assistance in relation to the claims handling. The purpose of processing personal data is the performance of the insurance contract, which is the legal basis for processing

When personal data is obtained from persons other than the Policyholder, the legal basis for processing of the personal data is the legitimate interest of the Controller, which is the performance of the contract.

The processing of health data is carried out on the basis of and for the purpose of establishing, investigating or defending against claims

Personal data may also be processed in order to comply legal obligations imposed on the Controller, and the necessity of processing such data always arises from the law (concerning: insurance activity, claims handling, tax and accounting issues, statistical and actuarial obligations and consumer protection) and for purposes arising from the legitimate interests of the Controller (i.e. reduction of insurance risks by reinsurance, prevention of losses of the Controller by preventing insurance crime, direct marketing of the Controller’s own products by conducting analytical activities and contacting the data subject, ensuring compliance with international sanctions by conducting analyses, and asserting or defending against claims arising from the Controller’s activities, including taking the necessary steps to secure them).

Personal data may be disclosed to other entities only in connection with the fulfilment of the above-mentioned purposes and on the basis of a written agreement (e.g. to IT service providers, insurance brokers, loss adjusters, debt collectors, marketing agencies) or in connection with purpose of the legitimate interests pursued by the Controller (e g to insurance companies, reinsurers, financial institutions). Depending on the purpose, personal data are always processed for no longer than the period of limitation of claims or the applicable law.

Personal data may be transferred to third countries (outside the European Economic Area) only in situations defined by law, in particular when conditions are met to ensure an adequate level of security of personal data In order to comply with established international sanctions, personal data related to the insurance contract may be transferred to the company DXC Technology, based in the United States, on the basis of standard data protection clauses adopted by the European Commission, which means that appropriate measures for the protection and security of personal data required by European legislation are ensured.

The data subject has the right to request access to personal data, the right to rectify, erase or restrict processing, the right to object to processing, the right to data portability and the right to lodge a complaint to the supervisory authority in charge of personal data protection (both in Poland and in Luxembourg), as well as the right to withdraw the consent. The provision of personal data is necessary for the conclusion and performance of the contract and the fulfilment of Colonnade’s legal obligations Without providing personal data it is not possible to conclude a contract (unless consents are optional).

The Controller can be contacted by writing to the Colonnade branch address, by calling +48 22 528 51 00 and by sending an e-mail: info@colonnade.pl In all matters concerning the processing of personal data, in particular exercising rights related to data processing, right to object or transfer of data outside the EEA area, you can contact the Data Protection Officer at Colonnade (dpo@colonnade.pl) or by sending a letter to the address of Colonnade