InsurProtect protects the data entrusted to it in connection with its insurance brokerage activities.
This policy covers website visitors, prospects, customers, affiliated employees, beneficiaries, insured individuals, and individuals involved in an insuranceclaim.
‍‍

1. Purpose of This Policy
‍
This policy transparently explains how InsurProtect collects, uses, discloses, protects, and retains personal data in connection with its insurance brokerage activities, its website, its customer portal, its communications, and the use of certain digital tools.It is intended to provide the information required by the General Data Protection Regulation (“GDPR”) and applicable Belgian law. It does not alter the contractual terms and conditions applicable to the products and services provided by InsurProtect.
‍‍

2. Data Controller and Contact

, InsurProtect SRL
‍40-42 AvenueHerrmann-Debroux
1160 Brussels
Belgium
Company Number: BE 0756.804.490
Phone: 02 899 25 53
contact@insurprotect.be

InsurProtect is registered with the Financial Services and Markets Authority (FSMA) as an insurance broker. InsurProtect has not appointed a Data Protection Officer within the meaning of Articles 37 through 39 of the GDPR. The coordination of data protection matters is handled internally by its CEO. Any inquiries may be sent to contact@insurprotect.be.
‍

3. Individuals Covered
‍
This policy applies in particular to:
‍
- customers and prospects;
- insured individuals, policyholders, and beneficiaries;
- executives, representatives, and contact persons of corporate clients;
- employees covered by group insurance, hospitalization insurance, or other group coverage;
- Individuals involved in an accident, an incident, or a claim;
- Website visitors and users of the MyBroker customer portal;
- Suppliers, partners, and professional advisors;
- Individuals who contact us or participate in our events.
‍

4. Catégories de données traitées
‍
Les données traitées varient selon la relation avec InsurProtect et le produit ou service concerné.
‍
4.1 Données d’identification et de contact
‍
- nom, prénom, adresse, e-mail et numéros de téléphone;
- date et lieu de naissance, langue, nationalité, sexe ou situation familiale lorsque ces éléments sont pertinents;
- liens avec le preneur d’assurance, l’assuré ou le bénéficiaire;
- coordonnées des représentants légaux ou mandataires.
‍
4.2 Données d’identification officielles
‍
- numéro de registre national ou autre identifiant lorsque son traitement est nécessaire et légalement autorisé;
- données figurant sur une carte d’identité ou un permis de conduire;
- numéro d’entreprise et données nécessaires au respect des obligations d’identification et de lutte contre le blanchiment.

4.3 Données professionnelles et sociales
‍
- employeur, fonction, catégorie de personnel et statut social;
- dates d’entrée et de sortie, temps de travail, interruptions ou suspensions;
- rémunération et autres éléments nécessaires au calcul des garanties;
- données d’affiliation à une assurance collective.

4.4 Données financières, patrimoniales et fiscales
‍
- numéro de compte bancaire, primes et paiements;
- revenus, rémunérations et situation financière ou patrimoniale;
- éléments nécessaires à l’analyse des besoins en assurance, pension, épargne ou investissement;
- données comptables et fiscales nécessaires à la gestion des contrats et au respect des obligations légales.

4.5 Données assurantielles et contractuelles
‍
- besoins, exigences et objectifs du client;
- demandes d’offre, devis, propositions, contrats et numéros de police
- garanties, capitaux assurés, franchises, bénéficiaires, primes et modalités de paiement;
- risques à assurer, antécédents d’assurance et documents relatifs au conseil;
- données relatives aux pensions complémentaires et aux engagements collectifs.

‍4.6 Données relatives aux sinistres

- circonstances d’un accident ou d’un sinistre;
- déclarations, constats, dommages, responsabilités et rapports d’expertise;
- échanges avec les assureurs, experts, avocats, médecins-conseils ou autres intervenants;
- indemnisations antérieures ou en cours et pièces justificatives.

‍4.7 Données relatives à la santé et autres données sensibles
‍
‍Dans le cadre de ses activités de courtage, quel que soit le type d’assurance concerné, InsurProtect peut être amenée à traiter des données relatives à la santé lorsque celles-ci sont nécessaires à l’analyse d’un risque, à la souscription ou à la gestion d’un contrat, ainsi qu’au traitement d’un accident, d’un dommage corporel, d’un sinistre, d’une demande d’intervention, de prestation ou d’indemnisation.

Ces données ne sont traitées que dans la mesure nécessaire à la gestion du dossier concerné et lorsqu’une base juridique ainsi qu’une condition autorisant le traitement des données de santé sont applicables conformément au RGPD. Selon les circonstances, le traitement peut notamment reposer sur le consentement explicite de la personne concernée, sur la nécessité de constater, d’exercer ou de défendre un droit, ou sur toute autre condition autorisée par la législation applicable.

InsurProtect applique à ces données des mesures particulières de confidentialité, de sécurité, de minimisation et de limitation des accès. Lorsque cela est approprié, les informations médicales destinées à l’appréciation médicale du risque ou d’une prestation sont transmises directement au médecin-conseil ou au service médical de l’assureur.
InsurProtect peut également traiter des données relatives à des infractions ou à des condamnations pénales lorsque ce traitement est autorisé par la législation applicable et nécessaire à la gestion du dossier concerné.

4.8 Communications et données techniques
‍
- contenu des e-mails, courriers, formulaires et autres communications;
- informations échangées lors de rendez-vous ou réunions;
- données de connexion, journaux techniques et informations nécessaires à la sécurité des systèmes.
‍

5. Source of Data
‍
Depending on the services involved, we obtain your data:

- directly from you; from the policyholder or your employer;
- from a social security office;
- from insurance companies and pension funds with which we collaborate;
- from individuals or professionals involved in the management of a policy or a claim;
- from a business partner, government agency, or publicly available source, when such collection is authorized.

When you provide InsurProtect with personal data relating to another person, you must, to the extent that it is your responsibility, inform that person of this disclosure and refer them to this policy.In the context of group insurance, InsurProtect may receive personal data relating to policyholders as part of the performance of a contract entered into with their employer or the policyholder.When providing InsurProtect with data regarding policyholders, the employer or policyholder must inform the individuals concerned of this disclosure and direct them to this privacy policy. This policy describes the data processing activities carried out by InsurProtect in the course of its own operations and is available on its website:
‍

6. Purposes and Legal Bases
‍
InsurProtect processes data only for specific purposes and on an appropriate legal basis.
‍

‍Whenwe base processing on a legitimate interest, this may include, among other things, ensuring the efficient and secure management of records, providing high-quality support, preventing fraud and abuse, defending the rights of the individuals or organizations concerned, improving our services, and reasonably expanding our business. Depending on the processing in question, the legitimate interests pursued may be those of InsurProtect, its clients, employers, policyholders, beneficiaries, or insurance companies—in particular to ensure the proper management of coverage, enrollment, claims, and requests for assistance.Before relying on this legal basis, we ensure that the interests pursued do not override the fundamental rights and freedoms of the data subjects. InsurProtect processes data only for specific purposes and on an appropriate legal basis.
‍

6.1 Mandatory or Optional Nature of Data

‍Certainpersonal data is necessary to enable InsurProtect:

- to respond to a request for information or to prepare a quote;
- to provide appropriate advice to its clients;
- to enter into, manage, or perform an insurance contract;
- to manage enrollment, changes, termination, benefits, or claims;
- to comply with its legal, regulatory, and professional obligations.

When the requested data is necessary to fulfill these purposes, providing it is mandatory. If the necessary information is not received, InsurProtect may not be able to provide the requested service, prepare a quote, offer appropriate coverage, properly manage the case, or comply with its legal obligations. However, some information may be optional. In such cases, failure to provide this data does not necessarily prevent the provision of the requested service, but may limit its personalization or effectiveness. Whether information is mandatory or optional may also be specified at the time of collection. You may object at any time to the processing of your data for direct marketing purposes, without having to justify your decision.
‍

7. Artificial Intelligence and Automated Processing

‍InsurProtectmay use professional generative artificial intelligence tools to assist its employees with certain tasks involving drafting, summarizing, translating, classifying, and researching and analyzing documents or regulatory information.

In connection with these uses, certain personal data may be processed when necessary for the task at hand. InsurProtect ensures that the data shared is limited to what is necessary and, whenever possible, deletes, anonymizes, or pseudonymizes identifying information.

These systems are support tools. Their results may be inaccurate or incomplete and are subject to appropriate human review prior to use when they are likely to affect an individual.

InsurProtect does not make any decisions based exclusively on an artificial intelligence system, profiling, or other automated processing that would produce legal effects concerning an individual or similarly and significantly affect them. However, automated rules or tools may perform administrative checks, detect missing data, generate tasks, prepare documents, or flag anomalies. Important decisions remain made or reviewed by a qualified individual.

The tools in question are evaluated, in particular, with regard to their contractual terms, security measures, retention periods, and terms of use.
‍

8. Recording or Transcription of Communications
‍
Certain calls, appointments, or meetings may be recorded or transcribed to facilitate the preparation of a report, ensure follow-up on a request, or document the information shared. This is done only after participants have been informed in advance and with their consent, when required.Recordings and transcripts are accessible only to those who need them and are retained for as long as necessary to fulfill the stated purpose.
‍

9. Access and Recipients
‍
Access to data is limited to executives, employees, and contractors who need it to perform their duties. These individuals are bound by a confidentiality obligation.

When necessary, data may be disclosed:

- to insurance companies and pension funds;
- to employers, group insurance policyholders, and social security offices, within the limits of their rights;
- to the beneficiaries and insured individuals concerned;
- to experts, medical consultants, claims adjusters, repairers, and other parties necessary to the case;
- to attorneys, bailiffs, mediators, and other professionals responsible for defending rights;
- to judicial, administrative, tax, or supervisory authorities, including the FSMA;
- to banks and payment service providers;
- to accountants, auditors, and other professional advisors;
- to IT, hosting, maintenance, communications, and cybersecurity service providers;
- to providers of management software, customer portals, and artificial intelligence tools;
- to parties involved in a merger, acquisition, reorganization, or portfolio transfer, subject to appropriate safeguards.

Insurance companies, pension funds, and other recipients may process the data they receive as separate data controllers, in accordance with their own data protection obligations and policies. The data is not sold to third parties.
‍

10. Service Providers and Subcontractors
‍
InsurProtect uses service providers in the following areas, among others:

- messaging, communication, and office software;
- brokerage management software;
- customer portal and secure document sharing;
- website hosting and IT infrastructure;
- professional artificial intelligence tools;
- storage, backup, IT or hardware maintenance, and cybersecurity;
- accounting, auditing, and other professional consulting services.

When these service providers act on behalf of InsurProtect, they are subject to the requirements applicable to subcontractors, particularly regarding confidentiality, security, authorized purposes, assistance, further subcontracting, and the deletion or return of data. A service provider responsible solely for hardware maintenance may access data only if such access is strictly necessary for their work and subject to a confidentiality obligation.
‍

11. Transfers Outside the European Economic Area
‍
Some service providers may be located outside theEuropean Economic Areaor allow access from a third country. When a transfer is made, InsurProtect ensures that it is based on a mechanism authorized by the GDPR, such as an adequacy decision, standard contractual clauses, binding corporate rules, or another recognized safeguard.
Additional contractual, technical, or organizational measures are implemented when necessary. You may contact us for information regarding the safeguards applicable to a specific transfer.
‍

12. Security and Data Breaches

InsurProtect implements appropriate technical and organizational measures to protect data against destruction, loss, alteration, disclosure, unauthorized access, and any other form of unlawful processing.

- access rights management and authentication;
- securing workstations, networks, and systems;
- backups and business continuity measures;
- software updates and incident monitoring;
- internal confidentiality policies and employee awareness training.

Data breaches are documented. When a breach is likely to pose a risk to individuals’ rights and freedoms, it is reported to the Data Protection Authority in accordance with the provisions of the GDPR. Data subjects are also notified when the risk is high, unless otherwise provided by law.
‍

13. Retention Period

Data is retained for as long as necessary to fulfill the purposes for which it was collected.

Data processed in connection with a contractual relationship is retained for the entire duration of that relationship, followed by the statutory limitation periods and the timeframes required by insurance, prudential, accounting, tax, and anti-money laundering laws, as well as for the period necessary to establish, exercise, or defend legal rights.

Prospecting data is retained for a period commensurate with the business relationship. Data used for direct marketing is retained until consent is withdrawn or the right to object is exercised. A minimum amount of information may be retained to ensure long-term compliance with an unsubscribe or objection request.

Recordings, transcripts, technical data, and security logs are retained only for a period commensurate with their purpose.

When deleted from active systems, certain data may remain temporarily in secure backups until they are replaced or expire according to the normal backup cycle. They are then reused only if restoration is necessary.
‍

14. Website and Contact Form

The InsurProtect website is hosted by a professional service provider. When you use the contact form, the data you provide is processed to respond to your request, contact you, and, if applicable, prepare for a pre-contractual or contractual relationship.

The website currently does not use Google Analytics, reCAPTCHA, or advertising, analytics, or profiling cookies. However, technical data strictly necessary for the website’s operation, security, and hosting may be temporarily stored by the systems and servers used.

If optional cookies or new tracking technologies are added, this policy and the consent mechanism will be updated accordingly.
‍

15. MyBroker Customer Portal

InsurProtect provides a MyBroker customer portallinked to Brio and Portima. This portal allows users to view certain information and documents related to their policies. The data necessary for creating, managing, securing, and supporting access is processed to perform the agreed-upon services and prevent unauthorized access. Use of MyBroker may be subject to additional terms and conditions provided by Portima.
‍

16. Social Media and Marketing Communications
‍
InsurProtect may be present on social media platforms, including LinkedIn. When you follow a page, interact with a post, or send us a message, we may process your name or username, your profile picture, public information, the content of the interaction, attachments, as well as metadata and statistics provided by the platform.

This data is used to communicate, respond to inquiries, promote our activities, and evaluate the reach of our posts. The processing is based on our legitimate interest and, where required, on your consent.

The platforms also process the data for their own purposes. InsurProtect does not currently use embedded LinkedIn lead generation forms.
‍

17. Your Rights
‍
Subject to the conditions and limitations set forth by law, you have the following rights:

- the right to access your data and information regarding its processing;
- the right to have inaccurate or incomplete data corrected;
- the right to erasure in the cases provided for by the GDPR;
- the right to restrict processing;
- right to object to processing based on legitimate interests;
- right to object, at any time and without justification, to direct marketing;
- right to data portability when the legal conditions are met;
- right to withdraw your consent at any time when processing is based on consent;
- right not to be subject to certain decisions based solely on automated processing.

Deletion is not absolute: certain data may be retained when necessary to comply with a legal obligation, to fulfill a contract, or to defend legal rights.
right to withdraw your consent at any time when processing is based on consent; right not to be subject to certain decisions based solely on automated processing.Deletion is not absolute: certain data may be retained when necessary to comply with a legal obligation, to fulfill a contract, or to defend legal rights. ‍

18. Exercising Your Rights
‍
InsurProtect SRL
‍40-42 AvenueHerrmann-Debroux
1160 Brussels
contact@insurprotect.be02899 25 53

Please specify your identity, the right you are exercising, and the data or processing operations concerned. If there is reasonable doubt regarding your identity, we may request additional information strictly necessary to verify it. A copy of an identification document will only be requested if this measure is necessary and proportionate. Unnecessary information may be redacted. We generally respond within one month. This period may be extended by two months if the request is complex or if there is a high volume of requests. Exercising your rights is generally free of charge, except in cases where the request is manifestly unfounded or excessive.
‍

19. Complaints

You have the right to file a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels. However, we encourage you to contact us first so that we can review your request and work toward a solution.
‍

20. Changes to the Policy

InsurProtect may amend this policy to reflect changes in its business operations, tools, legislation, or recommendations from regulatory authorities. The most recent version is published on the website along with its update date. In the event of a material change that could have a significant impact on the individuals concerned, InsurProtect may also notify them through an appropriate means of communication.