Source: https://www.prismalife.com/en/data_protection/
Timestamp: 2020-02-22 09:57:08
Document Index: 782094907

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 9', 'Art. 15', 'Art. 16', 'Art. 17', 'Art. 18', 'Art. 20', 'Art. 7', 'Art. 21', 'Art. 77', 'Art. 22', 'Art. 21', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 22', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 9', 'Art. 7', 'Art. 7', 'Art. 6', 'Art. 6', 'Art. 28', 'Art. 14', 'Art. 22', 'Art. 6', 'Art. 28', 'Art. 17', 'Art. 15', 'Art. 16', 'Art. 17', 'Art. 18', 'Art. 20', 'Art. 7', 'Art. 21', 'Art. 77', 'Art. 22', 'Art. 6', 'Art. 7', 'Art. 7', 'Art. 15', 'Art. 16', 'Art. 17', 'Art. 18', 'Art. 20', 'Art. 7', 'Art. 21', 'Art. 77', 'Art. 6', 'Art. 7']

Data protection › PrismaLife
Data protectionStefan Galbavi2019-06-13T11:36:01+02:00
Data protection at PrismaLife
The EU General Data Protection Regulation (GDPR), which entered into force on 25 May 2018, is a European Union regulation harmon­ising the rules across the EU for private companies and public bodies processing personal data. This is intended firstly to ensure the protection of personal data within the European Union as a whole and secondly to ensure the free movement of data within the European Union.
The new rules of the EU General Data Protection Regulation partic­u­larly provide for a high level of trans­parency in data processing and for extensive rights for data subjects.
We regard the protection of personal data and other privacy as a primary task of our work in order to ensure your trust and to put you at the centre of what we do. For this reason, we began early to adapt our business proce­dures, processes and systems to the new statutory require­ments of the EU General Data Protection Regulation in line with the law.
Our data protection organ­i­sation is designed so that the use of your data is in line with all statutory require­ments on data protection and particular attention is given to the principles of trans­parency, necessity of the data processed, data avoidance and data economy in accor­dance with the EU General Data Protection Regulation. More infor­mation regarding the handling of your personal data is available in the following infor­mation.
Privacy policy on the handling of your data when you contact us
1. Who is respon­sible for the data processing and who can I contact?
PrismaLife AG is respon­sible for the data processing.
Indus­tri­ering 40
Fürstentum Liecht­en­stein
Phone: +423 237 00 00 or 0800 237 0500* (*free of charge from German landlines and the German mobile network)
Email adress: kundenservice@​prismalife.​com
For data protection matters, please contact our data protection officer at the above address or by email on: datenschutz@​prismalife.​com
2. How does the individual commu­ni­cation with you take place?
Our website includes infor­mation that enables you to quickly contact our company and enables direct electronic commu­ni­cation with us.
2.1 myPris­maLife customer portal
On this website we offer an access-protected customer portal, myPris­maLife, with which you can view and manage your policies online.
After logging in to our customer portal, you can, for example:
view your data that is stored with us
make specific changes, e.g. notifi­cation of moving home, change of address or bank account
send us other messages and notifi­ca­tions
receive messages from us
When personal data is provided and is processed in the myPris­maLife customer portal, we assure you that without further consent we only use this infor­mation for the purpose for which it was given to us. The trans­mission of the data to the customer portal is encrypted. More infor­mation on processing of your personal data in the customer portal is available in the “Data protection” section in myPris­maLife.
2.2 Contact form/call-back service
2.2.1 Contact form
If you have questions of any kind, we offer you the option of contacting us via the contact forms provided on the website. If you contact us via these forms, we will store and process the personal data you provide in each case ourselves in order to process your query or forward it to the broker selected by or respon­sible for you in order to enable you to commu­nicate with the broker personally.
The following data marked by * is mandatory and is necessary for processing your query. The other data is optional:
Speci­fi­cation of whether you are already insured with PrismaLife AG (customer contact form)
Speci­fi­cation of whether you are already a sales partner of PrismaLife AG (partner contact form)
Providing the data for the fields marked as mandatory is necessary to be able to process your query. The optional data enables us to immedi­ately attribute the query to a policy and helps us to provide you with the best possible response to your query.
Note on the legal basis:
Depending on the message content, your message data is processed by us and also subse­quently by the broker on the following legal basis:
If your query is about infor­mation in advance of entering into a policy or about topics relating to an existing policy, the legal basis for processing your data is generally Art. 6 (1) b) GDPR (initi­ation or perfor­mance of a contract).
Otherwise the legal basis for processing your data is Art. 6 (1) f) GDPR (legit­imate interest). In this respect, the processing serves our business interest and the business interest of the broker of inter­acting with current, potential and former policy­holders and also serves your own interest of receiving an answer to your query.
Note on the transfer of special categories of personal data:
If you send us special categories of personal data (partic­u­larly health data) via the contact form, the processing is carried out by us and the broker in this respect on the basis of your consent (Art. 6 (1) a) GDPR in conjunction with Art. 9 (1) and (2) a) GDPR). The provision of this consent is voluntary. Please note, however, that we cannot accept your query without appro­priate consent. If you already have access to the myPris­maLife customer portal, please send your special categories of personal data to us via the portal.
Note on the retention period:
You will find the retention period for your personal data and your message that you send us as a customer in the privacy policy for insurance policies.
You will find the retention period for your personal data and your message that you send us as a broker in the privacy policy for brokers.
For inter­ested parties who do not currently have a contractual or business relationship with us, the personal data and your message are only stored to the extent that this is necessary for further electronic processing. We delete the queries if they are no longer needed. We check if they are needed every two years. Furthermore, the statutory archiving duties apply.
2.2.2 Call-back service
We offer a call-back service for questions of any kind. If you contact us via these forms, we will store and process the personal data you provide in each case ourselves in order to process your query or, if applicable, forward it to the broker selected by or respon­sible for you in order to enable you to commu­nicate with the broker personally.
Date for a call back*
The legal bases for processing your data and infor­mation on the retention period can be found under “2.2.1 Contact form”.
2.3 Emails
Alter­na­tively, it is possible to contact us via our contact email address. If you contact us, we will store and process the personal data you provide in each case ourselves (usually your first name and surname, job title and current address, email address and phone number, the subject of the message, any insurance number and the content of the message) in order to process your query or forward it to the broker selected by or respon­sible for you in order to enable you to commu­nicate with the broker personally.
2.4 Contact by phone
If you contact us by phone, your data will be recorded, stored and processed by the person respon­sible for answering your query. Where applicable, your data necessary for answering your query will be forwarded to one of our brokers in order to enable direct commu­ni­cation with you. Your data is not forwarded to third parties without your consent.
3. Transfer of data to a third country
If you have a contractual or business relationship with us, we transfer your personal data to recip­ients outside of the European Economic Area (EEA) that have their headquarters in Switzerland. The transfer only takes place if the European Commission has confirmed an appro­priate level of data protection for the third country or other appro­priate data protection guarantees (e.g. EU standard contractual clauses) exist. The European Commission has confirmed an appro­priate level of data protection for Switzerland. Detailed infor­mation on this is available here in the Commission Decision: https://​publi​ca​tions​.europa​.eu/​e​n​/​p​u​b​l​i​c​a​t​i​o​n​-​d​e​t​a​i​l​/​-​/​p​u​b​l​i​c​a​t​i​o​n​/​e​e​7​6f93d-4545 – 4878-87cb-7750d7f59987/language-de. You can also request confir­mation using the afore­men­tioned contact details.
According to the General Data Protection Regulation, as a data subject you have a right of access pursuant to Art. 15 GDPR, the right to recti­fi­cation pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR and the right to data porta­bility from Art. 20 GDPR. Furthermore, there is a right to withdraw consent pursuant to Art. 7 (3) GDPR and a right to object pursuant to Art. 21 GDPR. If you make use of your afore­men­tioned rights, we check whether the statutory require­ments for this are met. In addition, there is a right to lodge a complaint with a super­visory authority (Art. 77 GDPR).
The data protection super­visory authority respon­sible for us is:
Daten­schutzstelle Liecht­en­stein
You can exercise all rights by sending an email to datenschutz@​prismalife.​com, by contacting us by post or via the contact form on our website or via the myPris­maLife customer portal or the broker portal.
So that our reply can actually be addressed to you as the data subject, you need to identify yourself or contribute to the identi­fi­cation of your person.
5. Do I have a duty to provide personal data?
For your query to be answered by email, by telephone or via our contact form or call-back service, you only need to provide the personal data necessary for answering your query.
As a customer, in the context of a contractual or business relationship you only need to provide the personal data that is necessary for the estab­lishment, conducting and termi­nation of a contractual or business relationship, or that we are legally required to collect. Without this data, we will generally have to refuse to conclude the policy or execute the order or will no longer be able to execute an existing policy and may have to terminate it.
6. To what extent is there automated individual decision-making?
In principle, we do not use fully automated decision-making pursuant to Art. 22 GDPR to establish or conduct a contractual or business relationship. If we use this process in future in individual cases, we will inform you of this separately if this is required by law.
For reasons of security and to protect the transfer of confi­dential content, e.g. queries via the contact form that you as a user send to us as the website operator, this website uses SSL encryption. An encrypted connection can be identified by the fact that the address line of the browser switches from “http://” to “https://” and there is a lock symbol in the browser line.
Infor­mation on your right to object pursuant to Art. 21 of the General Data Protection Regulation (GDPR)
You have the right to object at any time on grounds relating to your particular situation to the processing of personal data concerning you that is based on point e) of Art. 6 (1) GDPR (data processing in the public interest) and point f) of Art. 6 (1) GDPR (data processing on the basis of balancing of interests).
If you file an objection, we will no longer process your personal data unless we can demon­strate compelling legit­imate grounds for the processing which override your interests, rights and freedoms or for the estab­lishment, exercise or defence of legal claims.
2. Right to object to processing of data for direct marketing purposes
We process your personal data for direct marketing purposes in individual cases. You have the right to object to the processing of personal data concerning you for the purposes of such marketing at any time.
The objection can be made without any require­ments as to its form and should be addressed to:
If you have any questions on this privacy policy, please do not hesitate to contact PrismaLife AG using the above contact details.
This “Privacy policy on the handling of your data when you contact us” may be updated at a later date due to changes, e.g. to the statutory provi­sions. You can obtain the latest version of this privacy policy and the service provider list on PrismaLife AG’s website on www​.prismalife​.com/​d​a​t​a​_​p​rotection/.
Privacy policy for visiting our website
Phone: +423 237 00 00 or 0800 237 0500* (*free of charge from German landlines and the German mobile phone network)
2. The website’s basic features
Funda­men­tally, you do not need to log in or identify yourself to use our website. In the context of the use of the website, however, we need to process your IP address to enable the function­ality of the website, partic­u­larly to be able to transmit the pages you have requested to you. We do not create personal user profiles.
The processing usually takes place on the basis of our legit­imate interests pursuant to Art. 6 (1) f) GDPR. Our legit­imate interest is to operate a website for general infor­mation and commu­ni­cation purposes and for the presen­tation of our company.
If you visit our website in order to initiate an insurance policy with us (e.g. to read about policy condi­tions) or in order to manage or terminate an existing policy, notwith­standing the above, the legal basis for processing your data is Art. 6 (1) b) GDPR (initi­ation or perfor­mance of a contract).
3. Recording of page views
When you view our website www​.prismalife​.com, the browser you use on your device automat­i­cally sends infor­mation to our website’s server. This infor­mation is temporarily stored in a log file. The following infor­mation is recorded without you doing anything and is stored until automatic erasure:
We process the afore­men­tioned data for the following purposes:
ensuring smooth setup of connection to the website
evalu­ation of system security and stability and
for other admin­is­trative purposes
The legal basis for the data processing is Art. 6 (1) sentence 1 f) GDPR. Our legit­imate interests results from the data collection purposes listed above. Under no circum­stances do we use the data collected for the purpose of drawing conclu­sions about you.
The retention period for the viewing history is a maximum of 24 months.
Cookies are generally used for the optimi­sation of special offerings. Cookies are small text files that are processed in the cache of your Internet browser (e.g. Internet Explorer or Firefox) if you visit our website and are used for the recog­nition of the Internet browser. They help to establish our customer website’s frequency of use and number of users. PrismaLife AG currently uses cookies of this kind. For more infor­mation see: www​.prismalife​.com/​e​n​/​c​ookies-en/
Our website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics also uses cookies. The infor­mation generated by the Google Analytics cookies about your use of this website is usually trans­mitted to a Google server in the USA and stored there.
More infor­mation on the handling of user data by Google Analytics is available in Google’s privacy policy on:
As a result of activating IP anonymi­sation on this website, your IP address will, however, first be shortened by Google within Member States of the European Union or in other states that are parties to the Agreement on the European Economic Area. Only in excep­tional cases will the full IP address be sent to a Google server in the United States and shortened there. On behalf of the operator of this website, Google will use this infor­mation to assess your use of the website, compile reports about website activ­ities and provide additional services associated with website and internet usage to the website operator. The IP address that is trans­mitted by your browser for the purposes of Google Analytics will not be associated with other Google data.
You can prevent cookies from being stored by selecting the appro­priate setting on your browser software. However, please note that if you do this, you may not be able to use the full function­ality of this website. You can also prevent Google from recording and processing the data that is generated by the cookie relating to your use of the website (including your IP address) by downloading and installing the browser plug-in available through the following link: www​.tools​.google​.com/​d​l​p​a​g​e​/​g​a​o​p​tout?hl=de
This website uses the Analytics functions for remar­keting, impression reports in the Google Display Network, integration of DoubleClick Campaign Manager and Google Analytics reports on perfor­mance by demographics and interests. You can deactivate Google Analytics for display adver­tising and person­alise the ads on the Google Display Network by visiting the ad settings on this link: www​.google​.de/​s​e​ttings/ads
This website uses the Analytics User ID features to be able to track inter­action data. This user ID will be additionally anonymized and encrypted and will not be linked with other data.
The legal basis for the data processing is Art. 6 (1) f) GDPR. Our legit­imate interest is in the oppor­tunity to analyse usage and the associated improvement of the website.
The retention period is 38 months.
We have involved Google as a processor in compliance with data protection require­ments.
We only use the “Google Maps” map service to show our location in the context of our contact forms. No personal data is collected from you because the location function is not activated, i.e. neither your IP address nor other data from you is processed.
Our services on our website are not designed for people under the age of 18 (“minors”). We do not inten­tionally collect data from minors or ask minors to provide data. We do not knowingly permit minors to use our services. If you are a minor, please do not use our services and please do not give us your data. If we discover that data from a minor has been collected without evidence of consent by his or her parent or guardian, we erase this data. If you think that we may have received data from a minor or that we have data from a minor, please contact us on datenschutz@​prismalife.​com.
With the exception of section 5.1, we do not transfer your personal data to any recipient outside of the European Economic Area (EEA).
9. Do I have a duty to provide personal data?
You do not need to actively provide any personal data of yours in order to visit our website.
10. To what extent is there automated individual decision-making?
We do not use any fully automated decision-making pursuant to Art. 22 GDPR when you visit our website.
This “Privacy policy for visiting our website” may be updated at a later date due to changes, e.g. to the statutory provi­sions. You can obtain the latest version of this privacy policy and the service provider list on PrismaLife AG’s website on www​.prismalife​.com/​d​a​t​a​_​p​rotection/.
Privacy policy for insurance policies
How we handle your data and rights
In the following we would like to inform you about how PrismaLife AG processes your personal data and about the rights you have pursuant to data protection regula­tions under the rules of the EU General Data Protection Regulation (GDPR), which apply from 25 May 2018.
What data is processed specif­i­cally and in what way it is used depends largely on the insurance product applied for or agreed.
PrismaLife AG, the company you have applied for an insurance product from, is respon­sible for the data processing.
2. What personal data do we use and where does it come from?
We process personal data that we have received from you as part of our business relationship. In addition – to the extent necessary for providing our services – we processper­sonal data that we have received or will receive in the future from third parties (e.g. from cooper­ation partners or credit reference agencies) in a permis­sible way (e.g. for the execution of orders, for the perfor­mance of contracts or on the basis of consent granted by you).
Secondly, we process personal data that we have permis­sibly obtained from publicly acces­sible sources (e.g. debtor lists, commercial registers and registers of associ­a­tions, the press, media) and that we are allowed to process.
We collect personal data without the involvement of the data subject if direct collection would be unrea­sonable or dispro­por­tionate, or we have received the data from the appli­cation documents from you as the policy­holder. If we also receive other people’s data in addition to your personal data, as our policy­holder, you must inform the data subjects of the data processing because we as an insurance company are subject to business secrecy and thus without your consent as the policy­holder are not allowed to give infor­mation to further data subjects. This may, for example, be an additional insured person, a benefi­ciary, a person other than you who pays premiums or any other beneficial owner or person with power of repre­sen­tation.
Relevant personal data includes personal details (name, address and other contact details, date and place of birth and nation­ality), proof of identity data (e.g. identity card data), tax identi­fi­cation numbers and authen­ti­cation data (e.g. specimen signature). In addition we process special categories of personal data (e.g. your health data). Furthermore, this can also include order data (e.g. payment order), data from the fulfilment of our contractual oblig­ation, infor­mation about your financial situation (e.g. credit­wor­thiness data, scoring/rating data), debt collection data, register data, data on your use of the telemedia we offer (e.g.time of accessing our website or apps, pages visited), personal data that you exchange with us in our electronic customer portal and other data compa­rable to the categories mentioned. In addition, under­writing data is stored for the policy, such as customer number, insured sum, term of the insurance, premium, and if necessary a third party’s infor­mation, e.g. a broker’s, an expert’s or a doctor’s infor­mation (contractual data). In the event of an insured event, we store your data on the claim and, if applicable, also data from third parties or upon expiry of a life insurance policy, the amount paid out (benefit data).
In the event of submission of an electronic signature in your appli­cation or other documents during our contractual relationship, we record biometric data (writing speed, writing direction, writing pauses and, if applicable, pressure) and store and use this data to establish, execute or terminate this insurance policy and to realise PrismaL­ife’s customer portal myPris­maLife. For the purpose of evidence in any dispute on the genuineness of your signature, we store this data with a notary who is legally bound to confi­den­tiality, for the purpose of the estab­lishment, exercise and defence of legal claims.
3. Why are we processing your data (purpose of the processing) and what is the legal basis for this?
We process your personal data in compliance with the General Data Protection Regulation (GDPR), the Liecht­en­stein Data Protection Act (DSG), the provi­sions of the German Insurance Contract Act (VVG) relevant to data protection and all other applicable laws.
The data, on the basis of the grounds of autho­ri­sation under the GDPR, is primarily processed to perform the contract, to safeguard our legit­imate interests, on the basis of your consent and/or to fulfil legal oblig­a­tions.
The conclusion, management and execution and fulfilment of the insurance policy are not possible without processing your personal data. If you do not provide us with this data or do not do so in full, then we might not be able to establish the insurance relationship requested by you or might not be able to assess or satisfy claims arising from an insurance policy.
Irrespective of the legal bases described above, we need your release from confi­den­tiality to be allowed to pass on your protected infor­mation, e.g. the fact that there is a policy with you, to other parties (e.g. your broker, service providers for IT, logistics, printing, telecom­mu­ni­ca­tions, debt collection and address verifi­cation or to our reinsurer). The release decla­ration is indis­pensable for the appli­cation review and for the estab­lishment, execution or termi­nation of your insurance policy with us. If you do not provide this, the conclusion and execution of the policy will generally not be possible. The decla­ration concerns the processing of your protected data by the recip­ients specified under section 4.
The legal bases and the associated processing purposes of the processing of your personal data are described below.
a) In order to satisfy pre-contractual and contractual oblig­a­tions (Art. 6 (1) b) GDPR)
The processing of your personal data is necessary in the context of the appli­cation for insurance cover. The processing is carried out in order to assess the risk to be assumed. If the insurance policy is entered into, we process this data to conduct the contractual relationship, e.g. for drawing up the insurance certificate or invoicing, for the execution of your orders and all activ­ities necessary with the operation and management of an insurance company. We need infor­mation on the claim, for example to be able to check to determine the existence of insurance cover and the existence of an insured event as well as its loss amount.
b) As part of the balancing of interests (Art. 6 (1) f) GDPR)
If necessary, we process your data beyond the actual perfor­mance of the contract in order to safeguard legit­imate interests of ours or of third parties.
consulting and exchanging data with credit reference agencies for deter­mining credit andde­fault risks and current addresses;
reviewing and optimising proce­dures for needs analysis and digital commu­ni­cation;
marketing our own insurance products and those of our cooper­ation partners to existing customers or market research and opinion polling, providing that you have not objected to the use of your data and all other statutory require­ments have been met;
estab­lishing legal claims and defence in legal disputes;
ensuring IT security and the IT operation of the insurance company, running stress tests, devel­oping new and adapting existing products and systems, migrating data to ensure the viability and integrity of the systems and thus in the broader sense also of the processed data;
preventing and inves­ti­gating criminal offences, we partic­u­larly use data analyses to identify indica­tions that may point to insurance fraud;
measures for the business management and further devel­opment of processes, services and products,
risk management within PrismaLife AG;
risk assessment, balancing of the risks assumed by PrismaLife AG and ensuring the satis­faction of your claims;
preparing insurance-specific statistics for devel­oping new rates, customer care, quote and appli­cation processing, policy management, service provision and risk minimi­sation;
compliance purposes: compliance with statutory and other require­ments, e.g. recording and advice-provision oblig­a­tions, audits, compliance with audits by the government/authorities, reaction to legal processes, pursuit of statutory rights/remedies, management of internal complaints/claims, inves­ti­ga­tions and compliant behaviour with strategies/procedures;
planning, imple­menting and documenting internal auditing measures to ensure continuous improvement of our business processes and fulfilment of super­visory oblig­a­tions.
If we want to process your personal data for a purpose not specified here, we will inform you of this in advance in accor­dance with the statutory provi­sions.
c) On the basis of consent (Art. 6 (1) a) GDPR and Art. 9 (2) a) in conjunction with Art. 7 GDPR)
If you give us consent to process your personal data for certain purposes, this processing is as a result deemed lawful, for example consent for the processing of your personal data for marketing purposes or consent for the collection, processing and use of health data or biometric data (e.g. data on your electronic signature) by us. The consent to processing your health data is indis­pensable for the appli­cation review when entering into a life insurance policy and for the estab­lishment, execution or termi­nation of your insurance policy with us. If you do not provide this, the conclusion and execution of the policy will generally not be possible.
Any consent you have given can be withdrawn at any time (Art. 7 (3) GDPR). This also applies to the withdrawal of decla­ra­tions of consent that were given to us before the General Data Protection Regulation entered into force, i.e. before 25 May 2018.
Please note that the withdrawal of consent will only have effect for the future. Processing carried out before the withdrawal of consent is not affected.
d) On the basis of statutory oblig­a­tions (Art. 6 (1) c) GDPR) or in the public interest (Art. 6 (1) e) GDPR)
In addition, we process your personal data to fulfil statutory oblig­a­tions, e.g. super­visory require­ments, commercial-law or tax-law retention oblig­a­tions, fraud and money-laundering prevention, to fulfil checking and reporting require­ments under tax laws, to assess and manage risks and for the purpose of informing public author­ities and insti­tu­tions.
As part of the prevention of money laundering and of the financing of terrorism in the financial market, PrismaLife AG is obliged to identify the policy­holder, the beneficial owner, the benefi­ciary and the premium payer and to check PEP (polit­i­cally exposed person) status. The data collected is processed and stored for as long as it is necessary for the perfor­mance of the contract and fulfilment of statutory require­ments.
Some of the notifi­ca­tions that are required by law are listed below:
FATCA notifi­ca­tions
The FATCA (Foreign Account Tax Compliance Act) agreement concluded between the Princi­pality of Liecht­en­stein and the government of the United States of America for the promotion of honesty in tax matters aims to ensure that all accounts of US persons held abroad are actually taxed in the USA. The agreement imple­ments the American FATCA tax act and requires financial insti­tu­tions every­where in the world to report the data and accounts of US persons to the American tax author­ities.
AEOI notifi­ca­tions
In the context of the AEOI (Automatic Exchange of Infor­mation), financial insti­tu­tions in countries that have consented on the basis of their agreement on the appli­cation of the AEOI are required to provide their national tax author­ities with infor­mation about their foreign customers and their accounts worldwide. More infor­mation is available in the statutory infor­mation on the automatic exchange of infor­mation that you have received with your insurance documents.
4. Who can your data be passed on to and who do we receive it from?
Within PrismaLife AG, your data is received by the depart­ments that need it to fulfil pre-contractual and contractual oblig­a­tions, in the context of the balancing of interests or your consent and on the basis of statutory oblig­a­tions or in the public interest. Processors used by us (Art. 28 GDPR) may receive data for these afore­men­tioned purposes and process it on our behalf. With respect to passing on data to processors and to recip­ients outside of the insurance company (third parties), it should first be noted that due to statutory require­ments, we are bound to confi­den­tiality on all customer-related facts and evalu­a­tions of which we gain knowledge (duty of confi­den­tiality). We are only permitted to pass on infor­mation about you if you have released us from the duty of confi­den­tiality, if statutory provi­sions permit or require it, or we are legally autho­rised to provide infor­mation. Under these condi­tions, recip­ients of personal data can include:
a) Reinsurers:
We insure risks assumed by us with special insurance companies (reinsurers). To do this, it may be necessary to transfer your policy and claim data to a reinsurer so that the reinsurer can form its own picture of the risk or the insured event. In addition, the reinsurer may support our company in risk assessment or perfor­mance assessment and in the assessment of proce­dures due to its particular specialist knowledge. We transfer your data to the reinsurer only to the extent this is necessary for the fulfilment of our insurance contract with you or to the extent necessary to safeguard our legit­imate interests. More infor­mation on the reinsurer used is available on the reinsurers’ websites on
Swiss RE Europe S.A., Germany branch, Munich
RGA Inter­na­tional Reinsurance Company dac, Germany branch, Cologne
Partner Reinsurance Europe SE, Zurich
You can also request infor­mation using the contact details provided above.
b) Brokers:
If you are under the care of a broker with regards to your insurance policies, your broker processes contact data, advice services data and the appli­cation, policy and claim data needed to conclude and execute the policy as a separate controller under data protection law. Our company also transfers this data to the brokers looking after you to the extent the brokers need infor­mation for providing you with customer care and advice on your insurance and financial services affairs.
In addition to the broker respon­sible for you, insurance brokers in this sense also include broker advisers, broker associ­a­tions, broker companies (broker pools) and technical service providers (operators of comparison software or broker or customer management programmes) or other service providers (sub-brokers), who your broker uses to conclude and manage your insurance policies. You can ask your broker which ones are specif­i­cally involved. Personal data of yours is only trans­ferred to an insurance broker if you have consented to this or have given the insurance broker a power of attorney or a compa­rable autho­ri­sation that covers data transfer.
If necessary, we sometimes work with processors to fulfil our pre-contractual, contractual and statutory oblig­a­tions.
d) Public author­ities and insti­tu­tions:
In addition, we can transfer your personal data to additional recip­ients, e.g. to author­ities to fulfil statutory notifi­cation oblig­a­tions (e.g. financial author­ities or prose­cution author­ities, FMA, BaFin, FINMA etc.).
e) Credit reference agencies:
Our company regularly checks your credit score when concluding policies and in certain cases where there is a legit­imate interest. For the purpose of the credit check/credit score check, Creditreform Boniversum GmbH (Hellers­bergstraße 11, 41460 Neuss) and Creditreform Konstanz Müller & Schott GmbH & Co. KG (Mainaustr. 48, 78464 Konstanz) transfer the address and credit score data stored in their database about you to us, including scores calcu­lated on the basis of mathe­matical statis­tical methods, provided that we have credibly demon­strated our legit­imate interest. Address data is one of the things used to calculate the score. More detailed infor­mation on the activ­ities of the credit reference agencies mentioned is available on the respective fact sheets pursuant to Art. 14 GDPR under
www​.creditreform​-konstanz​.de/eu-dsgvo
Our company regularly checks incoming and outgoing payments to risky persons and organ­i­sa­tions using World-Check when concluding policies and in certain cases where there is a legit­imate interest. World-Check’s functions include sanction screening, PEP monitoring, combating money laundering, combating the financing of terrorism, anti-bribery and corruption, organised crime. Thomson Reuters, the provider of World-Check, names more than 530 sanction, regulatory and watch lists, national and inter­na­tional data sources as data sources. More infor­mation on the work of the private database is available on
g) Debt collection companies:
If you as our policy­holder do not meet your contractual oblig­a­tions and fall into payment arrears, we commission an autho­rised debt collection company to collect the debt on a case-by-case basis.
h) Additional data recip­ients:
In addition, additional data recip­ients may include the bodies for which you have given us your consent for the transfer of data or for which you have released us from our duties of confi­den­tiality.
A list of the processors used by us with which we have a not just temporary business relationship and all other afore­men­tioned recip­ients of your personal data is available in the overview attached and the latest version is available on our website on www​.prismalife​.com/​e​n​/​d​a​t​a​_​p​rotection/ entnehmen.
5. Transfer of data to a third country
We transfer your personal data to recip­ients outside of the European Economic Area (EEA) that have their headquarters in Switzerland. The transfer only takes place if the European Commission has confirmed an appro­priate level of data protection for the third country or other appro­priate data protection guarantees (e.g. EU standard contractual clauses) exist. The European Commission has confirmed an appro­priate level of data protection for Switzerland. Detailed infor­mation on this is available here in the Commission Decision: publi​ca​tions​.europa​.eu/​e​n​/​p​u​b​l​i​c​a​t​i​o​n​-​d​e​t​a​i​l​/​-​/​p​u​b​l​i​c​a​t​i​o​n​/​e​e​7​6f93d-4545 – 4878-87cb-7750d7f59987/language-de. You can also request confir­mation using the afore­men­tioned contact details.
We store your personal data for as long as it is needed for the afore­men­tioned purposes. It may happen that personal data is stored for the period in which claims against our company can be estab­lished (statutory period of limitation of three or up to thirty years). In addition, we store your personal data if we are legally obliged to do so. The corre­sponding proof and retention oblig­a­tions result from, among other things, the Act on the Super­vision of Insurance Under­takings, the Due Diligence Act and the Money Laundering Act. The storage periods are generally ten years. If the policy is not concluded with you, we store your health data collected as part of the risk assessment until the end of the third calendar year after the year of making the appli­cation in case you apply for insurance cover again.
You can exercise all rights by sending an email to datenschutz@​prismalife.​com, by contacting us by post or via the contact form on our website or via the myPris­maLife customer portal.
8. Do I have a duty to provide personal data?
As part of our business relationship, you only need to provide the personal data that is necessary for the estab­lishment, conducting and termi­nation of a business relationship, or that we are legally required to collect. Without this data, we will generally have to refuse to conclude the policy or execute the order or will no longer be able to execute an existing policy and may have to terminate it. In particular, we are required under the due diligence and anti-money laundering rules and the rules on the Automatic Exchange of Infor­mation in tax matters (AEOI) and the Foreign Account Tax Compliance Act (FATCA) to identify you as the policy­holder or as the beneficial owner or premium payer, for example using your identity card, before estab­lishing the business relationship, and in so doing to collect your surname, forenames, place of birth, date of birth, nation­ality, home address, tax residence and tax identi­fi­cation number. So that we can meet this statutory oblig­ation, you must provide us with the necessary infor­mation and documents in accor­dance with the Due Diligence Act and the Anti-Money Laundering Act, the AEOI Act and FATCA and report any changes arising over the course of the business relationship to your broker or us as the insurance company immedi­ately. If you do not provide us with the necessary infor­mation and documents, we are not permitted to establish or continue the business relationship requested by you.
In principle, we do not use fully automated decision-making pursuant to Art. 22 GDPR to establish or conduct the business relationship. If we use this process in future in individual cases, we will inform you of this separately if this is required by law.
This “Privacy policy for insurance policies” may be updated at a later date due to changes, e.g. to the statutory provi­sions. You can obtain the latest version of this privacy policy and the service provider list on PrismaLife AG’s website on www​.prismalife​.com/​d​a​t​a​_​p​rotection/.
Privacy policy for the newsletter mailing
PrismaLife AG offers a newsletter mailing for prospective and already affil­iated brokers, in which we provide infor­mation on products, offers and services for insurance and financial services and on events and news until you unsub­scribe from the newsletter mailing.
If you would like to subscribe for our newsletter, the following details marked by * are mandatory. The other data is optional:
Providing the required data (marked by *) is necessary to be able to send you the newsletter. The voluntary provision of further data enables us to address you correctly.
A double opt in is used to sign up to our newsletter. That means that after entering your email address in the sign-up screen for receiving the PrismaLife AG newsletter, you will be sent a confir­mation email to the email address you provided in which you will be asked to confirm that you want to receive the newsletter. You confirm this by clicking on an activation link in the confir­mation email you have received.
The legal basis for processing your personal data is the existence of your consent (see Art. 6 (1) a) of the General Data Protection Regulation (GDPR)). For processing your personal data, your consent is therefore obtained as part of the sign-up process and we also refer to this privacy policy during the sign-up process. The newsletter will only be mailed to you once you have given your consent.
Note on withdrawing consent:
You can withdraw consent for your newsletter subscription at any time. A link for unsub­scribing is included in every newsletter. You will then no longer receive any newsletters from PrismaLife AG.
The data is then only used for evidence of the correct handling of the previous legal relationship (e.g. documen­tation of the consent, sending of the newsletter). The lawfulness of the data processed on the basis of the consent until withdrawal of consent is not affected by the withdrawal of consent.
The data provided is only used for mailing and person­al­ising the newsletter. There is no further processing or resale of the personal data you have provided. The newsletters do not contain any visible or hidden counters, marketing from third parties or links to external sites that are not directly connected with the content of our newsletter.
Recip­ients
Only the employees entrusted with sending the newsletter and the IT service provider appointed (the so-called processor) receive access to the processed personal data for fulfilling the task.
Note on the processor:
We use the newsletter services of Clever­Reach GmbH & Co. KG, Mühlenstr. 43 in 26180 Rastede, Germany for our newsletter service. A contract for contract processing pursuant to Art. 28 GDPR has been concluded with Clever­Reach GmbH & Co. KG.
The processed data is erased pursuant to Art. 17 GDPR. If you unsub­scribe from the newsletter, your email address with all the associated personal data provided will be erased – providing these are no longer needed. The necessity of erasure is checked every two years.
We do not transfer your personal data to any recipient outside of the European Economic Area (EEA).
According to the General Data Protection Regulation, as a data subject you have a right of access pursuant to Art. 15 GDPR, the right to recti­fi­cation pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR and the right to data porta­bility from Art. 20 GDPR. In the case of the right of access and the right to erasure, the restric­tions pursuant to section 31 and 32 of the Liecht­en­stein Data Protection Act (DSG) apply. Furthermore, there is a right to withdraw consent pursuant to Art. 7 (3) GDPR and a right to object pursuant to Art. 21 GDPR. If you make use of your afore­men­tioned rights, we check whether the statutory require­ments for this are met. In addition, there is a right to lodge a complaint with a super­visory authority (Art. 77 GDPR).
You can exercise all rights by sending an email to datenschutz@​prismalife.​com, by contacting us by post or via the contact form on our website or via the broker portal.
If you would like to receive PrismaLife AG’s newsletter, you need to provide your email address and your surname for the mailing and for the person­al­i­sation of the newsletter.
In principle, we do not use fully automated decision-making pursuant to Art. 22 GDPR to establish or conduct the business relationship.
This “Privacy policy for the newsletter mailing” may be updated at a later date due to changes, e.g. to the statutory provi­sions. We recommend that you check this policy from time to time so that you remain up-to-date regarding our proce­dures and rules for handling personal data.
Privacy policy for brokers
What data is processed specif­i­cally and in what way it is used depends largely on our business relationship.
PrismaLife AG is respon­sible for the data processing:
Phone: +423 237 00 00 or 0800 237 0500* (*kostenfrei aus dem deutschen Fest- und Mobilnetz)
We process personal data that we have received from you as part of our business relationship. In addition – to the extent necessary for providing our services – we process personal data that we have received or will receive in the future from third parties (e.g. from cooper­ation partners or credit reference agencies) in a permis­sible way (e.g. for the execution of orders, for the perfor­mance of contracts or on the basis of consent granted by you).
We collect personal data without the involvement of the data subject if direct collection would be unrea­sonable or dispro­por­tionate, or we have received the data from the affil­i­ation documents from you as our business partner. If we also receive other people’s data in addition to your personal data, as our business partner, you must inform the data subjects of the data processing. This may, for example, be sub-brokers or your employees and/or freelancers.
Relevant personal data includes personal details (name, address and other contact details, date and place of birth and nation­ality), proof of identity data (e.g. identity card data), data on broker status, data on previous activ­ities and authen­ti­cation data (e.g. specimen signature), data regarding payment trans­ac­tions (e.g. bank account details), debt collection data and commission and fee data.
In addition, we process data that you provide us with in the “Sales partner affil­i­ation data collection sheet” and in the “Sales partner data update sheet” as part of our business relationship (e.g. Chamber of Industry and Commerce register number, SCHUFA excerpt, business regis­tration, if applicable commercial register excerpt, copy of the broker license and articles of associ­ation or partnership agreement), your broker number and data from the fulfilment of our contractual oblig­ation, infor­mation about your financial situation (e.g. credit­wor­thiness data, scoring/rating data), register data, data on your use of the telemedia we offer (e.g.time of accessing our website or apps, pages visited), personal data that you exchange with us in the future in our electronic broker portal and other data compa­rable to the categories mentioned.
In the event that you provide an electronic signature when filing an appli­cation or other documents to be signed by you during our contractual relationship, we record biometric data (writing speed, writing direction, writing pauses and, if applicable, pressure) and store and use this data to establish, execute or terminate this insurance policy and to realise PrismaL­ife’s customer portal myPris­maLife. For the purpose of evidence in any dispute on the genuineness of your signature, we store this data with a notary who is legally bound to confi­den­tiality, for the purpose of the estab­lishment, exercise and defence of legal claims.
The processing of your personal data serves to conclude and fulfil the fee agreement and/or broker agreement. This includes commission settle­ments, relia­bility checks, production statistics and production management.
consulting and exchanging data with credit reference agencies for deter­mining credit and default risks and current addresses;
measures for the business management and further devel­opment of services and products;
preparing insurance-specific statistics for devel­oping new rates, customer care, quote and appli­cation processing, contract management, service provision and risk minimi­sation;
planning, imple­menting and documenting internal auditing measures to ensure continuous improvement of our business processes and fulfilment of super­visory oblig­a­tions
c) On the basis of consent (Art. 6 (1) a) GDPR in conjunction with Art. 7 GDPR)
If you give us consent to process your personal data for certain purposes, this processing is as a result deemed lawful, for example consent for the processing of your biometric data in the event of submission of an electronic signature. Any consent you have given can be withdrawn at any time (Art. 7 (3) GDPR). This also applies to the withdrawal of decla­ra­tions of consent that were given to us before the General Data Protection Regulation entered into force, i.e. before 25 May 2018.
Within PrismaLife AG, your data is received by the depart­ments that need it to fulfil pre-contractual and contractual oblig­a­tions, in the context of the balancing of interests or your consent and on the basis of statutory oblig­a­tions or in the public interest. External recip­ients of your personal data can include:
More infor­mation on the reinsurer used is available on the reinsurers’ websites on
b) Processors:
c) Public author­ities and insti­tu­tions:
In addition, we can transfer your personal data to additional recip­ients, e.g. to author­ities to fulfil statutory notifi­cation oblig­a­tions (e.g. financial author­ities such as FMA, FINMA, BaFin, prose­cution author­ities etc.).
d) Debt collection companies:
If you as our sales partner do not meet your contractual oblig­a­tions and fall into payment arrears, we commission an autho­rised debt collection company to collect the debt on a case-by-case basis.
e) Additional data recip­ients:
In addition, additional data recip­ients may include the parties for which you have given us your consent for the transfer of data.
A list of the processors used by us with which we have a not just temporary business relationship and all other afore­men­tioned recip­ients of your personal data is available in the overview attached and the latest version is available on our website on www​.prismalife​.com/​e​n​/​d​a​t​a​_​p​rotection/
We transfer your personal data to recip­ients outside of the European Economic Area (EEA) that have their headquarters in Switzerland. The transfer only takes place if the European Commission has confirmed an appro­priate level of data protection for the third country or other appro­priate data protection guarantees (e.g. EU standard contractual clauses) exist. The European Commission has confirmed an appro­priate level of data protection for Switzerland. Detailed infor­mation on this is available here in the Commission Decision: www​.publi​ca​tions​.europa​.eu/​e​n​/​p​u​b​l​i​c​a​t​i​o​n​-​d​e​t​a​i​l​/​-​/​p​u​b​l​i​c​a​t​i​o​n​/​e​e​7​6f93d-4545 – 4878-87cb-7750d7f59 987/language-de. You can also request confir­mation using the afore­men­tioned contact details.
We store your personal data for as long as it is needed for the afore­men­tioned purposes. It may happen that personal data is stored for the period in which claims against our company can be estab­lished (statutory period of limitation of three or up to thirty years). In addition, we store your personal data if we are legally obliged to do so. The corre­sponding proof and retention oblig­a­tions result from, among other things, the Act on the Super­vision of Insurance Under­takings, the Due Diligence Act and the Money Laundering Act. The storage periods are ten years.
According to the General Data Protection Regulation, as a data subject you have a right of access pursuant to Art. 15 GDPR, the right to recti­fi­cation pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR and the right to data porta­bility from Art. 20 GDPR. Furthermore, there is a right to withdraw consent pursuant to Art. 7 (3) GDPR and a right to object pursuant to Art. 21 GDPR. If you make use of your afore­men­tioned rights, we check whether the statutory require­ments for this are met.
In addition, there is a right to lodge a complaint with a super­visory authority (Art. 77 GDPR).
The provision of your data is mandatory. Without the provision of your data, a fee agreement and/or broker agreement cannot be concluded and fulfilled. If you do not provide us with the necessary infor­mation and documents, we cannot establish or continue the business relationship requested by you.
This “Privacy policy for brokers” may be updated at a later date due to changes, e.g. to the statutory provi­sions. You can obtain the latest version of this privacy policy and the service provider list on PrismaLife AG’s website on www​.prismalife​.com/​d​a​t​a​_​p​rotection/.
Protecting your personal data as a third party, e.g. as a benefi­ciary, service provider or other third party, is important to us. In the following we would like to inform you about how PrismaLife AG processes your personal data and about the rights you have pursuant to data protection regula­tions under the rules of the EU General Data Protection Regulation (GDPR), which apply from 25 May 2018.
What data is processed specif­i­cally and in what way it is used depends largely on the contracts or services applied for or agreed.
Relevant personal data may, for example, include personal details (name, address and other contact details, date and place of birth and nation­ality), proof of identity data (e.g. identity card data) and authen­ti­cation data (e.g. specimen signature). In addition – to the extent necessary – we process special categories of personal data (e.g. your health data). Furthermore, this can also include order data (e.g. payment order), data from the fulfilment of our contractual oblig­ation, infor­mation about your financial situation (e.g. credit­wor­thiness data, scoring/rating data), debt collection data, register data, data on your use of the telemedia we offer (e.g.time of accessing our website or apps, pages visited) and other data compa­rable to the categories mentioned. In addition, this may also include under­writing data and, if necessary, a third party’s infor­mation, e.g. a broker’s, an expert’s or a doctors infor­mation may be stored (contract data). In the event of an insured event, data on the claim and also any infor­mation from third parties may be processed.
The purposes of the data processing depend on the reason for the mutual contact (hereinafter also the business relationship). This may include:
as an autho­rised or appointed person, we use your personal data for commu­ni­cation
we process your personal data in the case of claims in order to be able to check whether an insured event has occurred and how high the loss is
in the case of business relation­ships, e.g. in the case of a service contract or a contract to produce a work, outside of an insurance relationship, we process your personal data to establish, conduct or terminate the relationship
We need our cooper­ation partners’ customers’ data to implement the cooper­ation agreement
The data, on the basis of the grounds of autho­ri­sation pursuant to the GDPR, is primarily processed to perform the contract, to safeguard our legit­imate interests, on the basis of your consent and/or to fulfil legal oblig­a­tions.
a) In order to satisfy contractual oblig­a­tions (Art. 6 (1) b) GDPR)
Processing personal data is necessary to satisfy the contractual oblig­a­tions with you. If you have a business relationship with us outside of an insurance relationship, we process your data to establish, conduct or terminate this contractual relationship, e.g. for commu­ni­cation.
To the extent necessary, we process your data to safeguard legit­imate interests of ours or of third parties. Depending on the reason for the mutual contact, this may include:
ensuring the IT security and IT operation of the insurance company, running stress tests, devel­oping new and adapting existing products and systems, migrating data to ensure the viability and integrity of the systems and thus in the broader sense also of the processed data;
measures for the business management and further devel­opment of processes, services and products;
planning, imple­menting and documenting internal auditing measures to ensure continuous improvement of our business processes and fulfilment of regulatory oblig­a­tions.
If you have given us consent to process personal data for certain purposes (e.g. consent to the processing of health data), this processing is as a result deemed lawful. Any consent you have given can be withdrawn at any time (Art. 7 (3) GDPR). This also applies to the withdrawal of decla­ra­tions of consent that were given to us before the General Data Protection Regulation entered into force, i.e. before 25 May 2018.
As an insurance company we are also subject to various legal oblig­a­tions, i.e. statutory require­ments (e.g. the Act on the Super­vision of Insurance Under­takings, the German Insurance Contract Act, the Money-Laundering Act, the Due Diligence Act, tax laws) and super­visory require­ments (e.g. by the financial market authority). The purposes of processing include the fulfilment of super­visory and regulatory tasks, identity and age checks, fraud and money-laundering prevention, the fulfilment of checking and reporting require­ments under tax laws, the assessment and management of risks and the provision of infor­mation to author­ities.
Within PrismaLife AG, your data is received by the depart­ments that need it to fulfil contractual oblig­a­tions, in the context of the balancing of interests or your consent and on the basis of statutory oblig­a­tions or in the public interest.
With regard to passing on data outside of PrismaLife AG, recip­ients of your personal data may, for example, include:
We insure risks assumed by us with special insurance companies (reinsurers). To do this, it may be necessary to transfer his policy and claim data to a reinsurer so that the reinsurer can form its own picture of the risk or the insured event. In addition, the reinsurer may support our company in risk assessment or perfor­mance assessment and in the assessment of proce­dures due to its particular specialist knowledge. We transfer data to the reinsurer only to the extent this is necessary for the fulfilment of our insurance contract or to the extent necessary to safeguard our legit­imate interests. More infor­mation on the reinsurer used is available on the reinsurers’ websites on
Insurance brokers in this sense include brokers, broker advisers, broker associ­a­tions, broker companies (broker pools) and technical service providers (operators of comparison software or broker or customer management programs) or other service providers (sub-brokers), who your broker uses manage your insurance policies.
In addition, we can transfer your personal data to additional recip­ients, e.g. to author­ities to fulfil statutory notifi­cation oblig­a­tions (e.g. financial author­ities or prose­cution author­ities, FMA, FINMA, BaFin etc.).
If you do not meet your contractual oblig­a­tions and fall into payment arrears, we commission an autho­rised debt collection company to collect the debt on a case-by-case basis.
5 Transfer of data to a third country
We transfer your personal data to recip­ients outside of the European Economic Area (EEA) that have their headquarters in Switzerland. The transfer only takes place if the European Commission has confirmed an appro­priate level of data protection for the third country or other appro­priate data protection guarantees (e.g. binding corporate data protection rules or EU standard contractual clauses) exist. The European Commission has confirmed an appro­priate level of data protection for Switzerland. Detailed infor­mation on this is available here in the Commission Decision:
www​.publi​ca​tions​.europa​.eu/​e​n​/​p​u​b​l​i​c​a​t​i​o​n​-​d​e​t​a​i​l​/​-​/​p​u​b​l​i​c​a​t​i​o​n​/​e​e​7​6f93d-4545 – 4878-87cb-7750d7f59987/language-de.
You can also request confir­mation using the afore­men­tioned contact details.
We store your personal data for as long as it is needed for the afore­men­tioned purposes. It may happen that personal data is stored for the period in which claims against our company can be estab­lished (statutory period of limitation of three or up to thirty years). In addition, we store your personal data if we are legally obliged to do so. The corre­sponding proof and retention oblig­a­tions result from, among other things, the Act on the Super­vision of Insurance Under­takings, the Due Diligence Act and the Money Laundering Act. The storage periods are generally ten years.
You can exercise all rights by sending an email to datenschutz@​prismalife.​com, by contacting us by post or via the contact form on our website.
8 Do I have a duty to provide personal data?
As part of our business relationship, you only need to provide the personal data that is necessary in this respect for the commencement and estab­lishment, conducting and termi­nation of a business relationship, that we need for the exercise of our legit­imate interests or that we are legally required to collect. Without this data, we will generally have to refuse a business relationship or will no longer be able to conduct an existing business relationship and may have to terminate it.
In particular, we are required under the due diligence and anti-money laundering rules to identify you as the benefi­ciary or as the beneficial owner, for example using your identity card, before estab­lishing the business relationship and in so doing to collect your surname, forenames, place of birth, date of birth, nation­ality, home address, tax residence and tax identi­fi­cation number and to electron­i­cally record the identity card/passport. So that we can meet this statutory oblig­ation, you must provide us with the necessary infor­mation and documents in accor­dance with the Due Diligence Act, the Anti-Money Laundering Act, the AEOI Act and FATCA and report any changes arising over the course of the business relationship to us as the insurance company immedi­ately. If you do not provide us with the necessary infor­mation and documents, we are not permitted to continue the business relationship requested by you or provide the service.
9 To what extent is there automated individual decision-making?
We process your personal data for direct marketing purposes in individual cases. You have the right to object to the processing of personal data concerning youfor the purposes of such marketing at any time.
This “Privacy policy for third parties” may be updated at a later date due to changes, e.g. to the statutory provi­sions. You can obtain the latest version of this privacy policy and the service provider list on PrismaLife AG’s website on www​.prismalife​.com/​d​a​t​a​_​p​rotection/.
Service provider overview (PDF)