The right of privacy, particularly the right of personal data protection, is one of the fundamental principles of Grupo Catalana Occidente.
Who is the controller of your personal data?
Who is the Data Protection Officer?
Who is the data protection supervisory authority?
The supervisory authority is the Spanish Data Protection Agency, with headquarters in Madrid (28001), calle Jorge Juan, nº 6, to whom you may submit queries and/or complaints regarding this matter, should you consider that your data protection rights and freedom have not been duly taken care of by the corresponding Entity of the Grupo Catalana Occidente. For more information, go to the following website: https://www.agpd.es.
What personal data are processed?
All personal data, whether directly collected or by an intermediary, including documents containing it, or obtained from recorded telephone conversations or Internet web page browsing or other means, including biometric and geolocation data, will be processed before, during and after executing an application, contract or service related to any of the products marketed by Grupo Catalana Occidente's Entities on behalf of the client, whose data is needed in the study, transmission, development and execution of contractual relationships.
In this sense, the definition of customer is established as any data subject that is a: policyholder, insured person, beneficiary, participant, shareholder, partner, subscriber, rightholder, mortgagor, investor in promissory notes and/or third party that establishes a contractual or services relationship with an Entity of Grupo Catalana Occidente.
If the personal data is provided by a person other than the holder, it shall be the provider's obligation to previously communicate this information to the holder of the personal data, as well as to obtain his consent, when required, so the Entity of Grupo Catalana Occidente can process this data.
In addition, this personal data can be supplemented, always complying with the requirements established in the personal data protection regulations, by other data obtained from providers of Grupo Catalana Occidente, as well as that obtained from public sources or any personal data that the data subject has made public.
In general terms the personal data of minors shall only be processed when their parents or legal guardians have provided their consent for the processing required to execute the corresponding contract or service, the fulfilment of a legal obligation and/or in legitimate interest of the data controlling Entity of Grupo Catalana Occidente, notwithstanding the personal data protection rights established by the current applicable regulation.
Which are the purposes of processing your personal data?
- Main purpose:
The main purpose of processing personal data is to study, issue, develop and execute the contract or service entered with the corresponding Entity of Grupo Catalana Occidente and to fulfil the obligations established in the current regulation applicable to the data controlling Entity of Grupo Catalana Occidente.
- Other purposes:
Likewise, personal data will be object of processing for the purpose of fighting and preventing fraud and money laundering and the financing of terrorism, and the consultation and communication of information from/to sectoral files shall be permitted.
In addition, within the scope of managing the request and/or any of the contracts or services provided by any of the Entities of Grupo Catalana Occidente, the Entity controlling the personal data may process your personal data to assess your´economic solvency, consulting and communicating information from/to financial solvency and creditworthiness files, as well as the carrying out of statistical, quality and technical studies, including those related to satisfaction surveys, market analysis, and research and service quality.
In insurance products the personal data may be processed to manage the coinsurance or reinsurance, in conformance with the current regulation.
Finally, as for contact forms, telephone numbers and social network profiles that may be made available to you by the different Entities of the Grupo Catalana Occidente, your data will be used to (i) attend to and manage queries and requests made via the telephone numbers and social network profiles provided for this purpose; (ii) attend to and manage suggestions, complaints and other queries made using the corresponding form; and (iii) to manage CVs provided for a selection process opened in Entities of Grupo Catalana Occidente.
- Automated decisions:
Some processing of personal data may require the adoption of automated decision-making and/or profiling. This means that certain decisions may be made automatically without human involvement, always having the data subject the right to: (i) request the review of the results by a person; (ii) express their point of view; and (iii) contest the decision, always in accordance with current applicable regulations.
- Advertising purposes:
What is the legitimation of the processing of personal data?
The legitimation of the aforementioned processing for the main purpose established above is based on the unfolding of the offer, contract or service entered with the corresponding data controlling Entity of Grupo Catalana Occidente.
Any processing for the other purposes mentioned above and for making automated decisions has legal grounds in the applicable regulation or the legitimate interest of each data controlling Entity of Grupo Catalana Occidente.
Lastly, the processing of personal data for advertising purposes is legitimised, where applicable, by express consent.
For how long will we hold on to your personal data?
Your personal data will be held for the entire time that the relationship with the Entity of Grupo Catalana Occidente with which the service or contract has been formalised is effective. Once this relationship has ended, this data will be stored for the necessary period of time established by the applicable legislation at all times, and will be available to the courts and tribunals, Public Prosecutor's Office, State security forces and/or competent public administrations, in particular the appropriate personal data protection supervisory authorities, and corresponding supervisory bodies, in order to deal with any legal or contractual liabilities arising from the contract or service related to the data processing in question and during the applicable time in force.
Any requests or proposals that do not materialise in a contract or service, regardless of the reason, shall be held for the required period to guarantee the fight against fraud in contracting and to prevent money laundering and the financing terrorism.
To which recipients will your personal data be communicated?
- Entities belonging to the Grupo Catalana Occidente:
We also specifically inform you that the Entities of Grupo Catalana Occidente share common services, with a different level of intensity, for the purpose of making use of the existing synergies, optimising resources and offering a better service to customers. To this end, several framework agreements have been entered to provide reciprocal services, which involve access to personal data managed by other Entities of Grupo Catalana Occidente and include various service provisions, including, but not limited to, the following:
- Services provided by Grupo Catalana Occidente, Tecnología y Servicios A.I.E. for Grupo Catalana Occidente's Entities: (i) hosting and data hosting, (ii) computing system, communication and equipment maintenance and management (iii) data security (iv) application development and maintenance, (v) providing a service to handle claims, and (vi) document management.
- Services provided by the Grupo Catalana Occidente Contact Center A.I.E. for Grupo Catalana Occidente's Entities: provide a customer helpline service by phone and via social networks; and customer satisfaction campaigns.
- Services provided by Prepersa Peritación de Seguros y Prevención A.I.E. for the Entities of the Grupo Catalana Occidente: render a service to cooperate in the management of claims related to insurance policies.
- Other Entities
Personal data can also be communicated to different collaborators or service providers of any data controlling Entity of Grupo Catalana Occidente, such as, including but not limited to: insurance brokers, co-insurers, reinsurers, lawsuit experts and investigators, lawyers and solicitors, auditors, consultants, medical professionals and health assessors, financial, depository and managing Entities and other suppliers and professionals who process personal data as party responsible and on behalf of the corresponding Entity responsable for Grupo Catalana Occidente, in order to guarantee that services rendered by the aforementioned party responsible for the contract or service comply with obligations stipulated in the applicable regulations, in legitimate interest and/or in accordance with their given consent.
In all the aforementioned cases, we inform you that the computer servers of these service providers may be located in countries outside the European Union, where, if the level of privacy protection were not equivalent to the European or national personal data protection regulations, the corresponding data controlling Entity of Grupo Catalana Occidente shall adopt the necessary and appropriate measures to safeguard the data subject's rights and the information's security, according to the available technical means at any given time..
- Official bodies and authorities:
Personal data will be given to all those recipients for whom such information must be disclosed by the Entities of the Grupo Catalana Occidente, in compliance with legal obligations, including, but not limited to, competent public bodies and administrations, such as the Spanish Tax Administration Agency or regional tax authorities, personal data protection control authorities, courts and tribunals, corresponding supervisory bodies, the Public Prosecutor's Office and/or State security forces and bodies.
- Financial services and credit worthiness:
Entities of Grupo Catalana Occidente are entitled to view and process data from files of claims, information on financial and credit solvency and any other such data to enable it to assess personal risk, maintain and monitor the development of the contractual relationship, manage claims and perform statistical analyses of claims and fraud prevention.
- In the case of having a car insurance policy:
The insurance companies of the Grupo Catalana Occidente, in accordance with current legislation, will provide the habitual driver subject to the insurance policy with information on sanctions, if any, that may be published in his or her name on the current or future certified websites, in compliance with current legislation on personal data protection.
The above insurance company shall use data belonging to the Vehicle Investigation Institute in the centre of Zaragoza (Instituto de Investigación sobre Vehículos S.A:) to identify the vehicle's registration and chassis number and all technical and administrative characteristics of the vehicle covered in the insurance policy.
In addition, by virtue of the powers granted by the Law on the Organisation, Supervision and Solvency of Insurance and Reinsurance Companies, the Spanish Union of Insurance and Reinsurance Companies (UNESPA by its Spanish acronym) has created the following files:
The car insurance file, whose purpose is the pricing and selection of risks. The file comprises the information provided by the Insurance Companies in which their claims records for the last five years are compiled, in accordance with the terms stipulated in the Civil Liability and Motor Vehicle Transit Insurance Law. We hereby notify you that data about your motor vehicle insurance contract and the claims associated with the same over the past five years (if any) will be assigned to the aforementioned shared file.
The common file for total loss, fire and theft of car insurance. The purpose of the aforementioned file, consisting of the information provided by the Insurance Companies, is fraud prevention and detection, either by preventing the Insurance Company at the time of contracting the insurance policy or by detecting fraud already committed in the declared claims. The file contains all the information in your insurance contract, including your personal data, claims submitted and amounts received as settlement. Likewise, in order to facilitate location of the missing vehicles due to theft, the Zaragoza Centre and Spanish law enforcement bodies will have access to the information, for the sole purpose of carrying out relevant checks on located vehicles to inform the Insurance Company of their availability for the owner or, in the event that the vehicle has been indemnified, for the Insurance Company itself. We hereby inform you that in the event of a claim in which the insured vehicle has been totally lost due to damage, fire or theft, the data from your motor vehicle insurance contract and information associated with the claim will be assigned to the above shared file.
If you wish to exercise your rights under the personal data protection regulations in relation to these files, you may contact Tecnologías y Redes para Entidades Aseguradoras, S.A. (TIREA, Spanish acronym for Technologies and Networks for Insurance Companies) who are in charge of data processing and to whom UNESPA (Spanish acronym for Spanish Union of Insurance and Reinsurance Companies) has delegated responsibility in, to resolve your personal data protection queries, certifying your identity by post to ctra. Las Rozas a El Escorial Km 0.3 Las Rozas 28231 MADRID or by e-mail to the data protection officer: firstname.lastname@example.org.
- If you have taken out a multi-risk insurance policy for home, business, community, SME and industry, civil liability or other insurance for various areas:
By virtue of the powers granted by the Law on the Organisation, Supervision and Solvency of Insurance and Reinsurance Entities, UNESPA has created a sectoral file for claims settlement, actuarial statistical collaboration and the conducting of studies on insurance techniques, as well as fraud prevention. We inform you that, in the event of a claim affecting the insured risk, the data concerning your insurance contract and any claim-related information may be transferred to the aforementioned joint file.
If you would like to exercise the rights conferred by the personal data protection regulations in relation to these files, you may write to TIREA, which is the processor assigned by UNESPA, acting as the controller, to safeguard the personal data protection rights, providing proof of your identity at the addresses included in section (v) above.
- If you have taken out a life, accident, health, illness, death or any other insurance policy in which we request or process health information:
Your personal data may be disclosed to the different partners and service providers of the corresponding Grupo Catalan Occidente Insurance Company mentioned above, who shall process all personal data as responsible party in the name and on behalf of the aforementioned Insurance Company.
In addition, and specifically, if you are a holder of:
(a) a life insurance policy with death benefit and/or an accident insurance policy covering the contingency of the insured person's death, whether individual or collective policies, in compliance with current legislation, your personal data will be disclosed to the public insurance register of contracts with death benefit dependent on the Ministry of Justice or the one that may replace it in the future, as the case may be.
(b) a health insurance or health care insurance policy, in which case your personal data, including health data, may be disclosed to the corresponding insurance company of the Catalana Occidente Group to doctors, health centres, hospitals or other institutions or persons in order to fulfil, develop, control and execute health care, leading to the reimbursement or indemnity stipulated in the insurance contract upon consulting or verifying the causes and medical background of the interested party with the aforementioned health providers to justify any benefits, reimbursements or indemnifications, and, where applicable, recovering expenses.
- In the event of having contracted a social welfare product:
Your personal data may be exchanged between the Managing Entity, the Depositary and the Promoter and/or Marketing Entity of such social welfare products.
Likewise, in the case of asking to demonstrate vested rights from the Managing Entity or target insurance company, the client must present this demonstration request and an authorization to the Managing Entity or target insurance company so that, in their name, the source fund Managing Entity may be asked to demonstrate such vested rights, in addition to all finantial and fiscal data needed in the process.
- In the event of having subscribed shares in any of the investment funds commercialised by Grupo Catalana Occidente:
Your personal data may be exchanged between the Managing Entity, the Depositary and the corresponding Marketing Entity of the said investment funds.
What are your rights when you provide your personal data?
As holder of your personal data, you are entitled to the rights set out below, which you may exercise by proving your identity, as explained in the Data Protection Officer section:
- Right of access. Information about your personal data may be requested from the corresponding Entity of the Grupo Catalana Occidente, including how such data is processed, as well as obtaining a copy of such data in a user-friendly, structured, easy to read format.
- Right of rectification. You may request the rectification of personal data that is inaccurate, and, where incomplete, you have the right to request that such data be correctly filled in, including an additional declaration where necessary.
- Right of withdrawal. You may request your personal data be withdrawn when it is no longer needed for the purposes for which it was collected by the Entity of the Grupo Catalana Occidente responsible for its processing, or when you withdraw your consent for which such processing is based. Such a request shall not be applicable when processing is required on the grounds of what is stipulated in the paragraph "legitimation of the processing of personal data".
In this respect, in the digital environment of any of the Entities of Grupo Catalana Occidente, if you exercise your right to be forgotten, the corresponding Entity will contact the Internet service provider to transmit the interested party's request to cancel the processing of personal data affecting them, taking into account available technology and the cost of using it; in this case, data will only be stored by the person responsible in order to make, exercise rights to or defend claims. The request shall not be applicable when the processing is required on the basis of the provisions included in the section “legitimation of the processing of your personal data”, whether the processing is required to exercise the right of freedom of expression and information or on grounds of public interest.
- Right to object. You may object to your personal data being processed, unless the Grupo Catalana Occidente Entity responsible for such processing have legitimate reasons to continue doing so, in which case such data will only be stored by the legally responsible person to make, exercise rights to or defend claims. The processing of personal data for commercial or advertising purposes shall not be considered legitimate and therefore the right to object shall be deemed equivalent to the withdrawal of given prior consent. Such a request shall not be applicable when processing is required on the grounds of what is stipulated in the paragraph "legitimation of personal data processing".
- Right to restrict processing: You may request the processing of your personal data be restricted, which may involve your data being blocked in the following circumstances: (i) when you contest the accuracy of the data, (ii) when the Controller opposes the deletion of data due to the processing being legal, (iii) when the Controller no longer needs the data but they are required to draw up, exercise or defend claims or (iv) when you have opposed the processing while the Controller verifies if its legitimate reasons prevail over yours, in this case they shall only be held by the Controller to draw up, exercise or defend claims.
- Right of portability. Where technically possible, you may request that relevant personal data subject to automated processing be transmitted to another controller, or to yourself as data subject, in a structured, commonly used and easy to read format, and without detriment to your rights of deletion or to be forgotten, in which case such data will only be stored by the data controller for the purpose of formulating, exercising or defending claims.
Any communications and actions performed in the context of exercising your rights shall be free of charge. When the requests are manifestly unfounded or excessive, especially when they are of a repetitive nature, the data controlling Entity of Grupo Catalana Occidente may charge a fee according to the expenses borne to fulfil the request.
Confidentiality of personal data
From the first moment it initiates the data processing, the data controlling Entity of Grupo Catalana Occidente shall implement the technical, organisational and security measures necessary, considering the state of technology, to guarantee the confidentiality, integrity, availability and resilience of the personal data, as well as to prevent its unauthorised access, alteration, loss or processing.
We inform you that the computer servers of some Grupo Catalana Occidente service providers may be located in countries outside the European Union, where, if the level of privacy protection were not equivalent to the European or nationals personal data protection regulations, the corresponding data controlling Entity of Grupo Catalana Occidente shall adopt the necessary and appropriate measures to safeguard the data subject's rights and the information's security, according to the available technical means at any given time.
Grupo Catalana Occidente reserves the right to apply, at any given time and without prior notice, as many modifications, variations, deletions or cancellations in the content and in the way it is presented as deemed appropriate.
COMPANY ► Tax ID number ► REGISTERED OFFICE ► RECORDABLE DATA ► CONTACT DETAILS / DEPT. ► EMAIL ADDRESS
- Grupo Catalana Occidente S.A.: A08168064 - Paseo de la Castellana 4, 28046 Madrid - Registered in the Commercial Registry of Madrid, in volume 36,829, folio 141, sheet M-659,287 - Data Protection Officer / Grupo Catalana Occidente / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - email@example.com
- Bilbao, Compañía Anónima de Seguros y Reaseguros: A48001648 - Paseo del Puerto 20, 48992 Neguri- Getxo (Vizcaya) - Registered in the Commercial Registry of Vizcaya, in volume 55, folio 103, sheet 2,436 - Data Protection Officer / Seguros Bilbao / Paseo del Puerto 20, 48992 Neguri- Getxo (Vizcaya) - firstname.lastname@example.org
- Seguros Catalana Occidente, S.A. de Seguros y Reaseguros: A-28119220 - Paseo de la Castellana 4, 28046 Madrid - Registered in the Commercial Registry of Madrid, in volume 37,110, folio 177, sheet M-91,458 - Data Protection Officer / Seguros Catalana Occidente / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - email@example.com
- Nortehispana de Seguros y Reaseguros S.A.U.: A-08185589 - Paseo de la Castellana 4, 28046 Madrid - Registered in the Commercial Registry of Madrid, in volume 36,935, folio 1, sheet M-660,565 - Data Protection Officer / Nortehispana Seguros / Pau Claris 132, Barcelona - firstname.lastname@example.org
- Plus Ultra, Seguros Generales y Vida S.A. de Seguros y Reaseguros, Sociedad Unipersonal: A-30014831 - Plaza de las Cortes 8, 28014 Madrid - Registered in the Commercial Registry of Madrid, in volume 5,992, folio 100, sheet M-97,987 - Data Protection Officer / Plus Ultra Seguros / Plaza de las Cortes 8, 28014 Madrid - email@example.com
- Grupo Catalana Occidente Gestión de Activos SGIIC, S.A.: A-28475754 - Cedaceros 9, planta baja, 28014 Madrid - Registered in the Commercial Registry of Madrid, in volume 36,521, folio 171, sheet M-52,463 - Data Protection Officer / GCO Asset Management / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - firstname.lastname@example.org
- Bilbao Hipotecaria S.A., EFC: A-48409023 - Paseo del Puerto 20, 48992 Neguri- Getxo (Vizcaya) - Registered in the Commercial Registry of Vizcaya, in volume 2,228, folio 150, sheet no. 16,326 - Data Protection Officer / Bilbao Hipotecaria / Paseo del Puerto 20, 48992 Neguri- Getxo (Vizcaya) - email@example.com
- Grupo Catalana Occidente Contact Center, AIE: V-65404063 - Jesus Serra Santamans 3, 08174 Sant Cugat del Vallés (Barcelona) - Registered in the Commercial Registry of Barcelona, in volume 42,241, folio 185, sheet B-405,292 - Data Protection Officer / GCO Contact Center / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - firstname.lastname@example.org
- Grupo Catalana Occidente Tecnología y Servicios AIE: V-65004517 - Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - Registered in the Commercial Registry of Barcelona, in volume 41,030, folio 29, sheet B-376,366 - Data Protection Officer / GCO Tecnología y Servicios / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - email@example.com
- Catalana Occidente Capital, Agencia de Valores: A-63764138 - Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - Registered in the Commercial Registry of Barcelona, in volume 37,416, folio 142, sheet B-298,341 - Data Protection Officer / COCAV / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - firstname.lastname@example.org
- GCO Previsión, Entidad de Previsión Social Voluntaria Individual: V-48410120 - Paseo del Puerto 20, 48992 Neguri- Getxo (Vizcaya) - Registered in the Commercial Registry of Vizcaya, in volume 2111, folio 124, sheet 5-8 - Data Protection Officer / GCO Presivisón EPSV / Paseo del Puerto 20, 48992 Neguri- Getxo (Vizcaya) - email@example.com
- GCO Gestora Pensiones E.G.F.P., S.A.: A-67000471 - Paseo de la Castellana 4, 28046 Madrid - Registered in the Commercial Registry of Madrid, in volume 36,886, folio 90, sheet M-659,976 - Data Protection Officer / GCO Gestora de Pensiones / Avenida Alcalde Barnils 63, 08174 Sant Cugat del Vallés (Barcelona) - firstname.lastname@example.org