When you:
- access and use the website www.lovys.com and/or the Lovys mobile app (the “Lovys Platform”); and
- view the information available about the insurance products offered on the Lovys Platform, request a free quote with a view to possibly taking out an insurance policy, subscribe to one of our products and/or services and manage your insurance policies and/or services online (the “Services”),
you entrust us with certain data and information, including data that identifies you or makes you identifiable (e.g. name, email address, copy of an identity document), which constitute “Personal Data”.
Lovys is committed to enabling you to use the Lovys Platform and the Services with complete confidence and to protecting your Personal Data.
This Privacy and Personal Data Protection Policy (the “GDPR Policy”) explains how we collect and process your Personal Data, and sets out our commitments and your rights in this respect.
The Lovys GDPR Policy in force is the one available on the Lovys Platform on the date you log in to the Lovys Platform. Lovys may amend it at any time, in particular to keep it up to date or to reflect changes in applicable regulations.
What does it mean for Lovys to be the Data Controller of your Personal Data?
Lovys, a simplified joint-stock company (SAS) with share capital of €2,036.79, registered with the Bobigny Trade and Companies Register under number 832028021, whose registered office is at 5 rue Pleyel – 93200 Saint-Denis (France) (“Lovys”), acts as “Data Controller” for the Personal Data collected and processed on the Lovys Platform and in connection with the provision of the Services. Within the meaning of the GDPR, it is Lovys that determines the purposes and means of the processing of your Personal Data carried out in this context.
As such, Lovys undertakes to ensure the protection, security and confidentiality of the Personal Data processed, in accordance with amended French Law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties (“Informatique et Libertés”), the General Data Protection Regulation no. 2016/679 of 27 April 2016 (“GDPR”) and the opinions and decisions of the competent supervisory authorities.
What Personal Data may be collected on the Lovys Platform?
When you use the Lovys Platform, the Personal Data that Lovys collects and processes may include, in particular:
- data relating to your identity, family and professional situation, and your economic and financial situation;
data relating to your bank details;
data relating to the management of your insurance policy or policies with Lovys;
- data required to enable Lovys to comply with its regulatory obligations, including in the fight against insurance fraud, money laundering and terrorist financing; and
- your communication preferences and your Lovys Platform connection data (see our Cookie Policy).
To find out more about the data we collect through our forms, see our Data collection page.
Why is Personal Data collected on the Lovys Platform? For how long?
Lovys only collects your Personal Data for specified, explicit and legitimate purposes.
Lovys undertakes that your Personal Data collected in this context will only be processed for the purposes described below and limited to what is strictly necessary and relevant to those purposes.
Each processing of Personal Data by Lovys is based on one of the legal bases provided for by the GDPR, as described below.
In addition, Personal Data is kept only for as long as necessary to achieve the purposes pursued; a longer retention period is possible where it results from a legal or regulatory obligation to which Lovys is subject.
To ensure full transparency regarding the processing purposes and retention periods applied at Lovys, please see the explanatory table below:
Management and performance of the insurance policy or policies taken out, including issuing contractual documents, handling claims and complaints, and providing cover
Processing is necessary for the performance of the insurance policy or policies taken out (Article 6.1(b) GDPR).
The entire term of the policy or policies plus an additional 24 months from the end of the contractual relationship.
Handling requests for information sent by email or via our online chat tool
Processing is necessary for the legitimate interest of Lovys, namely responding to requests for information about its Services (Article 6.1(f) GDPR).
36 months from your last contact.
Combating insurance fraud, money laundering and terrorist financing
Processing is carried out in the legitimate interest of Lovys (Article 6.1(f) GDPR) and to comply with its legal or regulatory obligations (Article 6.1(c) GDPR).
Combating insurance fraud: when an insurance fraud alert is raised, Personal Data is kept for no more than 5 years from the closure of the fraud file if the alert has been classified as “relevant”; it is deleted without delay if the alert is classified as “not relevant”.
Combating money laundering and terrorist financing: the Personal Data processed is kept for the entire term of the policy or policies and for 5 years from the end of the contractual relationship.
Communication, customer loyalty or service quality improvement activities (e.g., offers of our products and Services and/or those of our insurance partners, satisfaction surveys, polls, loyalty programmes, etc.)
Processing may be necessary for the legitimate interest of Lovys, namely offering its customers new Services that are related, complementary or similar to those already provided (Article 6.1(f) GDPR).
In some cases, processing is based on the consent of the data subject (Article 6.1(a) GDPR).
Personal Data relating to a prospect who is not a customer is kept for 36 months from its collection by Lovys or from the prospect’s last contact.
Personal Data relating to a customer is kept for the entire term of the policy or policies plus an additional 24 months from the end of the contractual relationship.
Processing is based on the consent of the person submitting their application (Article 6.1(a) GDPR); processing may also be necessary to take pre-contractual steps (Article 6.1(b) GDPR) and/or carried out in the legitimate interest of Lovys (Article 6.1(f) GDPR), namely contacting candidates.
For successful candidates: Personal Data is kept for the duration of the recruitment process and may be used for HR management purposes.
For unsuccessful candidates: Personal Data is kept for the duration of the recruitment process.
With the candidate’s consent, their Personal Data may be kept for an additional 24 months.
Is your Personal Data shared with third parties?
When you use the Lovys Platform, Lovys undertakes to limit access to your Personal Data to those persons who need to use it, namely:
- Lovys employees;
- Lovys’s insurer partners;
- Lovys’s co-distributors; and
- Lovys’s processors (including partners involved in handling claims and complaints).
Lovys never discloses Personal Data to third parties unless: (1) disclosure is necessary for the performance of your insurance policy or policies with Lovys; (2) an administrative or judicial authority requests disclosure from Lovys; (3) disclosure is necessary to comply with contractual, legal and/or regulatory obligations; (4) you request or authorise the disclosure.
Is your Personal Data transferred outside the European Union?
Where Lovys transfers your Personal Data outside the European Union, Lovys undertakes to put in place all necessary safeguards to protect your Personal Data and ensure that processing complies with the GDPR.
How is your Personal Data protected?
Lovys requires its employees, partners, co-distributors and processors (including partners involved in handling claims and complaints) to comply fully with the GDPR. This includes, in particular, written contractual guarantees regarding the security and confidentiality of the processing carried out, including to prevent Personal Data from being destroyed, altered, damaged or disclosed to third parties without authorisation.
Lovys undertakes to comply with, and to ensure that the third parties described in the section “Is your Personal Data shared with third parties?” comply with,
the following obligations:
- not to make any copies of the Personal Data entrusted, except those strictly necessary to provide the Services offered on the Lovys Platform and to perform the policy or policies taken out;
- not to use the Personal Data processed for purposes other than those provided for or agreed with you in this GDPR Policy;
- not to disclose Personal Data to persons not authorised to access it, whether private or public, natural or legal persons, unless required by law or regulation;
- to implement the measures necessary to prevent any misuse or fraudulent use of computer files;
- to implement the measures necessary to ensure the secure storage of the Personal Data processed throughout the contractual relationship;
- to pass on to any of its processors all the obligations incumbent upon it under the GDPR.
In addition, to limit the risk of your data being hacked, Lovys helps you manage your password. To this end, we have introduced a password policy based on the following principles:
- to create your password, Lovys asks for your email address in order to validate the creation of your account;
- the password you choose must be at least 8 characters long;
To keep access to your Lovys account secure, we recommend that you change your password at least once a year.
If you suspect that your password has been misappropriated or used without authorisation, please reset your password and notify Lovys without delay by email, chat or phone.
What are your rights under the GDPR?
In accordance with applicable regulations, you have rights over your Personal Data, in particular:
- a right to information: you are entitled to clear information about how your Personal Data is used and how to exercise your rights;
- a right of access: you can request access to the Personal Data concerning you and ask for a copy of it;
- a right to rectification and erasure: you can request the rectification, updating or erasure of all or part of your Personal Data; and
- a right to object: you can object to the processing of your Personal Data, subject to Lovys’s legal or contractual obligation to carry out such processing in order to provide its Services and/or fulfil its legal and contractual obligations.
To exercise your rights, or to find out more about them, you can contact our Data Protection Officer:
- by post: Lovys – Data Protection Officer (DPO), 5 rue Pleyel – 93200 Saint-Denis, France
- by email: dpo@lovys.com
Your request will be processed within a maximum of 1 month, which may be extended by the same period where applicable. Lovys reserves the right to ask you for a copy of proof of identity to verify your personal interest in exercising your rights, unless your identity is sufficiently established; this copy will be kept solely for this purpose and only for as long as it takes to process your request.
If you consider that Lovys is not complying with its Personal Data protection obligations or is not responding satisfactorily to your requests, you can lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, the French data protection authority) via its website (www.cnil.fr) or by post: CNIL, Service des Plaintes, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
