Privacy policy

When you:

access and use the website www.lovys.com and/or the Lovys mobile app (the “Lovys Platform”); and
read the available information about the insurance products offered on the Lovys Platform, request a free quote for the possible subscription of an insurance contract, subscribe to one of our products and/or services, and manage your insurance contracts and/or services online (the “Services”),

you entrust us with certain data and information, including data that identifies you or makes you identifiable (for example, name, email, copy of an identity document), which constitute “Personal Data”.

Lovys is committed to letting you use the Lovys Platform and the Services with confidence and to protecting your Personal Data.

This Privacy and Data Protection Policy (the “GDPR Policy”) tells you how we collect and process your Personal Data, and about our commitments and your rights in this area.

The current Lovys GDPR Policy is the one available on the Lovys Platform on the date you connect to it. Lovys may change it at any time, in particular to update it or to reflect changes in the regulations in force.

What does it mean for Lovys to be responsible for processing your Personal Data?

Lovys, a French simplified joint-stock company (SAS) with share capital of €2,036.79, registered with the Bobigny Trade and Companies Register under number 832028021, with its registered office at 5 rue Pleyel – 93200 Saint-Denis (France) (“Lovys”), is the “Data Controller” of the Personal Data collected and processed on the Lovys Platform and in the course of providing the Services. Within the meaning of the GDPR, Lovys determines the purposes and means of the processing of your Personal Data carried out in this context.

As such, Lovys undertakes to ensure the protection, security and confidentiality of the Personal Data processed, in accordance with the French Data Protection Act no. 78-17 of 6 January 1978 and the General Data Protection Regulation no. 2016/679 of 27 April 2016 (“GDPR”), and the opinions and decisions of the competent supervisory authorities.

What Personal Data can be collected on the Lovys Platform?

When you use the Lovys Platform, the Personal Data that Lovys collects and processes may include, in particular:

data about your identity, family and professional situation, and financial and asset situation;
data about your bank details;
data about the management of your insurance contract(s) with Lovys;
the data Lovys needs to meet its regulatory obligations, in particular in the fight against insurance fraud, money laundering and terrorist financing; and
your communication preferences and your connection data on the Lovys Platform (see our Cookie policy).

Why is Personal Data collected on the Lovys Platform? And for how long?

Lovys only collects your Personal Data for specific, explicit and legitimate purposes.

Lovys undertakes that your Personal Data collected in this context will only be processed for the purposes described below, and limited to what is strictly necessary and relevant for those purposes.

Each processing of Personal Data by Lovys is based on one of the legal bases provided for by the GDPR and described below.

In addition, Personal Data is only kept for as long as needed to achieve the intended purposes; a longer retention period is possible when it results from a legal or regulatory obligation Lovys is subject to.

To be fully transparent about the purposes of processing and the retention periods applied at Lovys, you will find an explanatory table below:

Management and performance of the insurance contract(s) taken out, including issuing contractual documents, managing claims and complaints, and providing cover

Processing is necessary for the performance of the insurance contract(s) subscribed to (Article 6.1 b) of the GDPR).

For the whole term of the contract(s) and an additional 24 months from the end of the contractual relationship.

Handling information requests sent by email or through our online chat tool

Processing is necessary for Lovys's legitimate interest, which is to answer requests for information about its Services (Article 6.1 f) of the GDPR).

36 months from your last contact.

Fight against insurance fraud, money laundering and terrorist financing

Processing is carried out in Lovys's legitimate interest (Article 6.1 f) of the GDPR) and to meet its legal or regulatory obligations (Article 6.1 c) of the GDPR).

Fight against insurance fraud: when an insurance fraud alert is raised, Personal Data is kept for no more than 5 years from the closing of the fraud file if the alert was qualified as “relevant”; it is deleted without delay when the alert is qualified as “not relevant”. Fight against money laundering and terrorist financing: the Personal Data processed is kept for the whole term of the contract(s) and 5 years from the end of the contractual relationship.

Communication and customer loyalty operations, or improving service quality (for example, offers of products and services from us and/or our insurance partners, satisfaction surveys, polls, loyalty programmes, etc.)

Processing may be necessary for Lovys's legitimate interest, which is to offer its clients new Services linked, complementary or similar to those already provided (Article 6.1 f) of the GDPR). In some cases, processing is based on the data subject's consent (Article 6.1 a) of the GDPR).

Personal Data about a prospect who is not a client is kept for 36 months from the date Lovys collected it or from the prospect's last contact. Personal Data about a client is kept for the whole term of the contract(s) and an additional 24 months from the end of the contractual relationship.

Recruitment

Processing is based on the consent of the person sending their application (Article 6.1 a) of the GDPR); processing may also be necessary to take steps before entering into a contract (Article 6.1 b) of the GDPR) and/or carried out in Lovys's legitimate interest (Article 6.1 f) of the GDPR) in contacting candidates.

For successful candidates: Personal Data is kept during the recruitment process and may be used for staff management purposes. For unsuccessful candidates: Personal Data is kept during the recruitment process. With the candidate's consent, their Personal Data may be kept for an additional 24 months.

Is your Personal Data shared with third parties?

When you use the Lovys Platform, Lovys undertakes to limit access to your Personal Data to the people who need to use it, in particular:

Lovys employees;
Lovys insurance partners;
Lovys co-distributors; and
Lovys subcontractors (including partners involved in managing claims and complaints).

Lovys never discloses Personal Data to third parties, unless: (1) disclosure is necessary for the performance of your insurance contract(s) with Lovys; (2) an administrative or judicial authority asks Lovys for disclosure; (3) disclosure is necessary to meet contractual, legal and/or regulatory obligations; (4) you request or authorise the disclosure.

Is your Personal Data transferred outside the European Union?

When Lovys transfers your Personal Data outside the European Union, Lovys undertakes to put in place all the safeguards needed to protect your Personal Data and to ensure it is processed in accordance with the GDPR.

How is your Personal Data protected?

Lovys requires its employees, partners, co-distributors and subcontractors (including partners involved in managing claims and complaints) to fully comply with the GDPR. This involves, in particular, written contractual guarantees on the security and confidentiality of the processing carried out, including to prevent Personal Data from being destroyed, altered, damaged or disclosed to third parties without authorisation.

Lovys undertakes to respect, and to ensure that the third parties described in the paragraph “Is your Personal Data shared with third parties?” respect, the following obligations:

not to make any copy of the Personal Data entrusted, except where strictly necessary to provide the Services offered on the Lovys Platform and to perform the contract(s) subscribed to;
not to use the Personal Data processed for purposes other than those intended or agreed with you in this GDPR Policy;
not to disclose Personal Data to people not authorised to access it, whether private or public, natural or legal persons, except where required by a legal or regulatory obligation;
to take the necessary measures to prevent any misuse or fraudulent use of computer files;
to put in place the necessary measures to ensure the secure storage of the Personal Data processed for the whole term of the contractual relationship;
to pass on to any subcontractors all the obligations they have under the GDPR.

In addition, to limit the risk of your data being hacked, Lovys helps you manage your password. As part of this, we apply a password policy based on the following principles:

to create your password, Lovys asks for your email address to confirm the creation of your account;
the password you choose must be at least 8 characters long;

To keep access to your Lovys account secure, we recommend changing your password at least once a year.

If you suspect your password has been misappropriated or used without authorisation, please reset your password and notify Lovys immediately by email, chat or phone.

What are your rights under the GDPR?

In accordance with the regulations in force, you have rights over your Personal Data, in particular:

a right to information: you are entitled to clear information about how your Personal Data is used and how to exercise your rights;
a right of access: you can ask for access to, and a copy of, the Personal Data concerning you;
a right to rectification and erasure: you can ask for all or part of your Personal Data to be corrected, updated or erased; and
a right to object: you can object to the processing of your Personal Data, subject to Lovys's legal or contractual obligation to carry out that processing in order to provide its Services and/or meet its legal and contractual obligations.

To exercise your rights, or to find out more about them, you can contact our Data Protection Officer:

by post: Lovys – Data Protection Officer (DPO), 5 rue Pleyel – 93200 Saint-Denis (France)
by email: dpo@lovys.com

Your request will be processed within 1 month at most, which may be extended by the same period if necessary. Lovys reserves the right to ask you for a copy of proof of identity to check your personal interest in exercising your rights, unless your identity is sufficiently established; this copy will only be kept for this purpose and while your request is being processed.

If you believe that Lovys is not meeting its obligations on the protection of Personal Data or is not answering your requests satisfactorily, you can contact the French Data Protection Authority (CNIL) through its website (www.cnil.fr) or by post: CNIL, Service des Plaintes, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.