Privacy Policy

• Concluding and managing the insurance policy and, if a covered event occurs, adjustment and settlement of the claim, managing reinsurance and handling complaints.

o All the data you provide when taking out products and throughout your relationship with AXA, including health data for managing covered events, are necessary for the conclusion and management of your insurance contract and associated services. The lawful basis is managing and concluding the insurance contract applied for and to which you are a party (Article 6(1)(b) GDPR). Also for compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR and section 8(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December in connection with insurance industry regulations, the Insurance Contract Act 50/1980 of 8 October.

• Performing risk assessments, selections, checks and pricing to calculate the premium for your insurance policy, including the option of remote claims assessment for motor and home products.

o The lawful basis is implementation of contractual measures at your request (Article 6(1)(b) GDPR) and compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR and section 8(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December in connection with the insurance sector’s own regulations, the Insurance Contract Act 50/1980 of 8 October, which requires insurers to gather the information needed to assess risk and set premiums.

o This pricing and risk assessment process may be carried out by automated processes, including profiling, using artificial intelligence (for remote claims assessment) and by statistical and actuarial analysis to establish your risk profile. However, in cases where we use automated processes you have the right to obtain human intervention on the part of AXA to assess your situation, to express your point of view and to contest the decision if you are not happy with it. AXA also regularly checks its methods for calculating the insurance premiums it offers to customers to ensure they remain fair, effective and unbiased. We apply an algorithm to this information which tells us the risk associated with your insurance.

o We may additionally view the information in our databases and those of other AXA Group organisations on the basis of AXA’s legitimate interest in performing checks which enable us to ascertain the risk in relation to the information provided by you, any derived from previous relationships with AXA Group organisations and the product you have asked for.

o Likewise, we also view the information in our databases and those of other AXA Group organisations specifically concerning identification data and socio-demographic information on the basis of AXA’s legitimate interest in keeping your data up to date and ensuring their accuracy while maintaining the necessary quality derived from previous relationships with AXA Group organisations and the product you have taken out.

• Carrying out relevant verifications and checks to evaluate any potential fraud at the time of taking out the policy, including remote claims assessment and viewing credit reporting files, as well as verifying the ownership of the bank account in relation to the recipients of benefit payments.

o The lawful basis is compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR and section 8(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December in connection with the insurance sector’s own regulations, the Insurance Contract Act 50/1980 of 8 October. In order to prevent harm and adverse consequences for you, we have put in place technical and organisational measures to enhance the confidentiality and security of this information and comply with a legal obligation, in particular sections 66 and 100 of the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 of 14 July, and the Anti-Money Laundering and Counter-Terrorist Financing Act 10/2010, in relation to identifying, measuring and assessing risk and preventing fraud.

o For this purpose and as per AXA’s internal policies, we analyse whether there have been any defaults or irregular activities in relation to AXA and other organisations by viewing common credit reporting and referencing files and common fraud management and prevention files. We also carry out checks to verify the ownership of the bank accounts into which benefit payments are made in relation to the recipients of those benefits.

o Furthermore, in relation to the above basis AXA is covered by a legitimate interest in preventing fraud and avoiding inappropriate actions which might lead to financial or reputational harm.

• In life and pensions, conducting the relevant checks and verifications to assess anti-money laundering and counter-terrorist financing measures.

o The lawful basis is AXA’s compliance with its legal obligations as a regulated entity under the Anti-Money Laundering and Counter-Terrorist Financing Act 10/2010 of 28 April, and accordingly it will verify personal data and report them to the relevant authorities as required by this legislation.

o Furthermore, in relation to the above basis AXA is covered by a legitimate interest in preventing money laundering and avoiding inappropriate actions which might lead to financial or reputational harm.

• Profiling for actuarial and market research purposes.

o The lawful basis is the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 of 14 July and the performance of the insurance contract. AXA may view common files covered by codes of conduct in the insurance industry to compile profiles for statistical and actuarial purposes required to determine the risk and premium of the insurance contract, both prior to taking out the policy and during its term, based on your new personal circumstances or a change in the actuarial technical basis.

• Conducting quality or opinion surveys.

o The lawful basis is AXA’s legitimate interest in monitoring the quality of its services and assessing customer satisfaction. AXA may contact you by any means or channel that you have approved to ask for your rating of the products and services offered and/or purchased and analyse this information in order to enhance our services.
The purpose of this processing is to tailor our operations and the products and services we offer to your preferences and expectations with a view to improving the quality of the service we deliver and hence we need your feedback.
You may refuse to give your rating at any time and also tell us that you do not wish to be contacted again for this purpose.

• Sending information or advertising, offers and promotions, gifts and loyalty campaigns or any other marketing activities (including marketing profiling for this purpose) by post, email, phone, text message or other equivalent electronic means as well as via social media platforms (of which you are a user) about our own insurance products and services and also insurance and financial products and services provided by AXA Seguros Generales, S.A. de Seguros y Reaseguros, AXA Aurora Vida, S.A. de Seguros y Reaseguros, AXA Pensiones S.A., EGFP, Bidepensión EPSV and Winterthur EPSV. We may send marketing messages even after the end of the business relationship if you agree.

o The lawful basis is AXA’s legitimate interest in sending marketing messages by post, email, phone, text message or other equivalent electronic means or on social media platforms in the terms described.  The Information Services Society Act allows the provider to send marketing messages relating to products or services of its own company which are similar to those initially taken out by the customer.
o You may at any time object to the processing of your data for this purpose free of charge and unsubscribe from these messages in every electronic message you receive. The “Rights” section of this Policy also describes how to unsubscribe from this type of messages.

o Likewise, on the basis of its legitimate interest pursuant to Article 6(1)(f) of the GDPR, to perform this processing AXA has conducted a balancing exercise between the data subject’s fundamental rights (right to data protection, right of good reputation and to personal and family privacy) and AXA’s own legitimate interests and has concluded that these rights are not affected. We also believe that as a customer, you have a reasonable expectation that we will send you marketing information which may be of interest to you based on your customer profile without this entailing any infringement of your rights and interests. We profile you based on your personal characteristics (such as your sex, age or socio-economic data) and information obtained from your actions as a user and especially the products you purchase. Information relating to your profile will be handled securely and confidentially and only processed in systems which analyse the information obtained automatically.
You may also tell us at any time that you object to this processing and refuse to accept it.

• Profiling you for analytical purposes and for audience targeting associated with AXA’s business processes based on the information provided as part of the insurance proposal. This process means we can learn about your browsing behaviour after you have accepted our Cookie Policy, tell you about offers which are best suited to you based on your user profile and get new pricing variables which may be inferred from your purchasing and consumer habits to let you know about new services or covers associated with the product you have taken out, including for this latter purpose data and information supplied by third parties.

o The lawful basis for profiling you for analytical purposes is your consent by allowing AXA to profile you based on your personal characteristics, your browsing information, information compiled about your needs or preferences you share when purchasing products and information gathered from third parties depending on your spending patterns.

o    The lawful basis for profiling you for audience targeting is AXA’s legitimate interest, allowing AXA to profile you based on your personal characteristics, your browsing information, information compiled about your needs or preferences you share when purchasing products and information gathered from third parties depending on your spending patterns.

o This purpose meets the need based on the analyses performed to provide you with product management which is better tailored to your actual needs, including better pricing and a service proposition associated with the product you have taken out. Information relating to your profile will be handled securely and confidentially and only processed in systems which analyse the information obtained automatically.
You may also tell us at any time that you object to this processing and refuse to accept it.

• In health, helping you find your nearest medical centre or specialist. To use the Health Medical Provider Network Finder’s location service, you can allow access to your current location to receive a list of the medical centres closest to you at the time of your query.

o The lawful basis is your consent by voluntarily allowing access to your location. Alternatively, you can also access the Health Medical Provider Network Finder’s location service without sharing this information by manually entering your postcode and province.

You can disable this feature in your browser settings, thereby withdrawing your permission to share your location.

2.5 If you are an intermediary contacting us by phone about the handling and processing of a claim involving your customer portfolio, including personal injury claims, AXA will process the data you provide for the following purposes:

• Managing and processing your request relating to your customer portfolio, assessing and settling personal injury claims and handling enquiries and complaints.

• All the data you provide throughout your relationship with AXA, including health data for handling claims, are necessary for concluding and managing the insurance contract of your customer portfolio and associated services. The lawful basis is managing and concluding the insurance contract applied for and to which the customer is a party (Article 6(1)(b) GDPR). Also for compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR and section 8(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December in connection with insurance industry regulations, the Insurance Contract Act 50/1980 of 8 October.

2.6 If you are a professional, supplier or any other third party contacting us by phone about the handling and processing of a personal injury claim, AXA will process the data you provide for the following purposes:

• Managing and processing your personal injury claim to assess and settle it along with handling applications, enquiries and complaints.

• All the data you provide throughout your relationship with AXA, including health data for handling claims, are necessary for managing the customer’s insurance contract and associated services. The lawful basis is managing and concluding the insurance contract applied for and to which the customer is a party (Article 6(1)(b) GDPR). Also for compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR and section 8(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December in connection with insurance industry regulations, the Insurance Contract Act 50/1980 of 8 October.

2.7 If you are a professional or supplier contacted by phone to conduct a quality or opinion survey, AXA will process the data you provide for the following purposes::

• Gathering your individual feedback and level of satisfaction with a view to improving the quality of the service provided to customers through AXA’s suppliers.

o The lawful basis is our legitimate interest in connection with the service agreement entered into with you in monitoring the quality of the services and assessing supplier satisfaction. AXA may contact you by any means or channel to ask for your individual rating and feedback on the services provided and analyse this information in order to enhance those services.
The purpose of this processing is to tailor our operations and the products and services we offer to customers’ preferences and expectations with a view to improving the quality of the service we deliver and hence we need your feedback.
You may refuse to give your rating at any time and also tell us that you do not wish to be contacted again for this purpose.

2.8 If you are an injured party contacting us by phone about the handling and processing of a personal injury claim, AXA will process the data you provide for the following purposes:

• Managing and processing your personal injury claim to assess and settle it along with handling enquiries and complaints.

• All the data you provide throughout your relationship with AXA, including health data for handling claims, are necessary for managing the customer’s insurance contract and associated services. The lawful basis is managing the insurance contract to which AXA’s customer is a party (Article 6(1)(b) GDPR). Also for compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR and section 8(1) of the Personal Data Protection and Digital Rights Safeguards Act 3/2018 of 5 December in connection with insurance industry regulations, the Insurance Contract Act 50/1980 of 8 October, the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 of 14 July, and Act 35/2015 of 22 September enacting the new road traffic accident compensation scale.

2.9 If you enter AXA’s premises, AXA will process your image for the following purpose:

• Managing building access control and other surveillance and security operations.

o This processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller pursuant to Article 6(1)(e) of the GDPR, in conjunction with the Private Security Act 5/2014 of 4 April.

2.10 If you report an irregularity or inappropriate behaviour via the whistleblowing channel, AXA will process your data for the following purpose:  

• Processing, investigating and resolving the complaint received via the whistleblowing channel.
The lawful basis is the complainant’s consent to the processing of their personal data when they submit a report via one of the whistleblowing channels that makes it possible to identify the complainant.

Also compliance with our legal obligations set out in Act 2/2023 of 20 February on the protection of people reporting regulatory infringements and the fight against corruption.

3. DATA CATEGORY

• Data provided directly by you in the form or by phone:

All the information in the data categories shown is specified in detail in the pricing and purchasing process; specifically:

o Identifying information.

o Contact information.

o Socio-demographic data.

o Socio-cultural data.

• Data provided by you in other channels or ways:

o Data on behaviour and interaction between the parties:

 Social media data which you have provided directly to AXA.

 Website browsing or mobile app data through cookies or other data storage and retrieval devices: information gathered from your browsing if you have accepted our use of cookies and similar technologies on your devices.

 Data about customer interaction and behaviour with the insurer: answers to quality surveys, complaints and recommendations.

 Customer transaction data disclosing information about financial transactions and product and service history.

Financial data for verifying customers’ bank account ownership.

• Data derived from the relationship between AXA and you taken from third party sources:

o Financial and credit standing data: information gathered from credit reporting and referencing files.

o Data from files covered by standard insurance industry codes.

o Viewing third party databases, including data from official registers relating to the insured product.

• Data derived from the complaint submitted via the whistleblowing channel:

o Identifying details of the complainant and, where applicable, the person against whom the complaint is made.

o Personal data or images submitted alongside the complaint.

• In addition, and depending on the type of insurance you have expressed an interest in, AXA will process the following data categories:

o For home insurance

 Details and/or photographs of the property to be insured

o For motor insurance

 Details and/or photographs of the vehicle to be insured

 Driving licence details

 Information on administrative offences: viewing third party databases, including data from official journals and gazettes.

 Health information in the event of personal injury claims.

 Data on behaviour and interaction between the parties involved in a claim made during the policy term: social media data or information that has been made publicly available as part of a fraud prevention investigation.

o For health insurance

 Data on your state of health.

 Geolocation data, used solely to determine your location in relation to the intended purpose of the Health Medical Provider Network Finder.

o For life insurance

 Data on your state of health.

o For temporary work disability insurance.

 Data on your current and future state of health.

o For travel assistance insurance

 Health data in the event of personal injury claims.

4. RECIPIENTS OF PERSONAL DATA

4.1. For all types of insurance.

Personal data will not be shared with third parties except in the following cases:

• In pricing and purchasing: to professional service providers such as loss adjusters and also to providers of technological services, databases and other services derived from the contractual relationship when required to fulfil the insurance contract.

• In purchasing: other insurance and reinsurance undertakings for the performance and management of the co-insurance and reinsurance contract.

• To public or private organisations related to the insurance industry for statistical/actuarial and fraud prevention purposes, risk selection and settling benefits.

4.2. For motor insurance and the fleet product during the purchasing process:

Likewise, pursuant to the legal authorisation in the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 of 14 July, AXA may transfer your data to the systems covered by standard insurance industry codes and to the following systems set up with insurers through the UNESPA business association:

• AXA will disclose historical data on policies and claims to the Motor Insurance Historical Information System for which it is a joint controller. Its purpose is to provide accurate and verified information about claims data at the time of underwriting the contract by sharing the information obtained through policies and claims in the last five years pursuant to the Motor Vehicle Liability and Insurance Act. You may exercise your data protection rights by contacting TIREA, ctra. Las Rozas - El Escorial km 0,3, Las Rozas, 28231 Madrid. You can find all other data protection information on the UNESPA (www.unespa.es) and TIREA (www.tirea.es) websites.

• AXA will report historical data on the number of claims related to your insurance or claims in which you have been involved to the Total Write-off, Theft and Fire Information System for which it is a joint controller. Its purpose is to enable automated identification of potential anomalies and risk of fraud, cooperate with law enforcement agencies by assisting with the investigation of potential crimes including theft and fraud related to insured motor vehicles, and to cooperate with CENTRO ZARAGOZA, law enforcement agencies, the Directorate General of Traffic and the insurer concerned in identifying and locating stolen and indemnified vehicles. You may exercise your data protection rights by contacting TIREA, ctra. Las Rozas - El Escorial km 0,3, Las Rozas, 28231 Madrid. You can find all other data protection information on the UNESPA (www.unespa.es) and TIREA (www.tirea.es) websites.

4.3. For home insurance and for condominium, office and shops products during the purchasing process:

Likewise, pursuant to the legal authorisation in the Organisation, Supervision and Solvency of Insurers and Reinsurers Act 20/2015 of 14 July, AXA may transfer your data to the systems covered by standard insurance industry codes and to the following system set up with insurers through the UNESPA business association:

• AXA will disclose any claims data relating to your insurance and/or your claim to the Fraud Prevention Information System for Miscellaneous Insurance Lines of Business, including the insurance policy taken out by you or any claim in which you have been involved, and is the joint controller for the processing by this System. Its purpose is preventing and detecting fraud, either by advising the insurer once the policy has been issued or by detecting fraud in claims already made. Likewise, its purpose will also be to cooperate with law enforcement agencies by assisting in the investigation of crimes including theft and fraud related to the insured property. You may exercise your data protection rights by contacting TIREA, ctra. Las Rozas - El Escorial km 0,3, Las Rozas, 28231 Madrid. You can find all other data protection information on the UNESPA (www.unespa.es) and TIREA (www.tirea.es) websites.

5. INTERNATIONAL PERSONAL DATA TRANSFERS

AXA has adopted Binding Corporate Rules as an internationally recognised standard delivering appropriate protection in personal data handling in a multinational enterprise. These Rules have been endorsed by 16 European data protection authorities including the Spanish Data Protection Agency. They specify similar data protection policies for personal data gathered in the course of business when such data are to be transferred between the Group's companies. AXA has also made a number of data protection undertakings.

Your personal data may be disclosed to recipients in countries outside the European Economic Area, including countries which do not have a level of data protection equivalent to the one in the European Union. However, in these cases your data will be processed in scrupulous compliance with European and Spanish law and the safeguards shown below will also be implemented:

Recipient category: AXA Group companies, for example AXA Business Services Pvt. Ltd. Country: India; Safeguard: Binding Corporate Rules. You can see them here.

Recipient category: Technology and marketing service providers Country: USA; Safeguard: Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (Text with EEA relevance) (2021/914/EU). You can see them here.

6. RIGHTS

As the data subject, you may write to AXA, Ejercicio de derechos de privacidad - Atención Cliente, calle Emilio Vargas, 6, 28043 Madrid, or email email buzon.lopd@axa.es, at any time to exercise the following rights:

• Right of access

You have the right to be told by AXA about whether or not we are processing your personal data, and if we are, to access such data and receive information including about the purposes for which they are being processed, the categories of data concerned, the recipients to which your data are disclosed and the expected retention period for the data.

• Right of rectification and erasure

You have the right to ask for erasure of personal data provided that the applicable legal requirements are met and also rectification of inaccurate data concerning you when among other reasons they are no longer required for the purposes for which they were gathered.

• Right to restriction of processing

In certain circumstances (for example if you contest the accuracy of your data during a period when we are verifying their accuracy) you can ask us to restrict our processing of your personal data and only process them for the purpose of exercising or defending legal claims.

• Right to withdraw consent

You also have the right to withdraw your consent at any time.

• Right to object in whole or in part to processing.

You have the right to object, on grounds related to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interest or the legitimate interest of a third party (including processing whose purpose is direct marketing and profiling). In this case, AXA will no longer process the personal data unless we demonstrate compelling legitimate grounds.

• Right to data portability

You have the right to receive the personal data which you have provided to AXA in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which your personal data have been provided in the legally specified cases.

• Automated individual decision-making

In addition to the above rights, in cases of automated individual decision-making and profiling you have the right to obtain human intervention on the part of AXA and to express your point of view and to contest the decision.

• Other

Furthermore, when your personal data are transferred to a third country or an international organisation you have the right to be informed about how you can access or obtain a copy of the sufficient safeguards relating to the transfer. For any further queries or concerns about exercising your rights or about the processing of your personal data in general, please contact our Data Protection Officer at DPOAXA@axa.es

Finally, you have the right to make a complaint to a national (Spanish Data Protection Agency at C/Jorge Juan, 6, 28001 Madrid, or phone no. 912663517) or regional supervisory authority.

If you do not wish your phone conversations to be recorded, please complete the following form for your request. Please provide all the information we ask you for in the form to ensure that we can attend to your request properly. 

7. SOURCE

7.1. In the pricing stage

For all types of insurance:

Along with the information which you provide us yourself (for example through forms, your policy application, etc.), we will also gather information about your browsing habits if you agree. We will additionally access credit reporting and referencing files to compile information about your creditworthiness. Likewise, we will view files covered by standard insurance industry codes for risk assessment and fraud prevention purposes. For home and motor insurance, we will also obtain data published by the official registers relating to the insured product.

If the data provided relate to people other than the policyholder/insured, the insured warrants that they have informed the person or people concerned about and obtained their prior consent to the processing of their data for the purposes set out in the policy.

For health, life and motor insurance:

If the data relate to other people, and specifically to minors or legally incapacitated persons where the policyholder/insured is not the legal representative of the minor or legally incapacitated person, they warrant that they have the specific consent of such representative prior to the signing of this agreement.

7.2 In the purchasing stage:

For all types of insurance:

Along with the information which you provide us yourself (for example through forms, your policy application, photographs of the vehicle or property for remote claims assessment, etc.), we will also gather information about your browsing habits if you agree. We will additionally access credit reporting and referencing files to compile information about your creditworthiness. Likewise, we will view files covered by standard insurance industry codes for risk assessment and fraud prevention purposes.

If the data provided relate to people other than the policyholder/insured, the insured warrants that they have informed the person or people concerned about and obtained their prior consent to the processing of their data for the purposes set out in the policy.

For health, life and motor insurance:

If the data relate to other people, and specifically to minors or legally incapacitated persons where the policyholder/insured is not the legal representative of the minor or legally incapacitated person, they warrant that they have the specific consent of such representative prior to the signing of this agreement.

For motor insurance:

In motor insurance, we will also gather information about you from the following sources:

• Websites containing information that the applicant has made publicly available (in particular on social media) for fraud prevention purposes.

• Data relating to administrative offences published in official journals and gazettes from third-party databases.

For home and temporary work disability insurance, we will also obtain data published by the official registers relating to the insured product.

8. RETENTION PERIODS

The retention period for your personal data processed by AXA will depend on the stage of the process:

Pricing. Putting together an insurance proposal (120 days from the date of the quote)

Pricing. Consent to receive advertising (two years if you have opted in to processing for the purpose of sending marketing messages)

Purchasing. (10 years from the termination of the policy or the last measure taken to handle a claim in accordance with the applicable period based on insurance contract regulations)

This period may be extended if you agree or if there is any special processing derived from the contractual relationship which remains in effect after such period.

Footage captured by CCTV systems will be retained for one month from the date of recording, except where it needs to be kept to provide evidence of the commission of actions threatening the safety of persons, property or facilities.

Personal data identifying the complainant which are submitted via the whistleblowing channel will be retained in the whistleblowing system for a period of three months from the date of submission.

Last update: October 2023