Privacy and personal data protection policy

Last updated: -- 2022

When you:

• access and use the website www.lovys.com and/or the Lovys mobile app (the “Lovys Platform”); and

• look at the information about the insurance products offered on the Lovys Platform, request a free quote for an insurance contract, take out one of our products and/or services and manage your insurance contracts and/or services online (the “Services”),

you give us certain data and information, including data that identifies you or makes you identifiable (e.g. name, email, copy of an ID document), which constitutes “Personal data”.

Lovys is committed to letting you use the Lovys Platform and the Services with complete confidence and to protecting your Personal data.

This Privacy and Personal Data Protection Policy (the “GDPR Policy”) explains how we collect and process your Personal data, and our commitments and your rights in this respect.

You can access the Lovys GDPR Policy in force on the Lovys Platform on the date you connect to it. Lovys may change it at any time, in particular to keep it up to date or to reflect changes in the regulations in force.

What does it mean for Lovys to be the Controller of your Personal data?

Lovys, a simplified joint-stock company with share capital of €2,036.79, registered with the Bobigny Trade and Companies Register under no. 832028021, with its registered office at 12 rue Anselme – 93400 Saint-Ouen-sur-Seine (France) (“Lovys”), acts as “Controller” of the Personal data collected and processed on the Lovys Platform and in providing the Services. Within the meaning of the GDPR, it is Lovys that determines the purposes and means of processing your Personal data in this context.

In this respect, Lovys is committed to ensuring the protection, security and confidentiality of the Personal data processed, in accordance with French Law no. 78-17 of 6 January 1978 known as “Informatique et Libertés”, as amended, the General Data Protection Regulation no. 2016/679 of 27 April 2016 (“GDPR”), and the opinions and decisions of the competent supervisory authorities.

What Personal data can be collected on the Lovys Platform?

When you use the Lovys Platform, the Personal data Lovys collects and processes may include, in particular:

• data about your identity, family and professional situation, and your financial and asset situation;

your bank details;

data about the management of your insurance contract(s) with Lovys;

• data Lovys needs to meet its regulatory obligations, including fighting insurance fraud, money laundering and terrorist financing; and
• your communication preferences and your connection data on the Lovys Platform (see our Cookie policy).

Why is Personal data collected on the Lovys Platform? For how long?

Lovys only collects your Personal data for specified, explicit and legitimate purposes.

Lovys is committed to processing the Personal data collected in this context only for the purposes described below, and only to the extent strictly necessary and relevant to them.

Each processing of Personal data by Lovys is based on one of the legal bases set out in the GDPR and described below.

Personal data is kept only for as long as needed to achieve the purposes pursued; a longer retention period may apply where it results from a legal or regulatory obligation Lovys is subject to.

To be fully transparent about the purposes of processing and the retention periods applied at Lovys, here is an explanatory table:

Is your Personal data shared with third parties?

When you use the Lovys Platform, Lovys is committed to limiting access to your Personal data to the people who need to use it, namely:

• Lovys employees;
• Lovys's insurance partners;
• Lovys's co-distributors; and
• Lovys's subcontractors (including partners involved in handling claims and complaints).

Lovys will never disclose Personal data to third parties unless: (1) disclosure is necessary to perform your insurance contract(s) with Lovys; (2) an administrative or judicial authority asks Lovys to disclose it; (3) disclosure is necessary to meet contractual, legal and/or regulatory obligations; (4) you request or authorise its disclosure.

Is your Personal data transferred outside the European Union?

When Lovys transfers your Personal data outside the European Union, it is committed to putting in place all the safeguards needed to protect your Personal data and ensure processing complies with the GDPR.

How is your Personal data protected?

Lovys requires its employees, partners, distributors and subcontractors (including partners involved in handling claims and complaints) to fully comply with the GDPR. This means, in particular, written contractual guarantees on the security and confidentiality of the processing carried out, including to prevent Personal data from being destroyed, distorted, damaged or disclosed to third parties without authorisation.

Lovys undertakes to comply, and to ensure that the third parties described in “Is your Personal data shared with third parties?” comply, with the following obligations:

• not to make any copies of the Personal data entrusted to them, except those strictly necessary to provide the Services offered on the Lovys Platform and to perform the contract(s) taken out;
• not to use the Personal data processed for purposes other than those set out in or agreed with you under this GDPR Policy;
• not to disclose Personal data to people who are not authorised to access it, whether private or public, natural or legal persons, unless required by law or regulation;

• to put in place the measures needed to prevent any misuse or fraudulent use of computer files;
• to put in place the measures needed to store the Personal data processed securely for the duration of the contractual relationship;
• to pass on to any subcontractors all their obligations under the GDPR.

To limit the risk of your data being hacked, Lovys also helps you manage your password. We have set up a password policy based on the following principles:

• to create your password, Lovys will ask for your email address to confirm the creation of your account;
• the password you choose must be at least 8 characters long.

To keep access to your Lovys account secure, we recommend changing your password at least once a year.

If you suspect your password has been misappropriated or used without authorisation, you will be asked to reset it and to notify Lovys without delay by email, chat or phone.

What are your rights under the GDPR?

In accordance with the regulations in force, you have rights over your Personal data, in particular:

• a right to information: you receive clear information about how your Personal data is used and how to exercise your rights;

• a right of access: you can ask to access the Personal data concerning you and to receive a copy;
• a right to rectification and erasure: you can ask for all or part of your Personal data to be corrected, updated or deleted; and
• a right to object: you can object to the processing of your Personal data, without prejudice to Lovys's legal or contractual obligation to process it in order to provide its Services and/or meet its legal and contractual obligations.

To exercise your rights, or for more information, contact our Data Protection Officer:

• by post: Lovys – Data Protection Officer (DPO) – 5 rue Pleyel, 93200 Saint-Denis, France
• by email: dpo@lovys.com

Your request will be handled within 1 month at most, which may be extended by the same period where appropriate. Lovys reserves the right to ask you for a copy of an ID document to verify your personal interest in exercising your rights, unless your identity is already sufficiently established; this copy will only be kept for this purpose and while your request is being handled.

If you believe Lovys is not meeting its Personal data protection obligations or is not responding to your requests satisfactorily, you can contact the French data protection authority (CNIL) through its website (www.cnil.fr) or by post: CNIL, Service des Plaintes, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.