• Identity and contact information: Name; residential address; email address and phone number; social security number or coordination number; family relationship with the policyholder, the insured or the injured party.
• Demographic data: Age; date of birth, gender; marital status; family status.
• Administrative insurance information: Insurance number; Claim number; the scope and amount of the insurance; beneficiaries; type of insurance and premiums paid.
• Information about insured property/objects: Property address; vehicle registration number; IMEI number and other object identification; place of insured object; details of travel arrangements (in the case of travel insurance).
• Information on insured persons: Co-insured; age category of co-insured or insured persons; relationships between insured persons; employment relationship; other insurance policies that you hold; membership in organisations or unemployment insurance fund.
• Financial date: Bank account number; debit card number; bank account details, billing address; credit history and credit score; assets; income; information about loans and credits covered by the insurance.
• Claims data: Information about the damage that has occurred; information about previous damages; types of injuries; course of injury; reported events, beneficiaries benefiting from the damage.
• Anti-fraud and financial sanctions checks: Information for the detection, investigation, prevention and reporting of insurance fraud, including identity data, insurance and claims information, data from other insurance companies, investigation materials, financial data, technical logs, and information obtained from external sources.
  Information required for checks against national and international sanctions lists as well as documentation of any matches and subsequent investigation.
• Special categories of personal data (sensitive data): Health data such as current or past physical, mental or medical conditions, as well as medical history and trade union membership (for example if you apply for insurance through a trade union, or which is procured by a trade union)

Please do not disclose any personal information about yourself to us unless we have requested you to do so. Unsolicited personal data will be deleted.

 

We process sensitive personal data (such as health information or trade union membership) if it is necessary for the establishment, exercise or defence of a legal claim.

Sensitive personal data will only be used for the purposes set out in section 3 below.

 

The information you provide to us or that we receive from third parties is generally necessary to enter into a contract with us and to enable us to perform our contractual obligations to you, while some of the information we collect may also be necessary for other purposes. See further details below:
 

Categories of personal data	Purpose (purpose of processing)	Legal basis
Identification and contact information	Calculate insurance premiums, offer, grant and administer insurance, offer renewal of insurance, inform about changes in the insurance.	Performance of contracts or preparatory measures for such contracts.
	Handle complaints.	Fulfill legal obligation that is incumbent on ANV.
	Improve our products, develop new systems and processes.	ANV's legitimate interest.
	Validate/confirm your identity.	Performance of contracts or preparatory measures for such contracts.
	Conduct customer satisfaction surveys of your experience with our services or products, via email, text message, phone or through other communication channels.	ANV's legitimate interest in being able to carry out customer satisfaction surveys.
	Answer your questions via web form, email, mail, or phone.	Performance of contracts or preparatory measures for such contracts.
	Preventing, detecting, and investigating crime, including fraud.	Fulfil legal obligation that is incumbent on ANV.
	Comply with applicable laws and legal obligations (including laws outside your country of residence), such as those relating to terrorism or financial sanctions.	Fulfil legal obligation that is incumbent on ANV.
	If you are a contact person for a supplier, partner or policyholder: Administer and fulfil agreements with suppliers (your employer) or policyholder.	Performance of contracts or preparatory measures for such contracts.

 

Categories of personal data	Purpose (purpose of the processing)	Legal basis
Demographic data	Calculate insurance premiums, offering, granting and administering insurance, offering insurance renewals,	Performance of contracts or preparatory measures for such contracts.
	Improve our products, develop new systems and processes.	ANV's legitimate interest in being able to carry out customer satisfaction surveys.
	Handling complaints.	Fulfill legal obligation that is incumbent on ANV.
Administrative insurance information	Calculate insurance premiums, offer, grant and administer insurance, offer renewal of insurance, inform about changes in the insurance.	Performance of contracts or preparatory measures for such contracts.
	Handling complaints.	Fulfill legal obligation that is incumbent on ANV.
Information about insured property/objects	Calculate insurance premiums, offer, grant and administer insurance, offer renewal of insurance, inform about changes in the insurance.	Performance of contracts or preparatory measures for such contracts.
	Handling complaints.	Fulfill legal obligation that is incumbent on ANV.
Financial data	Calculating premiums, offering, granting and administering insurance, offering insurance renewals.	Performance of a contract or preparatory measures for such an agreement.
	Handling complaints.	Fulfill legal obligation that is incumbent on ANV.

 

Categories of personal data	Purpose (purpose of the processing)	Legal basis
Claims data	Calculate premiums and administer insurance.	Performance of contracts.
	Handling Complaints	Fulfill legal obligation that is incumbent on ANV.
Sensitive information	Offer, grant and administer insurance.	The processing is necessary for the establishment, exercise or defence of legal claims. For example, to determine your right to take out insurance.
	Handling Complaints	The processing is necessary for the establishment, exercise or defence of legal claims.
	Detect, prevent and investigate fraud.	The processing is necessary for the establishment, exercise or defence of legal claims.
Anti-fraud and sanctions control tasks	Detect, prevent and investigate fraud. Perform checks against financial sanction lists.	Fulfill legal obligation that is incumbent on ANV.

Claims settlement is carried out on behalf of the relevant insurer. In connection with these assignments, the claims settlement company processes personal data in accordance with instructions from the insurer and thus acts as a personal data processor for this processing. The processing only includes the data necessary for the investigation, assessment and settlement of the claim in accordance with the insurance contract. All processing takes place in accordance with applicable data protection legislation and entered into personal data processing agreements.

 

Where it is necessary for us to be able to offer our services, we share your personal data with companies that act as data processors for us. A data processor is a company that processes the information on our behalf and in accordance with our instructions.

Examples of such data processors are:

1. a)  Claims Adjusters – Third-party claims administrators; claims investigators and claims adjuster
2. b)  T Service Providers – Systems, Support, Hosting Providers and IT Consultants
3. c)  Analytic companies – Customer survey & Analytics Service Providers
4. d)  Financial companies – Card acquirers, banks and payment service providers
5. e)  Insurance Administrators - Insurance Administrator
6. f)  Service providers – repair centres and providers of services such as customer satisfaction monitoring.
7. When your personal data is shared with data processors, it is only for purposes that are compatible with the purposes for which we have collected the information (e.g. to be able to fulfil our obligations under insurance contracts). We have entered into written agreements with all data processors through which they guarantee the security of the personal data being processed and undertake to comply with our security requirements as well as restrictions and requirements regarding the international transfer of personal data and as applicable under applicable data protection legislation.

8. 5.2 Independent data controllers

   We also share your personal data with certain companies, authorities and organisations that are independent data controllers. The fact that these companies, authorities and organisations are independent data controllers means that we do not control how the information provided to the company is to be processed.
9. Examples of independent data controllers with whom we share your personal data are:
10. a)  Distribution Partners – Insurance intermediaries and tied insurance intermediaries; business partners and agents; re-insurers; other types of distributors and administrators.
11. b)  Insurance company – ANV will disclose personal data to the insurance company that is the insurer of your policy.
12. c)  Service providers – External service providers such as business and credit information companies, accountants, actuaries; auditors, experts, lawyers and other third-party professional advisors; fraud detection providers; banks and financial institutions.
13. d)  Government and other public authorities or bodies - ANV may disclose personal data to government and other public authorities (including, but not limited to, regulators, courts, police, tax authorities and criminal investigation authorities) as well as to bodies to which we are required to disclose information by law.
14. When your personal data is shared with a company, authority or organisation that is an independent data controller, the privacy policy of that company, authority or organisation applies.

15. 5.3 International transfer of personal data

    We always strive to process your personal data within the EU/EEA. In some cases, however, data may be transferred to parties in countries outside the EU/EEA (so-called third countries). When a transfer to a third country takes place, we ensure that the protection of your data corresponds to the level that applies within the EU/EEA.
16. Some countries have been assessed by the European Commission as having a so-called adequate level of protection, which means that the country's regulations provide sufficiently strong protection. You can read more about this on the Swedish Authority for Privacy Protection's website, www.imy.se.
17. If your data is transferred to a country that does not have an adequate level of protection, we use both contractual, technical and organisational security measures to protect it. We use, among other things, the European Commission's Standard Contractual Clauses (SCCs), which impose requirements on both us and the receiving party. These clauses regulate, among other things, how data may be processed and how your rights under the General Data Protection Regulation are ensured. More information can be found on the Swedish Authority for Privacy Protection's website, www.imy.se.
18. ANV transfers personal data to the United Kingdom, the United States and Israel.

We are responsible for ensuring that your personal data is used in accordance with the law and that you have the opportunity to exercise your rights. You can contact us at any time if you wish to exercise your rights.

We are obliged to respond to your request within one month of receiving your request. If your request is complicated or if a large number of requests have been received, we have the right to extend the time by another two months. If we believe that we cannot comply with your request, we are required to notify you within one month of receiving your request why we cannot do what you want us to do and inform you that you have the right to complain to the supervisory authority.

All information, communication and all actions we carry out are free of charge to you. However, if your request is manifestly unfounded or unreasonable, we have the right to ask for an administrative fee to provide you with the information or to implement the requested action, or to decline your request altogether .

You have the following rights in relation to our processing of your personal data:

(a)  Request a copy of personal data we hold about you - You can request an extract regarding the personal data we process about you.

(b)  Erasure of personal data – Under certain conditions, such as when you have withdrawn a previously given consent or when we no longer need to process your personal data, you have the right to request the deletion of your personal data. In some cases, we have the right to retain certain personal data despite requests for deletion, e.g. if we have a legal obligation to retain your personal data.

(c)  Rectification - You can request correction or deletion of incomplete or inaccurate personal data.

(d)  Restriction and object to future processing - Under certain conditions, you have the right to restrict the processing of your personal data to only include the storage of the personal data, e.g. during the time when ANV investigates whether you have the right to erasure pursuant to section (b) above. If the processing of your personal data is based on a balancing of interests and you assess that your privacy interest outweighs ANV's legitimate interest in processing your personal data, you have the right, on grounds relating to your specific situation, to object to the processing by contacting ANV at the contact details set out in section 10. If you object to the processing, ANV must demonstrate a compelling legitimate reason for continuing to process the personal data.

(e)  Right to data portability - Where the processing of your personal data is based on your consent or because the processing is necessary for the performance or conclusion of a contract with you, and provided that the personal data has been collected directly from you, you have the right to receive a copy of your personal data in a commonly used commonly used machine-readable format.

(f)  Rights in relation to automated decision-making, including profiling - You have the right not to be subject to fully automated decision-making, including profiling, if such decision-making produces legal effects or similarly significantly affects you. However, this right does not apply if the automated decision-making is necessary for the performance of a contract with you, if the decision-making is expressly permitted by law, or if you have given your explicit consent to this. More information on how we use automated decision-making can be found in section 8.

(g)  Complaints to supervisory authorities - You are welcome to contact us with any questions or complaints relating to the processing of your personal data. However, you also always have the right to lodge a complaint regarding the processing of your personal data with the data protection authority in your country of residence.
To exercise your rights as set out above, please write to the Data Protection Officer at the address set out below in section 10.

If we have entered into a contract with you, we will retain the data that is necessary for as long as we have obligations under the contract and for as long as you have the opportunity to make claims under the contract. This means that we will retain your personal data even after the contract has expired. In some cases, as long as the so-called limitation period runs, you can return with supplementary demands during the agreement. When the limitation period for the agreement then expires, our dealings are also fully settled. This means that we have personal data stored during the limitation period, which varies depending on which insurance policies we have agreed on (as a general rule for 10 years).

In summary, we must always retain information, including personal data, for as long as is necessary due to the agreements, laws and regulations that apply to our insurance business. We must retain personal data in connection with, among other things, legislation on, for example, accounting, insurance distribution, statutes of limitations and legislation on measures against money laundering and terrorist financing.

When the retention period has expired, your personal data is deleted or anonymized in accordance with our routines for deletion and anonymization.