The private company under the corporate name “SMARTUP I.K.E.”, with distinctive title “Smartup”, registered under General Commercial Registry Number (G.E.MI.) 143257222000, VAT Number (A.F.M.) 800861613, having its registered office at 25is Martiou & Chaina 0, Chalkida, Municipality of Chalkideon, Evia, Postal Code 34100, hereinafter referred to as the “Company”, acts as the Data Controller and is committed to processing personal data in a lawful, fair and secure manner, in accordance with the applicable Greek and European legal framework, and in particular Regulation (EU) 2016/679 (GDPR).
This Privacy Policy is intended to inform every natural person dealing with the Company or using its services about the type of personal data collected, the purposes for which such data are used, the possible recipients, the retention period, the rights of data subjects and the protection measures applied.
The Company may collect personal data in particular in the following cases:
- when submitting an insurance application or a request relating to the amendment, cancellation, surrender or renewal of an insurance contract,
- when submitting a request for insurance benefits or reporting a claim,
- when participating in group insurance schemes,
- through the Company’s network of partners, employees and authorized persons,
- through service providers supporting the delivery of services,
- through the Company’s website, when the user voluntarily enters data in a contact form or request,
- in the context of promotional activities, where permitted by law,
- when using electronic access, identification and account security services.
Where the processing concerns special categories of data, such as health data, such processing takes place only where a lawful condition under Article 9 GDPR applies and, where required, after obtaining the explicit consent of the data subject. By contrast, for insurance-related activities that do not involve sensitive personal data, consent is not always required where processing is necessary for the conclusion or performance of the relevant contractual relationship.
1. Core principles of processing
The Company organizes the processing of personal data on the basis of the following principles:
- personal data are collected for specific, explicit and lawful purposes,
- processing is limited to the data strictly necessary for each purpose,
- efforts are made to ensure that data remain accurate, updated and appropriate,
- data are not retained longer than necessary,
- technical and organizational safeguards are implemented in order to protect data against loss, alteration, unauthorized access or any other unlawful use,
- where processing is based on consent, such consent is obtained only after adequate information has been provided to the data subject.
The Company does not deal directly with minors. If data relating to a minor need to be processed, this is done only through the persons exercising parental responsibility and only for purposes connected with a lawful or contractual relationship.
2. Categories of data that may be processed
Depending on the case, the Company may process the following categories of personal data:
a) Identification data
First name, surname, father’s name, date of birth, identity card number, passport number, social security number, VAT number and any other information required to identify the individual.
b) Contact details
Residential or business address, mailing address, email address, landline and mobile telephone numbers.
c) Payment and financial data
Bank account details, payment information, financial data and any other information required for billing, payment or servicing the insurance relationship.
d) Insurance-related data
Data necessary for risk assessment, the conclusion, renewal, amendment and support of the insurance contract.
e) Claims and settlement data
Information submitted in the context of compensation claims, insurance benefit requests, surrender requests or similar procedures.
f) Medical data
Where required for insurance purposes and permitted by law, the Company may process health data, medical questionnaires, examination results or information collected during the claims handling process.
g) Publicly available information
Information obtained from public sources, registries or databases, where this is lawful and necessary.
The above data may be kept in paper form, electronic systems or other secure means of record-keeping.
In addition, within the framework of insurance assessment, insurance companies or other lawful recipients may use automated processing methods in order to assess risk, categorize insurance applications and calculate terms or premiums. In such cases, the data subject may request information, clarifications or a review of the outcome, in accordance with the applicable legal framework.
3. Purposes of processing
The Company may process personal data for one or more of the following purposes:
- to assess an insurance request,
- to evaluate risk and determine the appropriate insurance product,
- to transmit information to insurance companies for the examination or conclusion of an insurance relationship,
- to conclude, administer, renew, amend or terminate insurance contracts,
- to manage claims, benefits, compensation or other insurance-related entitlements,
- to handle requests, complaints and communications with the customer or partner,
- to carry out payments and financial settlements,
- to protect the security of systems, transactions and the proper operation of the Company,
- to prevent fraud and deal with malicious use incidents,
- to comply with tax, accounting, insurance and other regulatory obligations,
- to respond to requests from administrative, judicial or independent authorities,
- to carry out informational or promotional activities, where the required legal basis exists.
The Company may disclose personal data only where lawful and necessary, in particular to:
- insurance companies,
- other insurance intermediaries,
- IT and technical support providers,
- hosting or system management providers,
- accountants, auditors, lawyers, doctors, loss adjusters or investigators,
- archive management, storage or courier companies,
- public, judicial, administrative or independent authorities, where disclosure is required by law.
If it becomes necessary to transfer personal data outside Greece or outside the European Economic Area, such transfer is carried out only in accordance with Articles 44 et seq. of the GDPR and only where an adequate level of protection is ensured or appropriate safeguards are in place, as required by law.
6. Data retention period
Personal data are retained for as long as required to serve the purpose for which they were collected and, in any case:
- for up to five (5) years following the termination of the insurance contract,
- for up to one (1) year if the insurance contract is not concluded,
- for a longer period where required due to pending judicial or administrative proceedings or other legal obligations.
7. Rights of data subjects
Each data subject has, as applicable, the following rights:
- the right of access to personal data,
- the right to rectification of inaccurate or incomplete data,
- the right to erasure, where permitted,
- the right to restriction of processing,
- the right to data portability for data provided by the subject,
- the right to object,
- the right to withdraw consent, where processing is based on consent.
If the data subject believes that data protection law has been violated, he or she also has the right to lodge a complaint with the Hellenic Data Protection Authority.
The Company makes every effort to respond to such requests within thirty (30) calendar days.
8. Company obligations and security measures
The Company implements appropriate physical, organizational and technical safeguards for the protection of personal data.
Processing is carried out only by persons authorized for that purpose and bound by confidentiality obligations.
In addition, the Company takes measures for:
- access control to information systems,
- protection against unauthorized use,
- prevention of data loss or destruction,
- detection of security incidents,
- safeguarding the integrity and confidentiality of information.
Where considered necessary for the protection of persons, premises and property, the Company may operate closed-circuit television systems in accordance with the requirements of the applicable legislation.
10. Updates to this policy
This Policy may be amended, updated or supplemented whenever required by legislation, the Company’s operations or compliance needs. The current version is published on the Company’s website.