Luko by Allianz Direct deeply care about your personal data and your privacy. As a broker and an insurer, Luko by Allianz Direct may collect and process different type of personal data for which a good level of compliance and security is applied.
- We don’t sell your personal data : Luko by Allianz Direct is independant and don’t share your personal data to any third party without your consent. Also, Luko by Allianz Direct is vigilant to apply the minimization principle and collect only the strict necessary.
- We provide a high level of security : Luko by Allianz Direct is highly involved in implementing strong technical and organizational measures in order to provide a high level of security for its customer.
- We care about your privacy : During the creation of new product and features, Luko by Allianz Direct’s pay attention to implement Privacy-by-design and integrate GDPR principles from the beginning.
What is the GDPR and the key notion ?
- Personal data : any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly.
Eg : name, phone number, age, email address, IP address, job title… - Data processing : any operation or set of operations which is performed on personal data or on sets of personal data.
Eg : collection, storage, modification, extraction, erasure… - Data Controller : the entity who determines the means and the purposes of the processing.
Eg : Luko by Allianz Direct decides to collect your payment method for invoicing. - Data Processor or sub-processor : the entity that act on the behalf of the Data Controller.
Eg : AWS is the entity that store the personal data.
Who is the point of contact (Data Protection Officer) ?
The Data Protection Officer (DPO) is the internal point of contact for any issue related to the GDPR. He will be able to answer any question, to request the exercice of your rights.
You can reach out directly to him :
By email at the address: dpo@luko.eu.
By postal mail: Luko by Allianz Direct by Allianz Direct Versicherungs-AG (succursale France) - "Eurosquare 2", 7 rue Dora Maar, 93400 Saint-Ouen-sur-Seine
Who is the data Controller ?
The Data Controller is “Luko by Allianz Direct” who determines the purposes and the means of the data processing. Due to its insurance activity and depending on the product, Luko by Allianz Direct has several entity :
- Luko by Allianz Direct Insurance AG :
c/o WeWork
Neue Schönhauser Str. 3-5
10178 Berlin, Allemagne
Amtsgericht Charlottenburg (Berlin): HRB 188013 B
Soumis à la BaFin, Dreizehnmorgenweg 13-15, 53175 Bonn, Allemagne - Allianz Direct Versicherungs-AG/Succursale France :
Allianz Direct Versicherungs-AG/Succursale France is a Société de droit étranger with a capital of €819,200, registered with the trade and companies register of Bobigny under number 953 811 338. Operating under the brand Luko by Allianz Direct, Allianz Direct Versicherungs-AG/Succursale France is an insurance distributor.
What data are collected and processed ?
- Identification data : Name, Surname, gender, Date and place of birth
- Contact details : phone number, email address
- Professional data : socio-professional category
- Housing data : postal address, flat surface, type of housing, status of occupation
- Payment data : encrypted credit card number, IBAN
- Claim data : contract, pictures and video, the content the claim and any data needed to analyse the claim
- Internet data : logs, IP address, Geolocation points
- Health data related to your Mortgage : height, weight, total or partial work stoppage, total or partial work stoppage for the last 10 years, holder of a pension, annuity or allowance for incapacity for work, covered at 100% for medical reasons by a social security organization, under medical treatment of more than 21 days in the 5 last years, hospitalization in the last 10 years, condition or disease requiring medical supervision in the last 10 years, accident resulting in after-effects, a disorder of the spine or any other musculoskeletal disorder in the last 10 years, a neuropsychic affection or any other psychic and psychiatric affection in the last 10 years, positive result to test on hepatitis B and C viruses or on the human immunodeficiency virus (HIV),
- Loan data : Bank providing the loan, type of loan, total amount, rate, first deadline, co-borrower
- Lifestyle informations : smoker or not, practice of extreme sport, work position, high risk work, recent travel to a high risk country, politically exposed
What are the aim of the Processings and on what legal basis?
In order to provide its insurance services Luko by Allianz Direct may process data to put at your disposal different product and services. According to the GDPR, each processing relies on one of these 4 legal basis :
- Consent : Under the GDPR, consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Ex : If you would like to subscribe to Luko by Allianz Direct’s newsletter. - Performance of a contract and pre-contractual obligations : Luko by Allianz Direct may process your data in order to provide its insurance services and products, as well as to comply with pre-contractual obligations such as providing a quote adapted to your needs for your housing insurance.
Ex : When you are requesting a quote, Luko by Allianz Direct will send it to you via email. - Legal or regulatory obligations : Luko by Allianz Direct may process your personal data to comply with its legal or regulatory obligations, such as combatting money laundering, terrorist financing, and insurance fraud.
Ex : As a broker and insurer, Luko by Allianz Direct has the duty to fight against terrorism and verify your identity. - Legitimate interest of Luko by Allianz Direct while preserving your right to privacy : In order to offer you a high level of service and quality, Luko by Allianz Direct may process personal data while preserving your fundamental rights, such as you right to privacy.
Ex : Luko by Allianz Direct can keep the personal data you provided, if you would like to finish your quote another time.
General to all Luko by Allianz Direct’s insurance product (PNO, MRH, MRI, NVEI, Mortgage)
Providing a quote adapted to your needs for your housing insurance
Purpose
In order to provide a quote adapted to your needs, Luko by Allianz Direct may collect the following data to perform the highest level of service. Following the duty to provide the most appropriated price, Luko by Allianz Direct will lead continuously a review, acceptance, control and monitoring of risk.
Categories of personal data
- Identification data
- Contact details
- Data related to your housing
Legal basis
Execution of pre-contractual information
Retention period
3 years from the last proof of interest from you.
Management of your insurance contract
Purpose
During the lifetime of your insurance contract, Luko by Allianz Direct will process your personal data to execute its obligation and provide a good level of services, as defined in your General Condition. In application of your contract, your personal data will be processed to manage your claim.
Categories of personal data
- Identification data
- Contact details
- Professional data
- Housing data
- Payment data
Legal basis
Execution of the insurance contract
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Phone call to finalize your quote
Purpose
If you have consented, Luko by Allianz Direct can call you back in order to details the different offers to which you can be interested in.
Categories of personal data
- Identification data
- Contact details
- Contractual data
Legal basis
Consent
Retention period
- Duration of the contract and 5 years after its termination (article 2224 Civil code)
- Phone call will be stored for 2 years (Insurance code)
Management of your claim
Purpose
In application of your insurance contract with Luko by Allianz Direct you may have to report a claim in order to allow Luko by Allianz Direct to assess your claim and seek compensation. Then, these the data you provided will be analysed by the claim manager for the purpose of assessing your eligibility to be compensated.
During the analysis of your claim, you might have to provide further proof and any contextual element that could be helpful for the processing of your case. In this case you may use our in-house service video consultation called “Docteur House”.
Categories of personal data
- Identification
- Contact data
- Claim data
- Location data
- Internet data
Legal basis
Execution of the insurance contract
Retention period
- 2 years to contest the amount of your compensation
- 5 years for any kind of legal action undertaken against Luko by Allianz Direct
Send you tips and offer about Luko by Allianz Direct’s product, improve the quality of services
Purpose
During your onboarding and your lifetime at Luko by Allianz Direct you may receive tips and news offer about Luko by Allianz Direct’s product and partner’s offer that are similar to the one who have subscribed to.
Categories of personal data
- Identification data
- Contact details
- Type of insurance contract
Legal basis
- Consent of the prospect
- Legitimate interest of Luko by Allianz Direct to suggest similar product
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Management of the unpaid invoices
Purpose
Following your obligation set in your insurance contract, you have to pay the amount of money defined in the particular condition in order to benefit from the insurance cover from Luko by Allianz Direct. If you're not able to pay and you are liable to do so, Luko by Allianz Direct may engage a procedure to recover the missing funds.
Categories of personal data
- Identification data
- Contact details
- Payment data
Legal basis
Legitimate interest of Luko by Allianz Direct to recover the unpaid invoices
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
For the management and execution of the assistance contract (with Opteven, your assistant)
Purpose
Categories of personal data
- Identification data
- Contact details
- Professional data
- Housing data
- Payment data
Legal basis
Execution of the insurance contract
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Fight against fraud :
Purpose
Luko by Allianz Direct put all the measures at its disposal to analyze and detect act that can show an anomaly or inconsistency, management of this anomaly and inconsistency, constitution of liste of person suspected to have committed act of fraud.
Categories of personal data
- Identification data
- Internet data
- Contractual data
Legal basis
Legitimate interest of Luko by Allianz Direct to prevent fraud and miscellaneous behaviors on its Platform.
Retention period
Duration of the contract and 2 years after its termination.
Elaboration of statistics and actuarial studies :
Purpose
Insurance companies have to provide evidence on the appropriateness of the level of their technical reserves, as well as the the applicability and appropriateness of the methods and the appropriateness of the underlying statistical data the underlying statistical data they use.
Categories of personal data
- Housing data
- Contractual data
Legal basis
- Legitimate interest of Luko by Allianz Direct to comply with its own legal obligation and provide appropriate risk assessment
Retention period
Duration of the contract, after its termination the data are anonymised.
You have subscribed to Mortgage
Providing a quote adapted to your needs for Mortgage
Purpose
In order to provide an adapted quote for your subscription to Mortgage, Luko by Allianz Direct as a broker has the duty to analyse your personal situation to have a better understanding of your risk.
If the loan is above 200.000,00 €, in compliance with the new legal framework, Luko by Allianz Direct can ask your further information on your health status, as required by our insurance partner.Categories of personal data
- Identification data
- Contact details
- Professional data
- Housing data
- Payment data
- Health data related to your Mortgage
- Loan data
- Lifestyle informations
Legal basis
Contractual and pre-contractual obligations
Retention period
If the contract is not signed : 120 days from the creation of the Quote
If the contract is signed : 5 years from its termination
Interaction with Luko by Allianz Direct
Participating to marketing campaign and lottery
Purpose
During its promotional campaign, on social media and other support, Luko by Allianz Direct may process your personal data if you decide to participate to the market campaign and lottery.
Categories of personal data
- Identification data
- Contact details
- Picture, if relevant
Legal basis
- Legitimate interest of Luko by Allianz Direct to promote its product
- Execution of the lottery rules
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Creation of your personal account
Purpose
You can freely download the MyLuko application in order to benefit from the different services offered on the application.
Categories of personal data
- Identification data
- Contact details
- Internet data
Legal basis
Legitimate interest of Luko by Allianz Direct to provide a high level of services and enhance the app services
Retention period
3 years after the last connection of the user.
Measuring the satisfaction of our members
Purpose
In a quality approach, Luko by Allianz Direct is dedicated to provide the best services and willing to hear from its user. Thus, you can leave a comment and/or a grade about your satisfaction and your experience with Luko by Allianz Direct.
Categories of personal data
- Identification data
Legal basis
Consent
Retention period
the duration of your consent; You can withdraw your consent at any time and request the deletion of your personal data.
For audience measurement (analytics) and the smooth running of our Platform
Purpose
Luko by Allianz Direct will process your personal data to analyse your behaviour on the Platform and propose you the best services adapted to you special needs.
Categories of personal data
- Identification data
- Behavioural data
Legal basis
Legitimate interest of Luko by Allianz Direct to analyse the use of the Platform and application in order to promote user-oriented features
Retention period
24 months from the collection of the data
Handling request under GDPR and consumer code
Purpose
Under the GDPR you can ask your rights to be granted. You can easily do such by filling a dedicated form and contacting the DPO at dpo@luko.eu.
Categories of personal data
- Identification data
- Contact details
- Contractual data
Legal basis
Execution of the chapter 3 of the GDPR.
Retention period
5 years after the reception of the request.
How did we obtain your data ?
- Directly : via our website and the MyLuko application.
- Indirectly : through a partner or an aggregator.
Who are the recipient ?
Internal
The main recipient are internal recipient and the data are exchanged internally within the different Luko by Allianz Direct’s entity.
External
In the management of its activities Luko by Allianz Direct has outsourced some services :
- Level 1 Customer support : for minor question and low risk issue, the request are processed by an external (Sitel)
- Insurer : Wakam, Mila, SADA, MunichRe, Luko by Allianz Direct Insurance AG, MNCAP
- For the treatment of your civil liability and bodily damage : Stelliant
- Commissaire de Justice : in charge of the unpaid invoices
Principal service providers
- Amazon Web Services : to store your data and provide access to the App.
- Intercom : to process all your requests received by the Customer Support.
- Stripe : to process the payment of your contract.
- Braze and Mailjet : to send the essential communication related to your contract or any other kind of communication.
What is the retention period ?
Luko by Allianz Direct's Data Life Cycle for an Insured
1. Onboarding: Account creation and administration: processing and collection of data for the life of the account until it is closed.
2. Use of Services: data is collected and processed to ensure the performance of the Services and retained, at a minimum, for the duration of the use of the Services.
3. Off-boarding: Closing the Luko by Allianz Direct account: archiving in an intermediate database until the limitation period in terms of the fight against fraud and/or money laundering (5 years from the closing of the account) has expired.
4. Final data purge: Luko by Allianz Direct's internal purge mechanism for deletion from all databases. Archived data is only accessible by the legal, compliance and IT departments for the purpose of investigating fraudulent use of the Services.
How Luko by Allianz Direct preserve the security of your data ?
Technical measures
- Pseudonymisation of your personal data in the database in order to prevent the potential damageful impact of a data breach
- Robust password policy at the moment of the Luko by Allianz Direct’s account creation
- Systematic encryption of data on the hosting servers at the time of data transit (between the application and the servers) and during storage
- Implementation of a team dedicated to incident management, monitoring of security controls and ongoing verification of the effectiveness of security measures
- User access to the Platform monitored and protected by a system for detecting and preventing brute-force attacks, access from multiple IP addresses and multiple access from a single IP address.
Organizational measures
- Physical protection of the premises and control at the entrance
- Logging and traceability of connections
- Policy of management of the authorizations of each personnel who can have access to the data
- Authentication procedures for people accessing data with personal and secure access via confidential identifiers and passwords.
What are your rights ?
You can request the exercise of your rights, at any time, by reaching out to the DPO. But first, in order to process well you request, you have to specify the scope of your request and justify your identity by providing a unique number like your contract number.
- 1
Right to access
You can request at any time the access of your data and obtain them in a format easy to read.
- 2
Right to rectification
You can request the modification of some of your personal data if your status evolve throughout time. For example, if you move out and your home address changes you can notify the people to take into account this modification.
- 3
Right to deletion
You can request the deletion of your personal data in some circumstances, depending on the legal basis on which your data are being processed. As the majority of data are processed on the basis of the execution of your labour contract and/or legal and regulation obligations, Luko by Allianz Direct is under to archive and store these data for a longer period of time.
- 4
Right to withdraw your consent
You have the right to withdraw their consent to the processing of their personal data at any time. Luko by Allianz Direct may rely on consent as a legal basis for processing personal data in some cases. If you wish to withdraw your consent, you can contact the Data Protection Officer (DPO) at dpo@luko.eu to make a request.
- 5
Right to portability
You can request you right to data portability, which allows you to obtain and reuse your personal data across different services. Please note that this right only applies to personal data that you have provided to Luko by Allianz Direct, and only in cases where Luko by Allianz Direct processes your personal data with your consent or as part of a contract.