Privacy Protection Rules of SIA "CL Insurance Broker"

About your privacy, why we care about it and protect it

Your privacy

Nowadays, technology is evolving very quickly, facilitating the rapid exchange of information and data, which can affect your privacy. Your privacy is important to us, so we do everything we can to protect it.

Financial security and secrecy of transactions

Our daily routine is to work with confidential and private information - your data, accounts, transactions, and other information. You entrust this information to us to receive quality services from us and special care for the security of your data and transactions.

Trust

Your trust is important to us, so we make sure your data is always safe.

Compliance with the law and best practices

We, SIA “CL Insurance Broker”, have developed these Privacy Protection Rules to provide you with general information about the data we process, why we process it, and how we protect it.

If you want to receive information about the processing of your data, we will provide it according to your request in accordance with the procedure specified in these terms.

We provide this information in accordance with European Union and Latvian legislation, recommendations and best practices of the financial sector and supervisory authorities.

Let's get acquainted with the terms

processing – any actions we perform with your personal data, such as collecting, recording, storing, viewing, using, disclosing your personal data by sending, disseminating or otherwise making them available, coordination, deletion or destruction of your personal data, and more.

broker or us – SIA “CL Insurance Broker”, registration No. 40003983430.

bank – AS “Citadele banka”, registration No. 40103303559.

Citadele Group companies – the Bank and all of its foreign branches and subsidiaries.

Data State Inspectorate – an institution that supervises the application of the Regulation in the Republic of Latvia.

EU/EEA – European Union/European Economic Area.

you – the person whose data we process.

data – any information that concerns or could relate to you, such as your name, surname, personal identification number, address, telephone number, e-mail address, your habits.

consent – any freely and informed confirmation by which you consent to the processing of your data.

profiling – an automated method of processing your data to assess your economic, financial situation, personal preferences, interests, reliability, behaviour, etc.

regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

Who processes your data

Your data are processed by SIA “CL Insurance Broker”, registration No. 40003983430, address: Republikas laukums 2A, Riga, Latvia, LV-1010.

If you have any questions regarding the processing of your data, you may contact us by calling +37167442995, by sending an email to citadele.brokeri@citadele.lv, or by contacting our Data Protection Specialist at gdpr@citadele.lv.

For what purposes, what data, on what basis do we process, to whom we transfer it and for how long we store it

On-site and electronic identity verification (authentication)

Purpose of data processing	Data types/sets (categories) we process	Legal basis for data processing	Data recipients	Data storage period
Client identification in person	Client/any natural person Name, surname, personal identity number, date of birth, signature.	Conclusion and performance of the agreement Article 6(1)(b) of the Regulation Legal Obligation Article 6(1)(c) of the Regulation	Data is not transmitted	Data is not stored
Authentication in the electronic environment (Leasing Portal)	Client/any natural person Name, surname, personal identity number, device identifier, IP address	Conclusion and performance of the agreement Article 6(1)(b) of the Regulation Legal Obligation Article 6(1)(c) of the Regulation	Authentication service providers — AS “SK ID Solutions”, VAS “Latvia State Radio and Television Center”, AS “Citadele banka” Maintenance providers for information system	18 months for storing online banking audit records.

Purpose of data processing

Data types/sets (categories) we process

Legal basis for data processing

Data recipients

Data storage period

Client identification in person

Client/any natural person

Name, surname, personal identity number, date of birth, signature.

Conclusion and performance of the agreement

Article 6(1)(b) of the Regulation

Legal Obligation

Article 6(1)(c) of the Regulation

Data is not transmitted

Data is not stored

Authentication in the electronic environment (Leasing Portal)

Client/any natural person

Name, surname, personal identity number, device identifier, IP address

Conclusion and performance of the agreement

Article 6(1)(b) of the Regulation

Legal Obligation

Article 6(1)(c) of the Regulation

Authentication service providers — AS “SK ID Solutions”, VAS “Latvia State Radio and Television Center”, AS “Citadele banka”
Maintenance providers for information system

18 months for storing online banking audit records.

Daily services

Purpose of data processing	Data types/sets (categories) we process	Legal basis for data processing	Data recipients	Data storage period
Distribution of non-life insurance products: CASCO (Motor vehicle insurance) MTPL (Compulsory motor third-party liability insurance) Property, plant and machinery insurance Ship and aircrafts insurance Civil liability insurance for owners of ships and aircraft General Liability Insurance Cargo insurance Credit, Surety (Guarantee), and Legal Expenses Insurance Travel insurance Insurance against various financial losses Health and Accident insurance.	Client Name, surname, personal identification number, phone number, address, e-mail, account number, signature, age, information about movable or immovable property, driver’s experience, claims history, disability certificate number and validity period for applying the insurance premium payment discounts.	Conclusion and performance of the agreement Article 6(1)(b) of the Regulation Legal Obligation Article 6(1)(c) of the Regulation Compulsory Civil Liability Insurance of Owners of Motor Vehicles Law Insurance and Reinsurance Distribution Law	ERGO Insurance SE Latvian branch Compensa Vienna Insurance Group ADB Latvian branch Insurance Joint Stock Company Baltijas Apdrošināšanas nams Insurance Joint Stock Company BTA Baltic Insurance Company If P&C Insurance AS Latvian branch Insurance Joint Stock Company Balta Balcia Insurance SE Bank of Latvia	3 from the date of termination of the business relationship. 10 years from the date of termination of the business relationship, if the information has been requested by the supervisory authority - the Bank of Latvia.
Ensuring payment of e-invoices	Client Name, surname, personal identity number, telephone number, address, e-mail address, account number, transaction information, signature.	Consent Article 6, Paragraph one, point (b) of the Regulation	recipients of tranfers cooperation partners involved in the execution of payments other credit and financial institutions, financialservice intermediaries, and third parties engaged in payment execution participants and persons associated with local, European and international payment systems third parties in connection with their contracts and transactions information system maintainers	5 years from the date of termination of the business relationship

Purpose of data processing

Data types/sets (categories) we process

Legal basis for data processing

Data recipients

Data storage period

Distribution of non-life insurance products:

CASCO (Motor vehicle insurance)
MTPL (Compulsory motor third-party liability insurance)
Property, plant and machinery insurance
Ship and aircrafts insurance
Civil liability insurance for owners of ships and aircraft
General Liability Insurance
Cargo insurance
Credit, Surety (Guarantee), and Legal Expenses Insurance
Travel insurance
Insurance against various financial losses
Health and Accident insurance.

Client

Name, surname, personal identification number, phone number, address, e-mail, account number, signature, age, information about movable or immovable property, driver’s experience, claims history, disability certificate number and validity period for applying the insurance premium payment discounts.

Conclusion and performance of the agreement

Article 6(1)(b) of the Regulation

Legal Obligation

Article 6(1)(c) of the Regulation
Compulsory Civil Liability Insurance of Owners of Motor Vehicles Law
Insurance and Reinsurance Distribution Law

ERGO Insurance SE Latvian branch
Compensa Vienna Insurance Group ADB Latvian branch
Insurance Joint Stock Company Baltijas Apdrošināšanas nams
Insurance Joint Stock Company BTA Baltic Insurance Company
If P&C Insurance AS Latvian branch
Insurance Joint Stock Company Balta
Balcia Insurance SE
Bank of Latvia

3 from the date of termination of the business relationship.

10 years from the date of termination of the business relationship, if the information has been requested by the supervisory authority - the Bank of Latvia.

Ensuring payment of e-invoices

Client

Name, surname, personal identity number, telephone number, address, e-mail address, account number, transaction information, signature.

Consent

Article 6, Paragraph one, point (b) of the Regulation

recipients of tranfers
cooperation partners involved in the execution of payments
other credit and financial institutions, financialservice intermediaries, and third parties engaged in payment execution
participants and persons associated with local, European and international payment systems
third parties in connection with their contracts and transactions
information system maintainers

5 years from the date of termination of the business relationship

Organization of the brokers activities

Purpose of data processing	Data types/sets (categories) we process	Legal basis for data processing	Data recipients	Data storage period
Attracting customers for the use of broker services (promotions, lotteries, raffles, contests)	The amount of data varies depending on the type of event. Client Name, surname, personal identification number, date of birth, phone number, e-mail address, data indicated in the identity document, place of tax residence, transaction history, information related to the prize won, account number, signature.	Consent to receive notifications and offers Article 6, Paragraph one, point (a) of the regulation Statutory obligation Article 6, Paragraph one, point (b) of the regulation	Cooperation partners who ensure the provision of the service	5 years
Debt recovery through debt collection service providers	Client Name, surname, personal identification number, date of birth, e-mail address, address, phone number, information about debt obligations, account number.	Legitimate interests in debt recovery. Article 6, Paragraph one, point (f) of the regulation	Debt recovery service providers	5 years
Transfer of the debt to another person – the collector (assignment) If you have a debt to the broker, the broker can transfer your debt to another company. This means that the debt does not disappear anywhere – you still must pay it, it just changes who you pay it to, for whom you will receive the appropriate notification.	Client Name, surname, personal identification number, date of birth, e-mail address, address, telephone number, signature, debt obligations and other obligations, insolvency status, account number, transaction history.	Legitimate interest in debt recovery. Article 6, Paragraph one, point (f) of the regulation	Debt recovery service providers (assignees)	5 years
Assessment and improvement of the quality of services (testing)	Clients and any person participating in testing Name, surname, personal identification number, phone number, e-mail address, information related to the client's interests, habits, use of broker services and their compliance with the client's needs, signature.	Consent to the processing of personal data for the evaluation/improvement (testing) of the quality of services and the provision of communication Article 6, Paragraph one, point (a) of the regulation	Information systems maintainers	3 months
Provision of audit (checks) The broker shall provide an independent internal/external audit to verify that the broker is operating honestly, safely and in accordance with the law. This helps protect the interests of both clients and employees.	Client, any natural person Considering the amount of data and information specified in various documents, the following data is processed: Name, surname, personal identity number, date of birth, signature, telephone number, address, e-mail address, information related to client identification, account number, insurance service history, indebtedness, information about real estate, movable property.	Statutory obligation Article 6, paragraph one, point (c) of the regulation Legitimate (legitimate) interest in verifying that the broker operates honestly, safely and in accordance with the law. Article 6, Paragraph one, point (f) of the regulation	Audit service providers	Until the end of cooperation/ audit
Receipt and sending of documents (correspondence)	Client, any natural person Name, surname, address, telephone number, e-mail address, signature.	Conclusion and performance of the contract Article 6, Paragraph one, point (b) of the regulation	Postal service providers Delivery, courier service providers	10 years from the date of receipt or issuance of information.
Document archiving (retention, destruction)	Client, any natural person Considering the amount of data and information specified in various documents, the following data is processed: Name, surname, personal identity number, date of birth, signature, phone number, address, e-mail address, taxpayer number, insurance service history, information related to client identification, disability certificate number and expiration date, account number, indebtedness, information about real estate, movable property.	Statutory obligation Article 6, Paragraph one, point (c) of the regulation Archives Law and national document standards Law on Accounting Civil Law and other laws and regulations Archiving in the public interest Article 9, Paragraph two, point (j) of the regulation	Cooperation partner who ensures the provision of archive service, maintenance of information systems.	Document retention periods depend on the type (category) of document and may be 1 year, 2 years, 5 years, or 10 years.

Receiving information, notifications and offers

Purpose of data processing	Data types/sets (categories) we process	Justification for data processing	Data recipients	Data storage period
Communication about your products and services and their changes (by phone, email)	Client Name, surname, personal identification number, phone number, email address, information about insurance products, services you use.	Conclusion and performance of the contract Article 6, Paragraph one, point (b) of the regulation Consent to receive notifications and offers Article 6, Paragraph one, point (a) of the regulation	Cooperation partners who ensure the provision of communication service	3 years from the day of communication
Client satisfaction surveys (We regularly conduct surveys to find out the opinions of clients and residents about the brokers services. In the surveys, we also find out opinions about the broker’s provided services. This information helps us improve our services and provide high quality service).	Clients Name, surname, personal identity number, date of birth, e-mail address, telephone number, insurance service history for the selection of respondents regarding the use of broker services, signature.	Consent to receive notifications and offers Article 6, Paragraph one, point (a) of the regulation	Cooperation partners in providing surveys	The data is deleted after the survey is closed.

Purpose of data processing

Data types/sets (categories) we process

Justification for data processing

Data recipients

Data storage period

Communication about your products and services and their changes

(by phone, email)

Client

Name, surname, personal identification number, phone number, email address, information about insurance products, services you use.

Conclusion and performance of the contract

Article 6, Paragraph one, point (b) of the regulation

Consent to receive notifications and offers

Article 6, Paragraph one, point (a) of the regulation

Cooperation partners who ensure the provision of communication service

3 years from the day of communication

Client satisfaction surveys

(We regularly conduct surveys to find out the opinions of clients and residents about the brokers services. In the surveys, we also find out opinions about the broker’s provided services. This information helps us improve our services and provide high quality service).

Clients

Name, surname, personal identity number, date of birth, e-mail address, telephone number, insurance service history for the selection of respondents regarding the use of broker services, signature.

Consent to receive notifications and offers

Article 6, Paragraph one, point (a) of the regulation

Cooperation partners in providing surveys

The data is deleted after the survey is closed.

Handling of requests, claims, applications and complaints

Purpose of data processing	Data types/sets (categories) we process	Justification for data processing	Data recipients	Data storage period
Examination of applications, requests, complaints of natural persons	Client Name, surname, personal identification number, date of birth, signature, address, e-mail address, telephone number, account number, insurance service history. Other types of data are determined depending on the amount of information requested in the request, claim or application, as well as on the information contained in the documents to be issued.	Statutory obligation Article 6, Paragraph one, point (c) of the regulation Insurance and Reinsurance Distribution Law	Data is not transferred	5 years from the date of provision of information
	For personal data used for identification, see the information in the section On-site and electronic identity verification (authentication).
Managing requests from data subjects	Client Name, surname, personal identification number, date of birth, address, e-mail address, phone number, signature. Other types of data are determined depending on the amount of information requested in the request, claim or application, as well as on the information contained in the documents to be issued.	Statutory obligation Article 6, Paragraph one, point (c) of the regulation Personal Data Processing Law	Data is not transferred	5 years from the date of provision of information
Managing requests from data subjects	For personal data used for identification, see the information in the section On-site and electronic identity verification (authentication).
Examination of requests from the competent national authorities and their officials	Client Name, surname, personal identification number, date of birth, address, e-mail address, phone number, signature, the information contained in the documents to be issued, account number, insurance service history, taxpayer number, movable and immovable property owned, credit obligations and other liabilities. Other types of data are determined depending on the amount of information requested in the request, claim or application, as well as on the information contained in the documents to be issued.	Statutory obligation Article 6, Paragraph one, point (c) of the regulation Insurance and Reinsurance Distribution Law State Labour Inspection Law Law on the Ombudsman and other legal acts	Bank of Latvia Court Promoters of criminal proceedings Police, Prosecutor's Office Data State Inspectorate State Revenue Service	5, 10 years from the date of provision of the information, depending on the type of request.

How we collect your data

We collect your data:

When you give them to us:
- by using our services, which you can apply for in our client service centres, websites, by filling out applications.
- to cooperate with the broker;
- as a third party in connection with transactions;
- by contacting us by mail, e-mail, by phone, in person, by visiting our client service center;
when they are provided to us by third parties:
- our cooperation partners who provide you with information about us;
- Citadele Group companies;
- maintainers of databases, registers established by law, media;
- state institutions and law enforcement agencies and their officials;

Your data is available only to our employees and those of our cooperation partners, who need it for the performance of their work duties and provide you with the services you need. They process your data for certain purposes, in accordance with requirements of the law and broker regulations.

Do we process data in an automated way and perform profiling

In some cases, we process your data through profiling. We do not process your data in an automated manner.

Profiling

What is it? Profiling is a data processing method in which, using various personal data, we create a "profile" of your person, within which we evaluate data such as insurance product purchase history,interests, wishes, etc.
Why do we do this? We perform profiling to assess whether:
- the relevant insurance product or service is suitable for your wishes and needs;
- assess risks;
- provide you with advice regarding insurance services;
- offer products and services according to your needs.

Do we transfer your data outside the EU/EEA

We process your data in the European Union and the European Economic Area. However, to provide certain services, data may be transferred to countries outside these territories, for example, if it is necessary for our cooperation partners to provide certain services. We provide you with information about this in section 4. In such cases, we ensure that the data is processed in accordance with the requirements of the regulation and is protected at the same level as required by the regulation.

If we transfer your data outside the EU or the EEA, we comply with at least one of the following conditions:

the transfer is carried out to a country recognized by the European Commission as safe and providing an adequate level of data protection;
the transfer is carried out on the basis of the Standard Contractual Clauses approved by the European Commission for data transfers outside the EU or EEA.

What are your rights in relation to the data processing we carry out

When processing data, we provide you with the following rights by submitting a written request to us in free form:

Withdraw consent to data processing	If you have given your consent, for example, to receive offers and notifications about our products, you can withdraw it at any time. You can use email or come in person to withdraw your consent. If you withdraw your consent, we will stop processing your data. The processing of your withdrawal request may take up to five business days, depending on the channel through which the withdrawal was submitted.
Access your data	You have the right to receive from us: confirmation of whether we process your data; detailed information about your data processing to ensure that the data is accurate and processed in accordance with the law. If you wish to access your data, please specify the time and the data you would like to receive. You have the right to know what data we hold about you, why we process it, how we obtain it, to whom we have transferred it and how long it will be stored. You may also request a copy of your data. So that we can fulfil your request faster, specify the shortest possible period and describe exactly what data and information you would like to receive. Please note that we will not be able to provide information if prohibited by law, for example, when providing data to law enforcement authorities (police, prosecutor's office, court, etc.).
Correct data	If you believe that the data we hold is inaccurate or incomplete, please let us know: inform us about corrections needed; we may ask you to provide documents confirming the necessary changes to the data, for example, if you have changed your last name.
Delete data	You may request to delete your data if you consider that: they are no longer needed, they are not used for their intended purposes. We will delete your data and inform our cooperation partners on the need to delete it, unless the data is necessary for the purposes for which we process it or if the law requires a longer retention period. Please note that fulfilling a deletion request may not always be possible, for example, if it will be necessary to provide you with a service, to comply with legal requirements or for proceedings.
Restrict data processing	You may request to restrict the processing of your data if: you dispute the accuracy of the data (the restriction will apply until the accuracy is verified), you believe the data processing is unlawful, but prefer to restrict rather than delete the data, we no longer need your data, but you need it to defend your rights, you object to data processing carried out based on our legitimate interests. We will reassess whether, considering your objections, we need to continue processing data. If data processing is restricted, we will use the data only for specific purposes, such as defending our rights.
Transfer data	The data provided by you, either with your consent or under a contract, may be transferred. Data processed automatically can also be transferred. You can use this data personally, or, upon your request, we will transfer it to another service provider, if there are no obstacles. When transferring data, it is important to consider that it may include data about third parties and in such cases, we must consider and assess the rights and freedoms of those third parties. To help us fulfil your request more quickly, please describe as precisely as possible what data and information you wish to transfer.
Object to data processing	You may object to the processing of your data if it is conducted based on legitimate interests. We will review your objections and assess the necessity of continuing the data processing. We will need to continue processing your data if it is necessary to comply with the law or to protect our rights. You will not be able to exercise the right to object to the processing of your data if you have given your consent to the data processing, if data processing is necessary for the performance of a contract, or if we are required to process the data to comply with the law.
Abandon automated individual decision-making, including profiling	We do not process your data in an automated manner, including profiling.

How to submit a data processing request and how will we process your request

How can you submit a request?	What is the response time for processing your request?	What will be the fee for processing your request?	How will we provide a response to the request?
In writing, in free form: in person, presenting an identity document – a passport or ID card, or a power of attorney if acting on behalf of someone else, by email – by sending a request signed with a secure electronic signature. Upon receiving your request, we will evaluate it. If necessary, we will ask you to clarify the information and data processing activities about which you would like to receive information.	We will review your request: not later than within 1 month from its receipt; if the request is very extensive or complex, we may need an additional 2 months. We will inform you about the period of extension and the reasons for it.	You can receive a response to your request: free of charge; if you submit a repeated request and we determine whether it is unfounded or excessive, we may charge a fee or refuse to fulfil the request. The fee will cover the costs of processing the information and the work of our employees. If payment is required, we will inform you in advance.	You can receive a response to your request: in person, presenting an identity document—a passport or ID card, or a power of attorney if acting on behalf of someone else, by email, receiving a password via SMS to access the document. We will consider the way you provide us with a response.

What to do if you believe that we have infringed your rights by processing

We process your data in accordance with the regulation, European Union and Latvian laws, industry best practice, guidelines and recommendations issued by supervisory authorities. If you believe that we have violated your privacy rights, you can submit a complaint to us using the contacts listed below. If the response provided does not meet your expectations, you can submit a complaint to the Data State Inspectorate using the contacts listed below:

SIA "CL Insurance broker"

Address: Republikas laukums 2A, Riga, Latvia, LV-1010

Phone: +371 67442995

Email address: citadele.brokeri@citadele.lv

E-mail address of the Personal Data Protection Officer: gdpr@citadele.lv

Data State Inspectorate

Address: Elijas iela 17, Riga, LV-1050

Phone: +371 67223131

Email address: pasts@dvi.gov.lv

Website: www.dvi.gov.lv

If the answer of the broker or the Data State Inspectorate does not provide you with a satisfactory solution, you can apply to the court.

How do we keep your data safe

How will we provide up-to-date information about the processing of your data

To ensure that you are always informed about how your data is processed, we will regularly review and update this Privacy Protection Rules. Therefore, we invite you to review the latest Privacy Protection Rules from time to time on our website or by e-mail. If there are any significant changes, we will notify them one month before they come into effect.

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use 2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use 2 On the use of marketing cookies for our loan services

Digital bank

Cards

Payment methods

Bring a friend!

For daily needs

For car

For home

Obligations

Pension

Short term savings

Long term savings

Finotherapy

For car and machinery

For financial security

For home

For an active lifestyle

Useful

Contact us

Contacts