This document explains the collection, usage and disclosure policies pertaining to the personal information obtained on this website Covergenius.com, operated by Cover Genius Limited (UK company Number 09408621) of 18 Finsbury Square, London EC2A 1BR, UK & Cover Genius Pty Ltd (Australian Company Number 159 983 598) (“we” or “us”) of Level 6, 9 Barrack St, Sydney, NSW 2000, Australia. We may amend this policy from time to time.
1. Our Privacy Commitment
We are committed to protect your personal information. This document outlines how we collect, use and disclose personal information.
2. General Data Protection Regulation (GDPR)
In Writing: Cover Genius 18 Finsbury Square London EC2A 1AH United Kingdom By Email: [email protected]
3. What is personal information?
Personal information is information that can identify you. This includes but is not limited to your name, age, phone number or email address.
4. Why do we collect personal information?
In order to enter into an agreement with us, we will collect, store and use elements of your personal data. The processing of this personal data is a contractual requirement and is necessary by us in order to administer your account and to provide a suitable policy for your trip. It is held and used to:
- Identify you;
- Offer you a suitable product;
- Give you support with an existing booking;
- Assist you with your claims (only claim-relevant information);
- Operate marketing & promotional activities (you can unsubscribe directly on material sent or contacting us);
- Issue you booking reminders for your convenience;
- Maintain training & quality purposes over the phone.
Should you choose not to provide us with details of your personal information we may not be able to carry out the services we have stated in the clause.
5. What personal information is collected?
We collect and keep information, which may include:
- Trip details,
- first name(s), surname or company name (including representation as the case may be),
- address (street, street number, postal code, city and country/region),
- email address,
- date of birth,
- telephone and mobile number,
- bank details (account number, account holder and card number) for claim purposes,
- Other information pertaining to your use of this website including but not limited to your IP Address and Browser information.
We will also monitor, record, store and use any telephone, email or other electronic communications with you for training purposes so that we can check any instructions given to us and to improve the quality of our customer service.
Personal data we collect from you will be accessed by trusted third-parties who are outside the European Economic Area. However, additional security and contractual arrangements are in place to ensure the protection of the data accessed. The countries involved in the processing include; Australia and the Philippines.
6. How is your personal information collected?
We collect information through different means:
- Directly from you – this happens when you create a quote on our website, request support or submit a claim. It may happen over the phone, via email or our chat box when communicating with our agents/representatives.
- Through our partners – this happens when you book one of our policies through one of our partner’s website or when our partners create quotes and book policies through our travel agent portal on our website.
- Through third parties – this may happen through our underwriters, your representatives (family members), service providers, partners, or claim investigators and handlers.
7. How do we protect your personal information?
In order to protect the personal data collected from you, we are dedicated to preventing any accidental or deliberate manipulation, loss, destruction of personal data, or any unauthorised access to or unauthorised disclosure of personal information. Technical and organisational security measures are constantly improved as part of our technological development. In addition, our employees, subcontractors and other support staff are obligated to observe confidentiality and data privacy.
- Only our authorised personnel has access to your personal information. If an employee leaves the company, his/her access to our database is restricted.
- We only disclose personal information once an individual has met all the identification requirements.
- We constantly train our staff on how to handle personal and sensitive information.
- Our website supports “Secure Socket Layer” or SSL encrypted 256-bit SSL which prevents other computers to impersonate your computer & access or modify from other third parties while it travels around the Internet.
- Our payment gateways are encrypted to enable safe transfer of credit card details.
Wherever possible, we have tried to create a secure and reliable website for our users. However, you recognise that your use of the Internet and our website is entirely at your own risk and we have no responsibility or liability for the security of personal information transmitted via the Internet.
All passwords and usernames allocated to you must be kept secret and must not be disclosed to anyone without our prior written authorisation. You must not use any false identity in email or other network communications and you must not attempt or participate in the unauthorised entry or viewing of another user’s account or into another system.
8. Sharing of data with other approved parties
Cover Genius is a ‘data controller’ within the meaning of the GDPR and determines the purposes and means of the processing of your personal data. Cover Genius uses ‘data processors’ which process your personal data on behalf of Cover Genius.
Here at Cover Genius we take your privacy seriously and the information we hold about you is confidential. In order to administer your contract, we may need to share some of your personal information with other approved parties. This processing is necessary for the purposes of delivering specific services to you.
Your personal information is not disclosed without your consent unless it is sold as part of the business. It may however be disclosed to parties within business operation, in accordance to the Privacy Act 1988 (Cth), the Data Protection Act 1988 and the General Data Protection Regulations (GDPR) (EU 2016/ 679) such as:
- government authorities;
- our agents and representatives;
- our insurers;
- our claims handlers;
- our partners,
- our suppliers.
We may disclose it outside Cover Genius when:
- you have given us your consent to do so,
- it is necessary for the performance of an agreement/contract of which you will be made aware,
- in order to obtain professional advice (e.g. legal advice),
- we or others need to investigate or prevent crime (e.g. to fraud prevention agencies),
- the law permits or requires it,
- regulatory or governmental body requests or requires it, even without your consent, or
- there is a duty to the public to reveal the information.
Other data processors which we may share your personal information with may include:
- Credit reference agencies,
- Claims handling and fraud prevention agencies (to investigate or prevent crime).
Cookies are small files that are downloaded to your computer and anonymously accumulates your personal information and our website’s usage, enabling us to recognize when your computer goes on our website in the future. Cookies do not damage your computer and you can deactivate them if you do not wish to receive them on your computer.
You can change your cookie settings by reading the help section for your browser for the latest instructions.
10. Direct marketing communication
If you have chosen to opt-in to our direct marketing communications, we will use your information to tell you about products and services available from us which may be of interest to you. We may also use your information to tell you about products and services which we can introduce from selected businesses.
To help make our emails more interesting and relevant, we often receive a confirmation when you open an email from Cover Genius if your computer supports such capabilities.
You have a right to opt-out of our direct marketing communications at any time. You can opt-out by following the Unsubscribe instructions at the bottom of the communication or by emailing [email protected]
11. Links to websites of other providers’ third parties
12. How long will your personal data be stored for?
Where possible, we will take steps to erase any personal data that is no longer necessary for the purposes for which it is collected or otherwise processed, or if you have withdrawn consent for its processing and retention.
As a general rule, if you enter into or took steps to enter into a contract with Cover Genius, we will store the data in accordance with other regulations and compliance with our general legal obligations and for the exercise or defence of any legal claims.
Under the GDPR, you have the right to ‘block’ or request the deletion or removal of personal data to prevent further processing. This right to erasure is also known as ‘the right to be forgotten’. Specific circumstances in which you can request the deletion or removal of personal data includes:
- where the personal data is no longer necessary for the purposes for which it is collected or otherwise processed,
- where you withdraw consent,
- when you object to the processing and there is no overriding legitimate interest for continuing the processing,
- where the personal data was unlawfully processed (i.e. otherwise in breach of the GDPR),
- where the personal data has to be erased in order to comply with a legal obligation.
- In case a deletion is not possible due to legal, statutory or contractual retention periods, or if it requires disproportionate efforts or prejudices your legitimate interests, the data will be blocked instead of deleted.
13. Your expanded rights under the GDPR
Right to Object
Under the GDPR you have the right to object at any time to the processing of your personal data (including profiling). If you make an objection Cover Genius must generally stop the data processing. However, this right only applies to certain types of processing, such as:
- where the legal basis for processing is legitimate business interests; or
- direct marketing.
Right to Data Portability
You have the right to receive your personal data that you provided to Cover Genius in a ‘structured, commonly used, machine-readable format’ and to transmit that data to another entity where the data is processed electronically.
Your right to Data Portability applies:
- to personal data that you have provided to Cover Genius;
- where the processing is based on your consent or the performance of a contract; and
- where processing is carried out by automated means.
Right to Restriction of Processing
You may have a right to obtain a restriction on processing of your personal data from Cover Genius. Where processing is restricted, personal data may only be processed in certain circumstances including with your consent. For example, if you contest the accuracy of your personal data, there may be a temporary restriction on processing to enable Cover Genius to verify the personal data.
14. Fraud Prevention
If you give us false or inaccurate information and fraud (in any form) is identified, details will be passed to the fraud prevention agencies. We and other organisations may also share, access and use this information to prevent fraud and money laundering, for example when:
- managing credit and credit related accounts or facilities,
- recovering debt,
- checking any details that may be provided to us during the course of engaging in business with us.
- In addition, law enforcement agencies may access and use this information.
If at any time we become aware that your data has been compromised, or that a breach of our systems and controls has occurred, which has an impact on the security of your data, we will notify the Information Commissioner’s Office, and you, without undue delay.
In case a data breach is likely to be a high risk to your rights and freedoms, we will notify you, as well as the relevant supervisory authority under the GDPR within 72 hours of becoming aware of the breach.
16. Subject Access Requests
You have the right to request access to a copy of the personal information that we hold about you. This is also known as a ‘Subject Access Request’. This information is provided to you free of charge however, we can refuse to respond or charge a ‘reasonable fee’ when a request is manifestly unfounded, excessive or repetitive.
We will provide this information in a structured, commonly used and machine-readable form such as a CSV file or PDF file where possible. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. Where possible, we will provide this information via remote access to a secure self-service system, such as our Customer Account area, which would provide you with direct access to your information.
If you would like to submit a Subject Access Request, please contact our compliance team in writing to:
Cover Genius 18 Finsbury Square London EC2A 1AH United Kingdom
By Email: [email protected]
We will response to your request without delay and at the latest, within 1 month of receipt of your request.
17. What if your personal information is inaccurate?
If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to rectification. You can log into your account and update this information at any time. Similarly, you can contact us anytime to discuss your personal information.
Where possible, we will also inform any third parties to whom we have disclosed the personal data in question to so they can rectify their records.
18. Withdrawing Consent
If we are processing any of your data by using consent as the lawful basis for processing, you have the right to withdraw your consent for us to collect, process and store this data at any time. If you wish to withdraw your consent, please confirm this in writing to our Data Protection Officer:
Cover Genius 18 Finsbury Square London EC2A 1AH United Kingdom
By Email: [email protected]
Please note, by withdrawing consent, we may be unable to execute the contract that you have entered into with us and will result in termination of our services. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.