Datenschutz allgemein

Zurich (hereinafter also referred to as "we"; see sub-paragraph 2" processes personal data relating to you or other individuals (referred to as "third parties"). For more information about Zurich, please refer to sub-paragraph 2.

"Personal data" is data relating to an identified or identifiable person; in other words, the data or corresponding additional data can be used to make inferences about their identity. "Sensitive personal data" is a category of personal data whose processing may be subject to special requirements. Sensitive personal data may include data from which ethnic origin can be discerned, data relating to health, data concerning religious or philosophical beliefs, biometric data for identification purposes and data concerning trade union membership. In sub-paragraph 3, you will find details of the data that we process within the scope of this Privacy Policy. 

In this Privacy Policy, you will find information about our data processing (we use the term "data" here synonymously with "personal data"). This concerns, for example, the following individuals (each referred to as "you"):

• Interested party, policyholder and insured person
• Authorized representative (e.g. legal representative)
• Claimants, injured parties and other involved individuals
• Contacts within corporate customers, co-insurers and reinsurers, suppliers and partners, as well as authorities and agencies.

This Privacy Policy explains our handling of personal data and makes reference to the processing of both already collected personal data and personal data that will be collected in the future. It applies to all our services and activities, unless we provide you with separate privacy policies for these.

For further details regarding our data processing, please refer to the following documents, if applicable:

• the customer information, which you receive together with the General Conditions of Insurance (GCI) or other contract documents, and the concluding declaration, which you will usually find at the end of the application or offer form;
• the General Conditions of Insurance (GCI) or other contractual provisions for each product, from which you can also obtain information about the purposes and circumstances of our processing;
• product and service descriptions;
• our websites.

For some products, services and offers, you will find further information on the corresponding data processing, such as in additional privacy policies, which apply in addition to this Privacy Policy.

In this Privacy Policy, we use the masculine form to make it easier to read, but this of course refers to people of all genders (in the English version, the neutral form is used where applicable).

We are happy to help should you have any questions (sub-para.2)

The insurer is responsible for processing data pursuant to this Privacy Policy, unless otherwise communicated in individual cases, for example, in additional privacy policies, on forms or in contractual conditions. 

For each data processing operation, there are one or more bodies who bear primary responsibility for ensuring that the data processing complies with the requirements of data protection law. This body is referred to as the "data controller" or “controller”. It is responsible, among other things, for responding to requests for information (sub-paragraph 10) or for ensuring that personal data is secure and not used in a way that deviates from what we tell you or from what is permitted by law. Details of third parties with whom we cooperate and who are responsible for their own processing can be found in sub-paragraph 3 and in sub-paragraph 6.

• The insurer for all classes of insurance, with the exception of life and legal protection insurance, is Zurich Insurance Company Ltd "ZIC" domiciled at Mythenquai 2, 8002 Zurich.
• The insurer for the life insurance is Zurich Life Insurance Company Ltd ("ZLIC”) domiciled at c/o Zurich Insurance Company Ltd, Mythenquai 2, 8002 Zurich. 

(ZIC and ZLIC shall be hereinafter jointly referred to as "Zurich")

ZIC and ZLIC are incorporated under Swiss law.

If you wish to contact us in this regard, please write to the following address:
Zurich Insurance Company Ltd 
Zurich Data Protection 
P.O. Box
CH-8085 Zurich
datenschutz@zurich.ch

Depending on the occasion and purpose, we process different data from different sources. Information on the purposes of this processing can be found in sub-paragraph 4. 

We primarily collect this data directly from you, for example, when you submit an insurance application to us, when you communicate with us, when you contact us through an intermediary, or when you report a claim. However, we may also obtain data from other sources (referred to as "third parties"). You will find further details on this in this sub-paragraph 3.

We primarily process the categories of data described below, although this list is not exhaustive. If data changes over time (for example, if an address changes or in the event of another modification), we may retain the previous status in addition to the current status.

Master data: We use the term "master data" to refer to the basic data that we require, in addition to the contractual data (see below), to process our contractual and other business relationships or for marketing and advertising purposes. We process your master data if, for example, you are a policyholder or an employee of another insurer or a supplier, or because we want to address you for our own purposes or the purposes of a contractual partner (such as in marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.; you will find further details on this in sub-paragraph 4 ).

Master data primarily includes information such as your name, address, email address, telephone number and other contact details, date and  place of birth, age, gender, nationality and hometown, details from identification documents (such as from your passport or ID card), your customer number and other details such as your tax number or tax country.

This data also includes information about relationships with third parties who are also affected by the data processing. In the case of motor vehicle insurance, for example, this would be information (such as name, date of birth or nationality) on the most frequent driver; in the case of collective personal insurance, this would be information about on the insured employees or, in the case of life insurance, this would be information on the beneficiary or the beneficial owner, as well as correspondence recipients, premium payers and other persons involved in the contract and, if applicable, information about family members.

In the case of customers and other contractual partners who are companies, we process data concerning our contact persons, this may include name and address, details of titles, position in the company, qualifications and, where applicable, details of supervisors and employees. Depending on the area of activity, we are also required to check the company in question and its employees more closely, for example, by carrying out a security audit. In this case, we collect and process additional data, if necessary also from third party providers. 

We often obtain master data from you, for example in application documents, but we may also obtain data from third parties such as providers of address updates or the commercial register. 

Contract and claims data: This is information that accrues in connection with the conclusion or processing of a contract, such as details relating to the insured risk and in connection with settling of claims. This also includes health data and information about third parties such as injured parties and other involved parties. We may also obtain this kind of data from third parties such as intermediaries, public authorities and agencies, employers, other insurers, banks, medical providers and experts, Car Claims Info and the HIS information system or from external lawyers. By submitting an insurance application or notification of a claim or benefit, you release these offices from any non-disclosure obligations. 

This data includes information about the conclusion of the contract (including consultations and our assessment of the risks), about your contracts, for example the type and date of contract conclusion and information stemming from the application process such as material risk factors and further information about the contract in question (such as insured risk, insured object, sum insured, salary amounts, premium, duration of contract, details of prior and additional insurance policies) as well as details of any previous claims and information stemming from the processing and administration of the contracts (such as details provided in the context of invoicing, advice and customer service). Contract data also includes information about complaints about and adjustments to a contract, as well as information about customer satisfaction, which we may collect, for example, by means of surveys.

When settling claims, we process additional data such as the notification of claims, claim number, amount of claims, details of third parties, for example, injured parties and persons involved such as co-drivers and other details in connection with the assessment of the claim, including particularly sensitive personal data such as health data. To do this, we cooperate with third parties such as experts, doctors and other service suppliers, from whom we also receive data – including health data – where applicable with your separate release declaration. We also participate in HIS, a notification and information system used by the insurance industry, and process information about certain circumstances in connection with claims reviews in the case of motor vehicle, liability, building, contents, technical and other property insurance, which we may report to and retrieve from HIS. In the event of a positive query result, we may share related data with other insurers with your separate consent. Further information on HIS can be found under sub-paragraph 4.

Depending on the insurance product, we process additional data in connection with the insurance contract, for example

• in the case of security deposit insurance and, in particular, rental security deposit insurance, this may include information on the deposit, on coinsured persons, correspondence recipients, landlords, property managers, rented property, previous insurance policies, material risk factors, outstanding debt enforcement proceedings and the companies involved, as well as data from any documents that may be attached, such as rental agreements, liability policies, business reports and business plans, and also information on surety recipients; 
• in the case of construction insurance and contractor’s liability insurance, this may include details of the property under construction, material risk factors, the concerned activity, sureties, turnover, salary amounts, association memberships, as well as details of contact persons, correspondence recipients, surety and guarantee beneficiaries, joint venture partners and brokers; 
• in the case of buildings insurance, this may include details of financing and ownership of land and residential property, location, type of building, construction type, purchase price, further details of the property including photographic documentation, as well as details of new owner if applicable; 
• in the case of household contents insurance, this may include information concerning the livingand housing situation, such as number of rooms, canton of residence, value of household contents, ownership situation, number of persons in the same household; 
• in the case of property and technical insurance, this may include details of the type of business, make, model, value and age of the items to be insured, photographs and proof of purchase for these items, information about their location, previous insurance policies, material risk factors, NOGA code, legal form, annual turnover, business inventory, main and secondary place of insurance, AHV annual salary sum, fee sum, fire extinguishing conditions, construction class, security devices for fire and theft, as well as details of coinsured persons, operators, property owners, suppliers, auditing companies and clients entrusted with audits, guarantee beneficiaries, assignees and brokers; 
• in the case of liability insurance, this may include details of activity or event, previous insurances, material risk factors, living and residential situation and canton of residence. Where necessary, we also process company data such as salary amounts, turnover, turnover splits, personnel data and other data regarding operations, products and services, as well as information about contracts with customers, buyers and contractual partners, as well as data on training, coinsured persons, contact persons, operators, property owners and data from use, easement and cooperation contracts;
• in the case of accident and daily sickness benefits insurance, this may include information on the company, location, the persons to be insured, their workloads and salary amounts, information on their state of health and previous accidents or illnesses, as well as information on previous insurers, co-insurers and reinsurers, recipients of correspondence, involved doctors and brokers;
• in the case of motor vehicle insurance, this may include information on the license plate, vehicle and mileage (such as information on loss of driver's license), no-claims classes, events of a loss (bonus/penalty) and vehicle financing, as well as use in a private or commercial capacity. It may also include data from Car Claims Info, a system for combating abuse in the area of motor vehicle insurance (further information on Car Claims Info can be found under sub-paragraph 4), information about health status, date of birth, gender and nationality and information about the previous check as to whether a claim has already been paid by another insurance company; 
• in the case of guarantee insurance for motor vehicles and real estate warranty, this may include information on the make, model, motorization, license plate, type certificate and chassis number in the case of motor vehicles or type of property, year of construction, age of the individual components as well as further details about the real estate including photo documentation and, if applicable, details of the new owner in the case of real estate;
• in the case of transport insurance, this many include details of transported annual turnover, means and routes of transport, previous insurances and material risk factors; 
• in the case of life insurance, this may include information on family and financial situation (such as number of people in the same household, occupation and branch of activity), on health and capacity for work, as well as on material risk factors and previous insurance polices, information on the various parties involved in the contract, as well as contact details of attending physicians. 

Financial data: This is data relating to financial circumstances, payments and the securing of claims.

This data may include information on income from employment, pensions and income from capital investments, additional details about assets and information about your risk and investment profile, your risk tolerance and your knowledge and experience in relation to financial products. It may also include information used to determine creditworthiness (i.e. information which allows conclusions to be drawn about the likelihood that claims will be settled) and information concerning the origin of assets, as well as data regarding the payment of premiums (including bank details, account numbers and credit card details), payment reminders and the collection of claims (e.g. premium claims).

We receive this data from you,  for example, in the context of payments that you make, as well as from credit agencies and from publicly accessible sources. 

Behavioral and preference data: Despite our large number of customers, we strive to get to know you better and to tailor our advice and offers to you in the best possible way. We therefore process certain data about you and your behavior. By ‘behavioral data’, we mean data about your behavior in the context of your interactions with us. We may combine this information with other information, including information from third parties, to determine whether you may have an interest in or need for certain Zurich products or services (preference data). 

Behavioral data is information about certain actions, for example, payments, your use of electronic communications (such as whether and when you opened an email), your use of our websites (such as your location and other information when you use a website of ours; please see the relevant separate privacy policies), your purchases of products and services from us, your interaction with our social media profiles, contacts with intermediaries and your participation in events, competitions contests and similar events.

Preference data tells us, for example, what your likely needs are, what products or services might be of interest to you, or when and how you are likely to respond to messages from us; this helps us to get to know you better, tailor our advice and offers more accurately to you and generally improve our offers. We obtain this information from analysis of existing data such as behavioral data.... In order to improve the quality of our analyses, we may combine this data with other data that we also obtain from third parties such as address dealers, websites and government offices; this may include information on your household size, income class and purchasing power, shopping behavior, contact details of relatives and anonymous information from statistical offices.

Communication data: This is data relating to our communications with you and information concerning your use of our website (for further details of this, please see the separate privacy policy at www.zurich.ch/datenschutz). If you contact us via the contact form, email, telephone or chat, by letter or by any other means of communication, we record the data that is exchanged between you and us, your contact details and other information about the communication (metadata). If we record telephone conversations, we will draw your attention to this fact. If we want or need to establish your identity, for example, in the context of a request for information, application for media access, etc., we collect data to identify you (such as a copy of an identity document). 

Communication data includes your name and contact details, the manner, place and time of the communication and its content, such as details in emails or letters from you or to you or from third parties or to third parties, if the latter also relate to you. We collect communication data, for example, when you contact us via our Customer Service or a Customer Consultant or via a website or app, or chatbot on the internet. 

Other data: We also collect data from you in other situations, which we cannot exhaustively list in this Privacy Policy. 

For example, data (such as files or evidence) accrues in connection with official or judicial proceedings, and some of this may also relate to you. We may also collect data for health protection reasons (for example, in the context of protection concepts). We may obtain or produce photographs, videos and audio recordings in which you may be identifiable (for example, at events, via security cameras etc.). We may also collect data about who enters certain buildings and when (including in the case of access controls, on the basis of registration data or visitor lists, etc.), who participates in events or campaigns (such as competitions) and when or who uses our infrastructure and systems .

We obtain the above information from you, but may also obtain it from third parties.

These third parties may include other Zurich Group companies and intermediaries, credit reporting agencies, media monitoring companies, financial service suppliers and banks from which you transfer assets to us or make transfers to us, address dealers, internet analysis services, public authorities, other insurers, parties to proceedings and publicly available sources such as the commercial register, media and sources on the Internet, public registers, media, etc.

The data we process in accordance with this Privacy Policy relates not only to our customers, but also partially to third parties (you will find information on this in sub-paragraph 1). If you provide us with information about third parties, we shall assume that you are authorized to do so and that the information is accurate. By transmitting data about third parties, you confirm this fact. Therefore, please inform these third parties about our processing of their data and provide them with a copy of this Privacy Policy or the Customer Information Sheet on Data Protection. If we refer you to a new version of these documents, please also hand over these new versions in each case. 

With the exception of certain individual cases, such as in the context of binding protection concepts (legal obligations), you are not obliged to disclose data to us. However, for legal and operational reasons, we must process extensive data to establish and process the contractual relationship, inclusive of claims settlement. If you do not wish to provide us with this data (in particular master data, contract and claims data, financial data and general behavioral data), we will therefore not be able to review, enter into or continue a contractual relationship. When using our website, it is not possible to avoid technical data processing. If you wish to gain access to certain systems or buildings, you will need to provide us with registration details.

We only make certain offers available to you – such as the use of a Zurich online portal or that of one of our partners, online claims reporting or participation in a virtual event – when you provide us with registration data, because we or our contractual partners want to know who is using our services or has accepted an invitation to an event, because it is technically necessary or because we want to communicate with you. If you or someone you represent (such as your employer) wish to enter into or perform a contract with us, we need to collect relevant master, contract  and communication data from you, and we process technical data when you use our website or other electronic offers. If you do not provide us with the data required to conclude and perform the contract, you must expect that we will refuse to conclude the contract, that you will be in breach of contract or that we will not be able to perform a contract. Likewise, we can only send you a response to a request you have made if we process the relevant communication data and, if you communicate with us online, technical data as well. It is not possible to use our website without us receiving technical data. And when you interact with us or we interact with you, behavioral data is generated. 

In particular, we process your personal data for the following purposes, which must be agreed upon:

We process personal data to fulfill legal and regulatory requirements and to comply with laws, directives and recommendations imposed by authorities, as well as internal regulations (Compliance).

This includes, among other things, the legally regulated combating of money laundering and the terrorism financing. In certain cases, this may oblige us to make inquiries (Know Your Customer) or to file reports. The fulfillment of disclosure, information or reporting obligations – such as  in connection with supervisory and tax obligations – also presupposes or entails data processing, for example, in the context of automatic information exchange, fulfillment of archiving obligations and to support of the prevention, detection and clarification of criminal offenses and other violations. This includes receiving and processing complaints and other reports, monitoring communications, conducting internal investigations or disclosing records to a government agency when we have a material reason are legally required to do so. Your personal data may also be processed in the course of external investigations, for example by a regulatory authority. For these purposes, we process, in particular, your master data, your contract and claims data and financial data, communication data and, under certain circumstances, behavioral data. The legal obligations can stem from Swiss law as well as foreign provisions to which we are subject, as well as self-regulations, industry standards, our own corporate governance and official instructions and requests.

We also process data for the purpose of concluding the contract including risk clarification as well as for processing the contract and administration. In addition, we also process data to settle claims or benefits as well as to enforce recourse claims. We can also carry out profiling in this context (see sub-paragraph 5).

When concluding a contract, personal data – in particular master data, contract data, financial data and communication data – are collected from potential customers for the purposes of consultation and risk assessment (for example, in an application form). This information is checked for compliance with legal requirements (such as for compliance with anti-money laundering and anti-fraud regulations). When concluding a contract, under certain circumstances we also process particularly sensitive data, such as health data, for the consultation, the risk assessment and the premium calculation.

When processing contractual relationships, we process data for the purposes of managing the customer relationship, to settle claims or benefits, to provide advice and for customer care (including to measure and document the compensation of intermediaries). This also includes reviewing claims and benefits. In particular, we also process claims data, including health data, data that we obtain from third parties such as external experts and doctors (for more information on this, please see sub-paragraph 3) and other data that arise in the context of these purposes or are required for them. In the event of a claim or benefit, in the event of regress to a liable third party (or its liability insurer), the data required for this purpose may be processed and transmitted. The enforcement of legal claims stemming from contracts (debt collection, court proceedings, etc.) also form part of the processing, as do accounting, termination of contracts and public communication.

In order to conclude contracts and process contractual relationships, we involve third parties, such as IT and logistics companies, advertising service suppliers, banks, other insurance companies or credit reference agencies, who may in turn provide us with data.

When cooperating with companies and business partners, such as partners in projects or cooperating with parties in legal disputes, we also process data to process and initiate contracts, for planning, for accounting purposes and other purposes related to the contract.

We also process data for the purpose of preventing and detecting insurance fraud, preventing the event of claims and benefits and to conduct legal proceedings, for the purposes of our risk management and prudent corporate governance including business organization and development. To this end, we can also use the information systems HIS and Car Claims Info, from which we enter and retrieve data.

For these purposes, we process, in particular, master data, contract and claims data and financial data, as well as communication data and behavioral data. For example, we must take measures against insurance fraud. This includes clarifications in the event of a claim or benefit, which may also be made with third parties such as doctors and experts, querying the HIS information system and – in the case of motor vehicle insurance – CarsClaims info. HIS is a notification and information system operated by SVV Solution AG, Zurich. Participating insurers report certain circumstances that propose investigating an event of a loss in detail and can query corresponding reports from other participating insurers. In the event of a positive query result, we may also share the related data with other participating insurers with your separate consent. Information from HIS will only be used in connection with the claims investigation. For more information about HIS and your corresponding rights, please visit www.svv.ch/de/his . In order to combat fraud in motor vehicle insurance, we may forward vehicle claim information to SVV Solution AG for entry in the electronic Car Claims database. This makes it possible to check whether a registered vehicle claim has already been paid by another insurance company. In the event of a justified suspicion, a corresponding exchange of data may take place between the companies (such as vehicle expertise, compensation agreement). We may also create and process profiles (see sub-paragraph 5) for the above purposes and in order to protect you and us from illicit or abusive activities.

We also process your data for market research purposes, to improve our services and our operation and for product development.

We strive to continuously improve our products and services and to be able to react quickly to changing needs. We therefore analyze, for example, which products are used by which groups of people in what way and design possibilities for new products and services. This gives us an indication of the market acceptance for existing products and services and the market potential of new ones. To this end, we process, in particular, your master data, behavioral data and preference data, as well as communication data and information from customer surveys, polls and studies and other information, such as from the media, from social media, from the Internet and from other public sources. As far as possible, however, we use pseudonymized or anonymized data for these purposes. We may also use media monitoring services or perform media monitoring ourselves, whereby we process personal data in order to carry out media work or to understand and respond to current developments and trends. 

Like all competitive businesses, we also process data such as master data, contract data, behavioral data, preference data and communications data for marketing purposes, such as for personalization and transmitting information on products and services provided by us and third parties and for relationship management. You can refuse such contacts at any time (see the end of this sub-paragraph 4).

For example, we may send you information, advertising and product offers provided by us and third parties in the insurance and other sectors as well as newsletters and other periodic communications, in print or by telephone. Such communications are also made as part of individual marketing campaigns (e.g. events, competitions, etc.). We personalize some of these communications in order to provide you with customized information and offers that meet your needs and interests. To do this, we link data that we process about you, determine preference data and use this data as the basis for personalization (see sub-paragraph 3). We may also carry out profiling for marketing purposes (see sub-paragraph 5). We also process data in connection with contests, competitions and similar events. Customer care also includes addressing existing customers – in a manner that may be personalized on the basis of behavioral and preference data or data from customer surveys – and organizing customer events (such as sponsoring , sports and cultural events and promotional events). In the case of customer events, we process personal data to carry out the events, as well as to inform the participants and to provide them with information and advertising before, during and after the event.

All of this processing is important to enable us to promote our offers in a way that is most relevant to your needs, to personalize our relationships with customers and other third parties and to use our resources efficiently. 

You may object to processing for marketing purposes at any time by notifying us. Automatically generated messages that cannot be customized, such as invoice texts, are excluded from this. Further information on your rights can be found in sub-paragraph 10.

We may also process your data for security purposes and for access control purposes. 

We continuously review and improve the appropriate security of facilities and buildings and our IT. In doing so, we process data, among other reasons, in connection with the surveillance of buildings and publicly accessible premises. Ensuring adequate security is also very important, especially for digitized products. Like all companies, we cannot rule out data breaches with absolute certainty, but we do our best to reduce the risks. We therefore process data, for purposes such as monitoring, control, analysis and testing of our networks and IT infrastructures, to carry out system and error checks, for documentation purposes and in the context of security copies. 

We may process your data for other purposes such as our internal processes and administration. 

These other purposes may include training and educational purposes, administrative purposes (such as the administration of master data, accounting and data archiving or the administration of real estate and the testing, administration and ongoing improvement of IT infrastructure), the protection of our rights (for example, to enforce claims in or out of court and before authorities in Switzerland and abroad or to defend ourselves against claims, for example by preserving evidence, through legal clarifications and by participating in judicial or official proceedings), the evaluation and improvement of internal processes and the general preparation of anonymous statistics and evaluations. In the course of developing our business, we may also sell or acquire businesses, operations or companies to or from other companies or enter into partnerships, which may also result in the exchange and processing of data (including from you, for example, as a customer or supplier or as a supplier representative). This also includes the protection of other legitimate interests, which cannot be named exhaustively.

If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You may withdraw your consent at any time by notifying us in writing; you will find our contact details in sub-paragraph 2. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the relevant purposes unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

We base the processing of your personal data on the fact that the processing is necessary for the preparation and execution of the contract with you or the body you represent (such as the processing of master and transaction data and of financial and risk data for application verification, for fraud prevention, for creditworthiness and borrowing capacity checks, for the processing of transactions, etc.), that it is required or permitted by law, that it is necessary for legitimate interests of us or third parties (such as processing for administrative and security purposes, for credit checks and purposes of market research, marketing, improvement of our services and product development) or that you have consented to the processing.

If we receive data that is particularly sensitive (such as health data), we may also process this data – where necessary – on the basis of other legal grounds, for example, in the event of disputes arising from the necessity to process the data for a possible lawsuit or the enforcement or defense of legal claims. In individual cases, other legal grounds may apply; we will communicate these to you separately where necessary.

For the purposes stated in sub-paragraph 4, we may process and evaluate your data (sub-paragraph3) automatically, i.e. in a manner aided by a computer; we may also do so to determine preference data, as well as to determine risks of misuse and security, to carry out statistical evaluations or for operational planning purposes. These processing operations also include profiling.  

Profiling is the automated processing of data for analysis and forecasting purposes. The most significant examples are profiling for the purpose of combating money laundering and terrorist financing, for combating abuse, for checking creditworthiness, for individualized risk measurement and  assessment as a necessary basis for calculating the insurance contract, for customer care and for marketing purposes. For the same purposes, we may also create profiles, i.e. we may combine behavioral and preference data, as well as master, contract data and technical data assigned to you, in order to better understand you as a person and your different interests and personal needs. In both cases, we pay attention to the appropriateness and reliability of the results and take measures against misuse of these profiles or profiling. 

In order to ensure the efficiency and uniformity of our decision-making processes, we can also automate certain decisions, i.e. make these with the aid of a computer according to certain rules and without review by an employee. 

In each individual case, we will inform you if an automated decision creates negative legal consequences or a comparable significant impairment. In this case, you shall have the rights set out in sub-paragraph 10 if you do not agree with the outcome of the decision.

Our products and services are provided and handled in cooperation with third parties and service suppliers who may consequently receive data about you. In particular, data disclosures may be necessary in connection with claims settlement and for clarifications with third parties and in this relation. Below you will find an overview of the categories of recipients to whom we may disclose personal data. For further information, please refer to sub-paragraph 3 and 4. 

Settling of claims: In connection with claims processing and the associated clarifications, personal data is passed on to the involved third parties, such as authorities, experts and information centers. 

When settling claims and making corresponding clarifications, personal data may be disclosed to, for example, doctors and other service suppliers, experts, information services such as SVV Solution AG (in connection with the Car Claims Info and HIS systems; see sub-paragraphs 3 and 4), authorities, courts, information clerks and lawyers.

Other insurers: We exchange data with other insurers, such as with previous insurers, co-insurers and reinsurers, as well as with social security institutions.

In the interest of all policyholders, data is exchanged with previous insurers, co-insurers and reinsurers in Switzerland and abroad for the purpose of risk assessment and distribution. One example of this is previous insurers, whom we query as to whether a claim was insured with them and whether benefits were paid, under disclosure of your personal details (such as surname, first name, address and date of birth). We can also exchange data with social insurers or liability insurers, especially in the case of recourse. In connection with the settlement of claims, we may also – with your separate consent, if necessary – exchange related information with other insurers. You will find further information on this under sub-paragraphs 3 and 4.

Insurance brokerage: We provide insurance intermediaries (such as general agencies and other bound and unbound intermediaries) with the information they need to serve you, advise you and market our products.

In addition to master data, this may include information on the period of insurance, the performance and  termination of the contract, the sum insured and coverage, claims data, information on the assessment of compensation and information for the – also personalized – marketing of our products. Intermediaries are required by law and contract to comply with the provisions of the Swiss Data Protection Act 

Address verification, credit check and debt collection: We may involve third parties to carry out address and credit checks and debt collection. 

We may involve third parties to carry out address verification, credit checks and for debt collection purposes and disclose data, such as that concerning outstanding debts and your payment history, to them in the process.

Companies of the Zurich Group: We may transfer personal data to other companies in the Zurich Group. 

Where necessary, we may share your information with other companies belonging to the Zurich Group, in particular for the purpose of risk measurement and  assessment and the provision of reinsurance solutions. In order to offer you the best possible insurance coverage and individualized financial solutions, we may disclose your data – in particular your master data, contract data and registration data as well as behavioral and preference data – to other companies belonging to the Zurich Group for the purpose of offering products and services tailored to your individual needs.

Public authorities and agencies: We may disclose personal data to public authorities, agencies, courts and other public bodies if we are legally obliged or entitled to do so or if this is necessary to protect our interests.

In the context of exercising of rights, defense of claims and fulfillment of legal requirements, we may disclose personal data to public authorities, agencies, courts and other public bodies, for example in the context of official, judicial and pre- and extra-judicial proceedings and in the context of legal obligations to provide information and to cooperate. Data is also disclosed if we obtain information from public bodies, for example, in connection with claims processing. Public authorities are responsible for processing data about you that they receive from us.

Additional individuals: Where third parties become involved due to the processing purposes pursuant to sub-paragraph 4, data may also be disclosed to other recipients on the basis of your separate consent or due to legal or regulatory requirements, directives and recommendations made by authorities or internal regulations.

We may disclose data, for example, to individuals involved in proceedings before courts or authorities (for example, in the case of regress to the liable third party or its liability insurer), as well as potential purchasers of companies, receivables and other assets and, in the case of securitizations, to financing companies and to other third parties, about whom we will inform you separately where possible, for example, in declarations of consent or special privacy policies. Other individuals include, in particular, payment recipients, authorized representatives, correspondent banks, other financial institutions and other bodies involved in a legal transaction. 

Service suppliers: We work with service suppliers at home and abroad who process data about you on our behalf or in joint responsibility with us or receive data about you from us within their own sphere of responsibility. This may also include health data.

We procure services from third parties to ensure that we can deliver our products and services securely and cost-effectively and that we can concentrate on our core competencies. These services include, for example, IT services, the dispatch of information, marketing, sales, communication or printing services, facility management, security and cleaning, the organization and holding of events and receptions, debt collection, credit agencies, anti-fraud measures and services provided by consulting firms, auditing firms and claims service suppliers. In each case, we provide service suppliers with the data necessaryfor their services. One example is hosting service suppliers who store electronic data on our behalf, which may include sensitive data such as health data. These service suppliers are each subject to contractual and/or statutory confidentiality and data protection obligations. They may exceptionally use such data for their own purposes in justified cases, for example, information on outstanding debts and your payment history in the case of credit agencies or anonymized information for the purpose of improving services. 

To the extent provided by law, these categories of recipients may in turn involve third parties, meaning that your data may also become accessible to them. 
We reserve the right to make these disclosures even if they concern confidential data.

In many cases, it is also necessary to disclose confidential data in order to process contracts or provide other services. Even non-disclosure agreements neither generally exclude this type of data disclosure, nor disclosure to service suppliers. However, given the sensitivity of the data and other circumstances, we take care to ensure that these third parties handle the data in an appropriate manner. 

We also allow certain third parties to collect personal data from you on our website and at events organized by us (such as media photographers, providers of tools that we have embedded on our website, etc.). Where we are not decisively involved in these cases of data collection, these third parties are solely responsible for them. If you have any concerns or wish to exercise your data protection rights, please contact these third parties directly.
The aforementioned disclosures to within and outside Switzerland (see sub-paragraph 7) are required for legal or operational reasons. Therefore, legal and contractual confidentiality obligations do not prevent these disclosures.

As explained in sub-paragraph 6, third parties and service suppliers also process your personal data in addition to us. Your data may also be transferred abroad, such as when personal data is transferred to other companies of the Zurich Group or to service suppliers, and possibly also when it is disclosed to third parties involved in the processing of the contract, to co-insurers and reinsurers, authorities and courts and to other bodies. Your data may therefore be processed worldwide, including outside the EU or the European Economic Area (i.e. also in third countries such as the USA). Many third countries do not currently have laws that guarantee a level of data protection equivalent to that provided by Swiss law. We therefore take contractual precautions to contractually compensate for the weaker statutory protection. For this purpose, we generally use the standard contractual clauses issued or recognized by the European Commission and the Swiss Data Protection and Information Commissioner (FDPIC) (for further details and a copy of these clauses, please see https://www.edoeb.admin.ch), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption clause. An exception may apply, in particular, in the case of legal proceedings abroad, but also in cases of overriding public interests or if the processing of a contract requires such disclosure, if you have granted your consent or data is concerned that you have made generally accessible and whose processing you have not objected to.

Many countries outside Switzerland or the EU and EEA currently do not have laws that guarantee an adequate level of data protection from the perspective of the Swiss Federal Acton Data Protection or the GDPR. The contractual arrangements mentioned above may partially compensate for this weaker or missing statutory protection. However, contractual precautions cannot eliminate all risks (with particular regard to state intervention abroad). You should be aware of these residual risks, even though the risk may be low in individual cases and we have taken additional measures (such as pseudonymization or anonymization) to minimize it. 

Please also note that data exchanged over the Internet is often routed via third countries. Your data may therefore be sent abroad even if the sender and recipient are in the same country.

We store your data for as long as our processing purposes, the legal retention periods and our legitimate interests in processing for documentation and evidence purposes require this or the storage is technically necessary. 

Therefore, the period for which we retain data depends on legal and internal regulations and on the purposes of processing (see sub-paragraph 4), which also include the protection of our interests (for example, to enforce or defend claims, for archiving purposes and to ensure IT security). 

Documentation and evidence purposes include our interest, processes, interactions and other facts in the event of legal claims and other discrepancies, for IT and infrastructure security purposes and to provide evidence of good corporate governance and compliance. Retention may be technically necessary if certain data cannot be separated from other data and we therefore need to retain it with this other data (such as in the case of backups or document management systems).

We handle your data confidentially and take appropriate technical and organizational security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to protect it against the risk of loss, accidental alteration, unauthorized disclosure or access. We use recognized security standards such as ISO 27001 as a guide.

Our security measures include measures such as encrypting and pseudonymizing data, logging, access restrictions, storage of backup copies, instructions to our employees, confidentiality agreements, audits, etc. We also oblige our contracted data processors to take appropriate security measures. In general, however, security risks cannot be completely ruled out; certain residual risks are unavoidable. 

When your data is transmitted via our web pages, we protect it during transport using suitable encryption mechanisms. However, we can only secure areas that are under our control. 

If you contact us by email, you do so at your own risk and agree that we may respond to you to the sender's address via the same channel. If you send us emails via the Internet in unencrypted form, third parties may be able to access, view and manipulate them. 

In addition, we take appropriate technical and organizational security measures to reduce the risk within our Internet pages. However, your end device is outside the security area that lies within our control. You are therefore required to learn about the necessary safety precautions and to take appropriate measures in this regard.

Applicable data protection law grants you the right to object to the processing of your data in certain circumstances, in particular for direct marketing purposes, profiling used for direct marketing and other legitimate interests.

In order to give you more control over the processing of your personal data, you have various rights in connection with our data processing:

• the right to request information from us as to whether we are processing your data, and which we are processing;
• the right to have us rectify data if it is inaccurate;
• the right to object to our processing for specific purposes and to request the deletion of data unless we are obliged or entitled to continue processing it;
• the right to obtain from us the disclosure of certain personal data in a commonly used electronic format or to request that we transfer this to another controller;
• the right to revoke consent, where our processing is based on your consent. 

If we inform you about an automated decision (sub-paragraph 5), you have the right to express your position on this and request that the decision be reviewed by a natural person. 

Please note that certain conditions must be met in order to exercise these rights and that exceptions or restrictions may apply (e.g. to protect third parties or trade secrets). We will inform you accordingly where necessary.

In particular, we may need to process and store your personal data in order to perform a contract with you, to protect our legitimate interests, such as the assertion, exercise or defense of legal claims, or to comply with legal obligations. To the extent legally permissible, in particular to protect the rights and freedoms of other data subjects and to safeguard sensitive interests, we may therefore also reject a data subject’s request in whole or in part (for example, by blacking out certain content relating to third parties or our trade secrets). 

If you wish to exercise any rights against us, please contact us in writing (see sub-paragraph 2). To enable us to rule out abuse, we must identify you (such as with a copy of an identity card, if not otherwise possible). You also have these rights in relation to other bodies who work with us under their own responsibility – please contact them directly if you wish to exercise any rights in relation to their processing. 

If you do not agree with our handling of your rights or data protection, please let us know at the contact details listed under sub-paragraph 2. You can contact the Swiss supervisory authority here: www.edoeb.admin.ch and the Liechtenstein Supervisory Authority at www.datenschutzstelle.li.

This Privacy Policy does not form part of any contract with you. We may amend this Privacy Policy at any time. The version published on this website is the current version.