Justitia Privacy Statement

Since 1948, Justitia NV has been the specialised insurance company for healthcare. Justitia has close links with the insurance broker Vanbreda Risk & Benefits and specialises in insuring customised Employee Benefits plans that are developed by Vanbreda Risk & Benefits to suit the individual companies holding the policy.

Depending on the situation, we may process the following personal data: your identity data, your contact data, health data, financial data, social security number, and so on. We process this personal data solely for one of the reasons listed under point 4.

3.1 You have the right to access your personal data

If you want to know whether Justitia processes your personal data, and if so which data, you can ask to access it. Justitia will then provide you with the most comprehensive list possible of the personal data being processed in its open files. Given the large volume of personal data processed by Justitia, we ask you to specify which information or which processing activities your request relates to. Personal data which only exists in back-up or log files, or which cannot be directly linked to you, will not be included. Given the sensitivity of health data, this is not sent by default. In this case, we ask that you give us details of a doctor to whom we can send the data so that they can make the data available to you.

3.2 You can have your personal data corrected

If it appears that the personal data we are processing about you is incomplete or not (or no longer) correct, you can correct or complete said data (or have this done).

3.3 You can sometimes have your personal data deleted

Your personal data is automatically deleted over the course of time. You will find a more detailed explanation of this under point 6. If you believe that your personal data should not be processed, you can ask Justitia to delete said data sooner.

3.4 You can object to certain uses of your personal data

Due to a certain situation in which you find yourself, it may be that you cannot agree to any processing on the basis of Justitia’s legitimate interests. In this case, you can object to the processing of your personal data and Justitia will have to consider the merits of your specific interests as well as its own. Only if there are imperative, legitimate reasons that outweigh your interests (e.g. combating fraud) or in the context of a (future) legal claim, will Justitia continue to process your personal data.

If you object to the processing of your personal data for direct marketing, Justitia will end all processing for this purpose.

3.5 You can oppose certain uses of your personal data

You can ask Justitia to restrict the processing of your personal data if, for example, time is needed to check the accuracy of your personal data, where the processing is not legal, if Justitia no longer requires this personal data (but you do in the context of a legal claim) or if you have raised an objection to a specific type of processing and the consideration of competing interests still needs to be carried out.

3.6 You can ask for your personal data to be transferred to another party

For personal data that you have provided to Justitia, and data that was obtained with your consent or on the basis of a contract and which is being processed by an automated procedure, you can ask that it be transferred to you or someone else.

3.7 You can sometimes reject decisions being taken on the basis of automated processing

In some of our processes, decisions are taken without any human intervention. An example of this is the reimbursement of a claim for which it is clear even to a computer that for the specific situation a reimbursement is obviously the outcome. You are informed of the existence of this kind of automated decision-making and of the underlying logic used as part of the process itself or under point 7 of this privacy statement. You can always get in touch with your contact person at Justitia if you have any questions about these automated decision-making processes or if you do not agree with a decision and wish to provide additional information.

3.8 You can withdraw your consent

You can withdraw your consent at any time for the personal data processed by Justitia on the basis of your consent. If you withdraw your consent, Justitia may no longer be able to provide certain services.

3.9 How can you exercise these rights?

If you wish to exercise any of these rights, it is important for you to:

• formulate your question to Justitia clearly (including which information or activity your request relates to, which type of insurance, your customer number, and so on);
• provide proof of identity (e.g. using a copy of an identity card).

Depending on the scope and impact of your request, Justitia may ask for additional information.

We recommend that you send your request to your contact person at Justitia.

For questions or complaints about exercising your rights, you can also address the Justitia Data Protection Officer using our form, by e-mail at dpo@Justitia.be or by post to Justitia NV, F.A.O. Data Protection Officer, Plantin en Moretuslei 301, 2140 Antwerp, Belgium.

You can find more information about the legislation relating to the protection of personal data at www.dataprotectionauthority.be, the website of the Belgian Data Protection Authority. You can also submit complaints to them.

4.1 To meet legal obligations

Justitia needs certain personal data in order to meet its legal obligations. If it does not have this data available, it cannot sign or renew any contracts with you, or carry out a transaction that was requested by you or by a third party for your benefit.

Legal provisions pursuant to which Justitia must process your personal data include:

• Insurance legislation, in particular the law of 4 April 2014 and the law of 2 August 2002 relating to the supervision of the financial sector and financial services
• Anti-money laundering legislation, in particular the law of 18 September 2017
• Sanctions legislation, in particular Regulation (EC) No 2580/2001
• Accounting and tax obligations

4.2 To be able to conclude and implement contracts with you

Some personal data is needed to be able to sign a brokerage contract or to provide the service you expect from Justitia in connection with the performance of the contract to which you are a party.

Justitia’s services include offering and concluding insurance contracts and the performance of said contracts. It assists with the preparation of claims and may, if necessary, appoint experts or contact other affected parties and provide them with your personal data.

If you want to make use of a third-party payment system, Justitia will also need to process your personal data.

4.3 For the correct provision of our services

Justitia will also process your personal data to further its legitimate interests.

Processing for this reason includes, among other things:

• Customer management
• Central administration within Justitia
• General business management
• Risk management, combating fraud and compliance
• Legal support and defence of our rights
• Quality control and improvement of our services
• Internal audit
• IT support for other purposes (such as use of pseudo-anonymised data for testing programs, searching for the causes of and solutions for IT problems, and so on)
• Network and information security, including access controls
• Studies and statistics
• Analysis and use of the website, apps, and other features with a view to improving our products and services
• Direct marketing to existing customers (commercial mailings, invitations to events and seminars, sending out surveys, and so on)

For this processing, Justitia will always balance its own interests against your rights and reasonable expectations. If you do not agree with one of the above forms of processing, you may lodge an objection as described under point 3.

4.4 For the smooth provision of our services to our clients and reinsurers

Justitia will also process your personal data to further the legitimate interests of third parties such as clients, employers and reinsurers. This will only be the case if the interest of the other party outweighs the impact on your rights and reasonable expectations,

Wherever possible, this data is communicated to the parties involved on an anonymised basis.

4.5 To carry out direct marketing

Justitia wants to offer you products and services that are relevant to you. In addition, we also see it as our duty to inform you of new business risks that may, for example, threaten the continuity of your company.

In order to give you the best possible advice, Justitia will use the data that it has available. Justitia uses your personal data to carry out direct marketing. By analysing your personal data, Justitia can offer you a personalised approach and present you with specialised proposals. If you would prefer for us not to do so, you can always let us know.

4.6 Because you have provided us with your consent

Certain personal data will only be processed because you have provided Justitia with your consent for us to do so. You can withdraw your consent at any time, without providing any justification.

The withdrawal of consent means that this processing, based on your consent, will no longer be possible in future. The withdrawal of your consent does not mean that processing that occurred in the past on the basis of your consent is no longer valid.

Your personal data can reach Justitia in a number of ways:

1. You may have shared your personal data yourself, initially or in the course of our collaboration.
2. Justitia received your personal data from someone close to you (such as your family).
3. Justitia received your personal data as part of the performance of a contract with your employer, where you were an insured person, beneficiary or contact.
4. Justitia found said personal data in a public source (e.g. the Belgian Official Gazette, LinkedIn, and so on).
5. Justitia purchased said data from third parties, e.g. prospect databases to which you had given your consent.
6. Someone else provided your personal data to Justitia as part of the performance of an insurance contract or the management of a claim.
7. Someone else provided your personal data to Justitia as part of a contract between Justitia and said third party (e.g. a hospital invoice that AssurCard passed directly on to Justitia).
8. Your personal data reached Justitia indirectly (for example from surfing our website).

If you provide Justitia with someone else’s personal data, it is important that this person is informed about it and referred to this privacy statement.

Justitia may provide your personal data to parties involved in the performance of a contract or policy. Such parties may include medical and other experts and consultants, banks, health insurance funds and reinsurers.

Your medical data is handled with particular care. In order to avoid processing any unnecessary data, we ask everyone to respect the agreements in the insurance policy.
If Justitia shares this data with a third party (e.g. your own doctor), this is only in the context of the performance of a contract, paying for a claim or acting on your request.

Justitia may also provide your personal data to parties involved in handling a claim. Such parties may include medical or other experts, consultants as well as banks and reinsurers.

In order to provide its services as smoothly as possible, Justitia uses a number of suppliers and subcontractors. In order to perform their tasks correctly, it may be that they are given access to your personal data. By signing a data processor contract with them, Justitia defines very clear limits about what your personal data may be processed for, and where. In addition, Justitia imposes the necessary security standards.

If Justitia is required by law to do so, it will share your personal data with public authorities.

Note: Justitia will never sell your personal data.

Justitia endeavours to process your personal data within the European Economic Area to the extent possible, unless the performance of a contract (for instance contact with a local expert for a claim abroad) requires otherwise. If this is not the case, Justitia will inform you about it.

Justitia uses automated data processing in some processes to increase the speed, reliability and efficiency of its services. In limited cases (see below), there is an automated decision-making process that has consequences for the insured. These processes are subject to manual review on a sample basis. You have the right to ask for human intervention for these processes at any time, indicate your opinion or challenge the automated decision. Please get in touch with your contact person or the Data Protection Officer in this regard.

Justitia will only retain your personal data for as long as Justitia needs said data for the performance of its tasks and the representation of its interests.
We will delete your data in our active systems at the latest on the expiry of the liability period for potential complaints.

Your data is stored in our back-up systems until it is removed from the storage system. When a back-up system needs to be used, the data that is no longer needed for the defined tasks is first removed from the active systems.

Justitia uses Google Analytics to collect data about the use of the website and uses this data to prepare statistics and detailed reports. This information is collected using cookies to optimise the website according to patterns of user behaviour.

The information that is collected is transmitted directly to Google’s servers in the United States. The information is also stored there. To prevent data being traced back to specific users, the users’ IP addresses are transmitted to Google and anonymised there before use. These (anonymised) IP addresses will never be processed in conjunction with other data from the user. In this way, data is only collected from anonymous groups and not from individual users.

In addition, Justitia does not collect demographic data from its users via Google Analytics, and no additional data is collected for advertising purposes. No user IDs are kept, and no personally identifiable information is displayed anywhere in the website’s URLs.

Google acts as the processor for our data, and a processing agreement has been concluded with Google for this role. Google has not been granted permission to use the data on Justitia’s website for its own purposes, such as displaying advertisements.

The data Google Analytics collects is therefore anonymous and is only used to help optimise the user experience of the website. The information that we collect:

• Title and URL of the pages that the user visits
• Information about the user’s browser, operating system and screen resolution
• User information: user’s language and location based on their browser settings and IP address. This location will be a rough estimate because the IP address is truncated
• The platform or website through which the user accesses the Justitia website, the amount of time the user spends there, the number of pages they visit, and the date and time of this visit

Justitia’s website also uses Google Tag Manager. This Google Inc. tool allows different tags to be placed on the website. Google Tag Manager does not itself use any cookies or collect information from its users.

For any questions and problems relating to the processing of your personal data, you can contact our Data Protection Officer (DPO) at dpo@justitia.be or by post at Justitia NV, F.A.O. Data Protection Officer, Plantin en Moretuslei 301, 2140 Antwerp.

dpo@Justitia.be

Date of publication: 15 July 2019