Privacy Policy

Línea Directa Aseguradora S.A. Privacy Policy

Introduction

If you wish to review a brief version of our privacy policy, you can consult our basic information. In case you have any doubts about any expression used, we have also included a glossary of privacy terms on our website, highlighting the concepts and expressions that you can consult.

There are processing activities for which Línea Directa is jointly responsible with other insurers, in order to manage the Shared Insurance Information Systems as required by law and promoted by UNESPA (Unión Española de Entidades Aseguradoras y Reaseguradoras). These activities are governed by a Code approved by the Spanish Data Protection Agency. In other processing activities, the sole responsible party is Línea Directa. For the former, in addition to what is indicated in the basic information, additional information is available on the UNESPA (www.unespa.es) and TIREA websites (www.tirea.es). For the latter, we present the following additional information.

Who will process my data? Information and contact for the Controller

The responsible party is Línea Directa Aseguradora S.A. Compañía de Seguros y Reaseguros, S.A., with Tax ID code (CIF) A-80871031 and registered address at Ronda de Europa, 7, Tres Cantos, Madrid, C.P. 28760. You can contact us by post, by email at privacidad@lineadirectaaseguradora.com or by phone on 917 700 700.

How do I contact the Data Protection Officer?

The Data Protection Officer (hereinafter DPO) is the person responsible for safeguarding your privacy and overseeing compliance with the regulations. To do this, we have created a Data Office. If you need to contact the DPO you can do so at dpo@lineadirectaaseguradora.com or by writing a letter addressed to the “Data Protection Officer”.

What are my rights?

  • Access: right to obtain confirmation as to whether personal data is being processed and, if so, the right to access such data and the additional information referred to in Article 15.1 of the GDPR.
  • Rectification: right to have inaccurate data corrected and to have such data completed, in accordance with Article 16 of the GDPR.
  • Erasure or cancellation: a right that may be exercised when, among other reasons, the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, or in other circumstances as set out in Article 17 of the GDPR.
  • Restriction: You may, in the cases provided for in Article 18 of the GDPR, request the restriction of the use of the data, in which case it will only be kept for the exercise or defence of claims, compliance with judicial requirements or for the protection of the rights of another person, or for reasons of important public interest of the Union or a Member State, or to meet legal requirements.
  • Data portability: the right to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another data controller of your choice, in accordance with Article 20 of the GDPR.
  • Objection: In certain circumstances you may request that your data not be processed for certain purposes, especially for its use for commercial or marketing purposes, for which you may always object, all in accordance with Article 21 of the GDPR.
  • Human intervention: In cases where automated decisions are made that produce legal implications for you, or significantly affect you, you have the right to obtain human intervention to whom you can express your views on such decisions, and you have the right to challenge these, in accordance with Article 22.3 of the GDPR.
  • Withdrawal of consent: When the processing is based on your consent, you have the right to withdraw that consent at any time, without any adverse consequences, in accordance with Article 6.3 of the GDPR.
    If data processing is carried out through the acceptance of “cookies” and/or similar technologies, you may withdraw your consent or configure them by using the cookie settings panel available on our website.
    Lodging a claim. You have the right to file a complaint, either to our Data Protection Officer (DPO) (dpo@lineadirectaaseguradora.com), or to the Spanish Data Protection Agency, without prejudice to the powers that may be held by other regional or supranational bodies.
Right to obtain confirmation as to whether personal data is being processed and, if so, the right to access such data and the additional information referred to in Article 15.1 of the GDPR.
Right to have inaccurate data corrected and to have such data completed, in accordance with Article 16 of the GDPR.
A right that may be exercised when, among other reasons, the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, or in other circumstances as set out in Article 17 of the GDPR.
You may, in the cases provided for in Article 18 of the GDPR, request the restriction of the use of the data, in which case it will only be kept for the exercise or defence of claims, compliance with judicial requirements or for the protection of the rights of another person, or for reasons of important public interest of the Union or a Member State, or to meet legal requirements.
The right to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another data controller of your choice, in accordance with Article 20 of the GDPR.
In certain circumstances you may request that your data not be processed for certain purposes, especially for its use for commercial or marketing purposes, for which you may always object, all in accordance with Article 21 of the GDPR.

When the processing is based on your consent, you have the right to withdraw that consent at any time, without any adverse consequences, in accordance with Article 6.3 of the GDPR.


If data processing is carried out through the acceptance of “cookies” and/or similar technologies, you may withdraw your consent or configure them by using the cookie settings panel available on our website.

Lodging a claim. You have the right to file a complaint, either to our Data Protection Officer (DPO) (dpo@lineadirectaaseguradora.com), or to the Spanish Data Protection Agency, without prejudice to the powers that may be held by other regional or supranational bodies.

In cases where automated decisions are made that produce legal implications for you, or significantly affect you, you have the right to obtain human intervention to whom you can express your views on such decisions, and you have the right to challenge these, in accordance with Article 22.3 of the GDPR.

How can I exercise my rights and resolve any doubts?

You may submit your rights request in writing addressed to Línea Directa Aseguradora, S.A., at Tres Cantos, Madrid, Ronda de Europa 7, C.P. 28760 or by sending an email to: privacidad@lineadirectaaseguradora.com. Please note that we will not ask you to provide additional information, such as official documents (DNI (Spanish ID)), NIF (Tax ID) or NIE (Foreign National ID), when your contact details and identity have already been verified, unless we request it because there may be reasonable doubts about your identity, in order to protect you and ensure the confidentiality of your information. If it is necessary to provide an image of these documents, for your security, please include black and white images, front side only. You may pixelate or blur your signature, the CAN, or you may even add text indicating that this image is to be used solely by Línea Directa for the exercise of your rights. If, after sending the image, there are still doubts about your identity, we will request further information. In such cases, please ensure that essential data allowing us to verify your identity with the document, such as your name, surname and document numbers, are not covered or removed. This data and image will only be used to verify your identity and only if we have requested it after assessing the specific case.

If you have any doubts, or if you do not consider that you have been properly attended to, please do not hesitate to contact us and submit your complaint via the following email address privacidad@lineadirectaaseguradora.com or by post addressed to the address provided above.

Legitimacy. Why is my data processed? Compatible processing activities

In section 8, we have shown the corresponding legal basis for each processing purpose, i.e. the justification or basis that allows such processing to be carried out.

In general, and by way of summary, we inform you that there are certain processing activities necessary to execute your contracts or requests, or to comply with regulations. The regulations to be complied with include, in particular, Law 20/2015, of 14 July, on the regulation, supervision and solvency of insurance and reinsurance companies, Law 50/1980, of 8 October, on Insurance Contracts, and Royal Decree-Law 3/2020, of 4 February, which transposes Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution, as well as the rules implementing these laws.

In addition, we carry out other processing activities, which we refer to as voluntary because you have the right to object to them, or give or withdraw your consent, as the case may be, as we will indicate for each specific situation. These processing activities may be based either on law, or on satisfying a legitimate interest or on your consent. We have considered all of them to be compatible processing activities , as their sole purpose is to improve our products and services, as well as to send you advertising that is as well suited to you as is possible, in line with what is standard in the industry.

Origin. Where does my data come from?

The following table shows the different sources from which your data may originate. The mere fact that we mention them does not mean that such a source is used in every processing activity or in your specific case:
ORIGIN OF THE DATA
DESCRIPTION

Data provided by you and/or generated through your relationship with us.

The information you provide when you request, take out or maintain products and/or services with us, either directly or through third parties authorised by you. Likewise, the data generated when you use our services is included, such as queries, transactions, operations, quality or commercial surveys, or requests you process during your calls, their transcripts, or in other types of communications. Finally, this also includes data shared with us in order to provide you with, or as a result of having provided you with, a service, such as through healthcare providers, appraisers, or other professionals used in the course of your policy coverage or through the company’s loyalty programme.

Legitimate external sources of information

Information included, provided its use is lawful, in files that may be consulted by any person not prevented by a restrictive regulation or with no requirements other than, where applicable, the payment of a fee, such as that published in newspapers, the media, official bulletins, professional associations, directories and/or public registers, such as the Land Registry, Directorate General of Traffic, Commercial Registry or Property Registry. This also includes information provided by private entities that legally report data about the insured object and, in general, risk indicators for claims, such as Carfax, Experian Iberica, Asexor, Lexis Nexis, as well as third-party companies to whom you have given your consent to transfer your data to us or, in general, to insurance companies. In certain cases, where permitted by law, we may consider including any data that you have clearly made public. The use of any of these legitimate external sources will require prior assessment of the compatibility of the intended purpose of the processing with the purpose that justified the publication of the publicly accessible information.

Credit reports

Information provided by specialist companies on creditworthiness, fulfilment or non-fulfilment of obligations, defaults and, in general, indicators of financial or credit risk, in particular Asnef Equifax and Badescug Experian. Likewise, when calculating premium prices, Línea Directa will consult asset solvency files relating to compliance or non-compliance, or propensity to comply or not comply, with monetary obligations. If the Policyholder appears at any time in any of the files consulted, Línea Directa may decide not to take out or not to renew the Policy with that person, without prejudice to their right to make any representations they deem appropriate.

Data from common industry systems

Information that is legally shared in common files in the insurance industry, as provided for by law. In addition, some of these files are subject to a Code of Conduct approved by the Spanish Data Protection Agency, promoted by UNESPA (Spanish Association of Insurance and Reinsurance Companies). Currently, this refers to information included in the Motor Insurance History Information System, the Total Loss, Theft and Fire Information System, and the Fraud Prevention Information System for various insurance types.

What type of data is handled? Categories of data processed

In line with standard practice in the industry, we have grouped together the following categories of data. Remember that merely mentioning these categories when analysing any processing does not imply that all of them are used, or in every processing, or in your specific case.
Name, surname, ID number (DNI, NIE, passport, driving licence number), sex, nationality, residence, date of birth, and language of communication. This category of data may include your voice in the recording of your calls or the image of your signature, except when they are classified as biometric data, in which case consent or legal authorisation will be required.
In general, the use of biometric data is restricted and will not be used unless you have consented or there is authorisation under regulations, as would be the case in some video contracting scenarios. Such data would include the Advanced Digitised Handwritten Signature (FMDA), its image in certain cases for contracting by video identification, or voice biometrics or fingerprint pattern.
Identification codes or passwords, such as unique user IDs and passwords generated for operating on our website, as well as the “IP” addresses from which certain operations are carried out, and logs generated by your activity on our applications.
Postal address, telephone number, as well as email addresses used to communicate with you.
Relating to your compliance or non-compliance with monetary, financial or credit obligations, provided by credit information files such as Asnef and Badexcug.
Your marital and family status, professional or employment information, your home’s features, such as the type of property, its location, whether or not it has a garage to store your vehicle, and membership of professional groups you may have indicated to us. Other statistical data is also included, that is, not about you personally, but relating to the geographical areas where you live, age groups or professional sectors, which we may use to relate or contextualise with the rest of your information.
Any data through which we identify the risk covered by the insurance, such as data relating to your insured vehicle, including registration number, chassis number, model, engine size, value and technical or administrative characteristics, such as your vehicle's “MOT” result, and information regarding the vehicle’s equipment, in particular any driver assistance systems it may have. Data about your insured home, such as address, square metres, land registry reference, value and public land registry data, from the Land Registry. Data relating to your pet or, more generally, any data that identifies the risk you wish to insure.
This data includes quotations and policies taken out with us, number of claims recorded, property and/or personal damage managed within the policies taken out, use of coverages, services provided and, in general, the information you have provided us in your communications and calls. Your activities may also be included in the entity's loyalty programmes and communications with you via any channel, for the purpose of managing our relationship with you.

Data obtained from your browsing on our websites or mobile applications and your activity on them, through cookies and/or similar technologies. When we refer to "cookies" we include:

  1. Cookies themselves, which do not constitute personal data but are simply information generated when visiting a website that you may consent to store on your device, the consultation of which allows us to adapt to your interests as shown by your previous browsing activity.
  2. Pixels, tags or web beacons, which are technologies that do not store information on your device, but only send references of where you have browsed on our website or on third-party sites, enabling you to consent to personalised processing or to be shown tailored adverts based on these sites visited or adverts generated on other websites for our products;
  3. Online identifiers provided by your devices, applications, tools and protocols, such as internet protocol addresses, session identifiers or others, with which you may consent to associate your information in order to transmit your interests or personal profiles;
  4. Social media technologies, such as Facebook or Instagram, which you have accepted to consent to receive advertising for our products, in which case you will have accepted the legal texts of these platforms to receive personalised adverts we show you based on your browsing on them;
  5. Technologies for sharing email and/or telephone in encrypted (hashed) form, enabling you to consent to securely share your hashed email or telephone, that is, converted into an unrecognisable alphanumeric identifier, with specialist companies such as Meta Group social networks (Facebook and Instagram), Google (Adwords, YouTube, DV360), Amazon, Salesforce, Audience Studio, Appnexus, Doubleclick, Bluekai, Exponential or similar online advertising generators, so that you may consent to receive personalised advertising of our products when you use these platforms.
This refers to data relating to your geographical location at a given time, but it will only be collected if you have consented or authorised its use and configured your devices accordingly, i.e. when it is of interest to you.
This refers to identification data for your payment methods, such as bank account number, credit card, payment methods, rejections and failed payments.

Purposes. What is my data processed for?

To make analysis easier, we have grouped the different purposes according to the legal bases that would allow them to be processed. In addition, we have sought to include references to different processing activities, indicating in general terms which categories of data may be used, as well as the possible sources of data initially envisaged.

The mere fact that we mention a category of data or a source of data is for reference only and does not mean that this type of data or source is used in your specific case, as it is normal for processing to be carried out without resorting to all these possibilities. Likewise, for example, in a specific data processing instance you may be informed of the use of other categories of data, or other sources.

Attend to your applications and Policy renewals

  1. Description of purposes
    We will contact you and send you the information you request, by email, equivalent means of communication, post and telephone.
    We will prepare and send you insurance proposals when you request our products, or when it is time to renew your Policies.
  2. Potential data categories
    Identification data, Contact data, Insured object data, Socio-economic and demographic data, Activity data, Asset solvency and credit data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Credit reports; Common systems in the insurance industry for those purposes where they may legitimately be used.

To determine the insured risk and the insurance cost (rating)

  1. Description of purpose
    The law requires us to ensure that premiums are sufficient to cover risks, so in order for the price to be competitive, calculated objectively and impartially, and adjusted in line with the insured risk, the following processing activities are necessary: we will consult external credit reports, insurance industry files and legitimate external sources of information to create a risk profile using automated risk assessment decisions, and which use a scoring logic that takes your information into account. This system is based on applying pre-designed algorithms to each data subject which automatically assign a risk score. This classification allows us to comply with regulatory requirements regarding risk monitoring, creditworthiness control, calculation of regulatory capital, accounting regulations (provisions) and insurance regulations. Notwithstanding the above, if you disagree with the outcome of the assessment, you may challenge the decision by providing any information you consider relevant, as well as requesting the personal intervention of one of our risk analysts.
  2. Potential data categories
    Identification data; Connectivity data; Contact data; Asset solvency and credit data; Socio-economic and demographic data; Insured Object data; Activity data; Browsing data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Credit reports; Common systems in the insurance industry for those purposes where they may legitimately be used.

To enter into and execute contracts, as well as the relationships established with you.

  1. Description of purposes
    1. Account Management: We will manage your access or logins to our applications and store telephone calls and website access that serve to justify the purchase or completion of procedures relating to your services or policy.
    2. Contract completion and execution: Your data will be used to complete the contract, maintain it, renew it and, in short, to manage and monitor the Policies you take out, including the management of claims, complaints and grievances.
    3. Claims against the insurers and parties responsible for a loss and, in addition, once the payment has been made, exercise the rights and actions vested in you as the Insured Person as a result of the loss.
    4. Making any payments due and carrying out the necessary investigations and appraisals for this purpose, in accordance with our policy and commitment to combat fraud.
    5. Management of healthcare assistance: For vehicle Policies, in order to comply with the insurance Policy and its consequences, the law authorises us to (i) use your data, including health data, to determine the healthcare to be provided to the injured party and to set a value for the indemnity when these are to be paid by Línea Directa. (ii) the appropriate payment to health care providers of health care expenses incurred under healthcare insurance contracts, or reimbursement of the Insured party or their beneficiaries.
  2. Potential data categories
    Identification data; Connectivity data; Contact data; Asset solvency and credit data; Socio-economic and demographic data; Insured Object data; Activity data; Browsing data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Credit reports; Common systems in the insurance industry for those purposes where they may legitimately be used.

 

Notification of data to Reinsurance Companies

  1. Description of purpose
    The law enables us to disclose data to reinsurance companies, if any, that are strictly necessary for the conclusion of the reinsurance contract under the terms set forth in Article 77 of Act 50/1980 of 8 October 1980 on Insurance Contracts or the performance of related operations, understood as conducting statistical or actuarial studies, risk analysis or research for customers, as well as any other activity related to or derived from reinsurance activities.
  2. Potential data categories
    Identification data; Insured Object data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Common systems in the insurance industry for those purposes where they may legitimately be used.

Creation of technical and statistical models and to provide for provisions

  1. Description of purposes
    Profiling for provisioning purposes. All insurers are required to make accounting provisions (set aside funds) to ensure that, statistically, we will be able to pay any claim for any Insured Party, before it occurs. To do this, we need to create profiles and make automated decisions that allow us to deal with claims that occur and to anticipate, statistically, whether a claim will occur, something which involves using your data for these purposes in the creation of studies and statistical models. We will prepare and send you insurance proposals when you request our products, or when it is time to renew your Policies.

    To keep your data in a statistical and anonymous form. To set premiums, prevent fraud and assess risk, we must keep your data in a statistical and anonymous form, even after the contract has ended, as this helps us to create statistical models that enable us to fulfil these duties.

    Calibrate our statistical models. To readjust them according to the results obtained in the fulfilment of each contract, including the payment of indemnities or the lack thereof, so that they reflect reality in the setting of premiums, risks, non-payments and, in general, for the best quality of information we are required to handle in accordance with regulations.

    Comply with regulations to analyse principles such as “value for money”, that is, to check that the insurance products we offer you provide adequate value in relation to their cost. In practice, this means that the cover, benefits and performance of a Policy are proportional to the price of the premium and its commissions.
  2. Potential data categories
    Identification data; Connectivity data; Contact data; Asset solvency and credit data; Socio-economic and demographic data; Insured Object data; Activity data; Browsing data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Credit reports; Common systems in the insurance industry for those purposes where they may legitimately be used.

Accountancy and audits

  1. Description of purpose
    We will process your data to keep the accounting records required by the Commercial Code and other applicable provisions, as well as records of accounts, claims, technical provisions and investments, and, where appropriate, to carry out any accounting audits that may be compulsory or advisable in accordance with regulations and industry practice.
  2. Potential data categories
    Identification data; Insured Object data; Activity data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Credit reports; Common systems in the insurance industry for those purposes where they may legitimately be used.

 

Notification of data for supervisory obligations

  1. Description of purposes
    1. Internal communications: the law requires data to be communicated between companies in the same group for compliance with supervisory obligations established by law and for inspections to analyse creditworthiness.
    2. Notification to Authorities: all data may be supervised, and therefore communicated, to the authorities, in particular administrative authorities responsible for ensuring compliance with regulations and creditworthiness, especially to the Directorate General of Insurance and Pension Funds.
  2. Potential data categories
    Identification data; Insured Object data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Common systems in the insurance industry for those purposes where they may legitimately be used.


Notification of data and consultation with Common systems in the insurance industry

  1. Description of purpose
    To adjust the Policy and premium to the insured risk, assess this risk and prevent fraud (a task also carried out in the public interest, all insurers may consult common industry files, and your data must also be communicated to these files).
  2. Potential data categories
    Identification data; Insured Object data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Common systems in the insurance industry.

 

Retention of pre-contractual information

  1. Description of purpose
    Regulations require us to retain documents containing pre-contractual and contractual information that must be provided to the customer for no less than six years.
  2. Potential data categories
    Identification data; Contact details; Data about the insured object.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Resolution of complaints

  1. Description of purpose
    Data will be used to manage the resolution of complaints and any disputes that may arise within the contractual framework between policyholders, insured persons, beneficiaries, injured third parties or the successors of any of these.
  2. Potential data categories
    Identification data; Contact data; Insured Object data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources; Credit information files; Common systems in the insurance industry for those purposes for which they may be used, if applicable.

In accordance with the Guide on the processing of personal data prepared by UNESPA, it should be considered that processing relating to fraud prevention, notifications made to Common systems in the insurance industry, and cooperation with law enforcement authorities for fraud prevention purposes, are not only processing activities covered by law, or which may be necessary for the performance of contracts or in pursuit of specific legitimate interests, but they also serve the fulfilment of a public interest mission.
 

In turn, Law 20/2015 of 14 July, on the regulation, supervision and solvency of insurance and reinsurance companies, establishes the obligation that “Insurance companies must adopt effective measures to prevent, impede, identify, detect, report and remedy fraudulent conduct relating to insurance, whether individually or through their participation in shared files referred to in Article 99.7”.
 

Commitment to combating fraud:

  1. Description of purposes
    Detecting and preventing fraud in general, and also in making payouts when a claim occurs, with regulations authorising the necessary investigations and assessments for this purpose.

    Performing the account ownership verification query on IBERPAY's VALITIC system. Through this system, we will check that the current account provided for payment belongs to the account holder you have indicated, to ensure there are no errors in your payments. If it does not match, we will notify you of the existence of any issue so that you can provide a new current account or another payment method.

    Carry out claims analysis: For this purpose, it may be necessary to create profiles and make automated decisions in risk selection and claim management. This means processing your data to verify the truthfulness of damage to the same asset or insured object, or to check for possible behaviours or patterns of previous claims.

    Review and monitoring of internet access using the same IP address, or the contact details provided, in order to prevent third parties from taking out contracts in the name of others.
  2. Potential data categories
    Identification data; Connectivity data; Contact data; Asset and credit solvency data; Socio-economic and demographic data; Insured object data; Activity data; Browsing data; Geolocation data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources; Data from Common Information Systems in the Insurance Industry.

There is a legitimate interest in processing your data when it is necessary to meet the needs of the responsible or a third party, provided that your privacy does not prevail. This means weighing up this prevalence on a case-by-case basis. In addition, you will always be able to exercise your right to object to processing based on legitimate interest. For some of these processing activities, objections will be accepted automatically and without the need to provide any reason, such as in cases of direct marketing. In other cases, it may be necessary to analyse the reasons. For example, the regulations themselves recognise legitimate interests associated with marketing, or in sharing data within a group of companies for internal administrative purposes, or to prevent fraud.

 

Verifying, completing and correcting data to fulfil contracts and speed up the purchase process.

  1. Description of purpose
    Regulations require us to keep your identification data and any other data necessary for each contract accurate and, where possible, up to date. To do this, your data may be cross-checked, or collected directly, from legitimate external information sources and, in general, from publicly accessible sources. This helps to detect and avoid errors when transmitting information, especially when data is provided by telephone that is not easy to remember, such as certain technical details of the object of insurance (for vehicles, the date of registration or chassis number, model, etc., or for home Policies, some details of the property, such as its land registry reference, correct postal address, etc.). Legitimate interest consists in maintaining data quality, i.e. correct data, while also speeding up the purchase process, something which saves you time, improves the efficiency of our services, and enables us to comply with the contract and regulations.
  2. Potential data categories
    Identification data; Data about the insured object.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources.


Investigations

  1. Description of purpose
    Data appearing in legitimate external information sources and, in general, publicly accessible sources may be consulted and added to your data. The legitimate interest consists in carrying out the necessary investigations permitted by law for the payment of any compensation, a purpose also linked to the obligation to combat fraud imposed on all insurers.
  2. Potential data categories
    Identification data; Insured object data; Contact data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources.

Transfer to group companies for legitimate purposes

  1. Description of purpose
    In order to fulfil internal administrative purposes, as well as to ensure the security of the network and information, and the centralised management of IT resources (intra-group applications and servers), or for crime prevention, it may be necessary to transfer data between group companies. The legitimate interest is to preserve and optimise shared networks or resources belonging to group companies, as well as to prevent crime.
  2. Potential data categories
    Identification data; Connectivity data; Browsing data; Insured object data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources.


Processing of legal entity data

  1. Description of purpose
    Article 19 of LO 3/2018 presumes that the personal contact data of a company, individual business people and self-employed professionals may be processed on the basis of legitimate interest. If this is your case when taking out insurance or contacting us, we will carry out such processing as indicated in this provision. The legitimate interest consists in maintaining relationships with your company or your business activity.
  2. Potential data categories
    Identification data; Contact data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources.


Processing for corporate transactions

  1. Description of purpose
    The transfer or acquisition of insurance portfolios, merger, demerger, transformation, or in general any corporate transaction, including any listing on the stock exchange, or structural modification of companies, or the contribution or transfer of a business or a branch of business activity, will be based on legitimate interest, provided that the processing is necessary for the proper completion of the transaction and ensures, where appropriate, continuity in the provision of services.

    The legitimate interest consists in carrying out and developing corporate transactions in accordance with practices and regulations.
  2. Potential data categories
    Identification data; Insured object data; Contact data; Socio-economic and demographic data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Checking and auditing the quality of the service provided

  1. Description of purpose
    In order to check and review the performance of suppliers and agents who may be responsible, on our behalf, for providing any service such as assisting you, as well as our employees, we may carry out audits, record calls, transcribe them using computer and, where appropriate, artificial intelligence tools, store communications held with you and analyse the service provided through any communication channel by means of random reviews of this information. The legitimate interest is to uphold our quality commitments, avoiding delays, lack of attention or resolving any other issues.

  2. Potential data categories
    Identification data; Insured object data; Contact data; Activity data; Connectivity data.

  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Profiling and segmentation to provide you with optimal and specialised service

  1. Description of purpose
    Dealing with and resolving your problems requires operators and agents who can understand you, sometimes trained in the technical matters you require or sometimes in your own language, and who can resolve the specific matters you raise at any time. To this end, we invest in improving our technology and our customer service and contract compliance methodology in order to create profiles and segmentations that enable us to improve this service and adapt to you in terms of service, product and your needs, reducing waiting times and ensuring greater efficiency and better evaluation by you of the service received, particularly when it comes to telephone service through agents who are able to adapt to your preferences, interests and needs. The legitimate interest consists in reducing call waiting times, avoiding redirecting calls to specialised departments or operators, and ensuring you are attended to by the staff and operators best suited to you.
  2. Potential data categories
    Identification data; Insured object data; Contact data; Activity data; Connectivity data; Socio-economic and demographic data; Browsing data.
  3. Potential sources
    Data provided by you and/or generated by the relationship with you; Legitimate external sources.

Sending commercial communications

  1. Description of purpose
    We only want to send communications that respect what we have considered to be your privacy expectations, particularly to involve you in loyalty programmes, promotional surveys and/or prize draws relating to insurance, financial products, the automotive world, home and decoration, as well as sports and health or other sectors linked to your insurance. Therefore, and unless you object, you may receive commercial communications about our insurance and benefits associated with your Policies via any channel, including telephone, email, messaging and equivalent means of communication, notification or chat during browsing. Remember that you can always object to this purpose at any time, and that for certain notifications by email or equivalent means, the legal basis is the authorisation provided in Article 21 of Law 34/2002 of 11 July. The legitimate interest is marketing.
  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Profiling and Segmentation

  1. Description of purpose
    We only want to send you commercial communications that we believe may be of interest to you. For this purpose, we tailor our communications to a specific segmentation (for example, customers located in a town, or neighbourhood, or of a certain age, value of the premiums offered), or to your particular profile, that is, taking into account those products and services you have contracted and your habits as a customer, including data derived from your activity and use of the entity’s loyalty programme, as well as any other action resulting from interactions you have had with us in your calls or communications, and, where appropriate, their transcriptions. 

    No automated decisions will be made based on such commercial profiling that significantly affect you or produce legal effects for you. The legitimate interest is to limit the advertising we may send you, so that you only receive what matches your interests.
  2. Potential data categories
    Identification data; Contact data; Connectivity data; Socio-economic and demographic data; Insured object data; Activity data; Browsing data; Geolocation data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Anonymising data to create commercial behaviour models

  1. Description of purpose
    To create behaviour models from pseudonymised and anonymised data, in order to create new insurance products or improve the service we offer you. The processing will involve anonymising the data. In the case of using transcriptions of your communications with us, this will mean completely removing any personal data about you. The legitimate interest consists in being able to use statistical techniques to learn from these models about how to market our products and services.
  2. Potential data categories
    Identification data; Contact data; Connectivity data; Socio-economic and demographic data; Asset and credit solvency data; Insured object data; Activity data; Browsing data; Geolocation data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external sources of information; Credit reports; Common systems in the insurance industry for those purposes where they may legitimately be used.

Inviting you to respond to a service quality survey

  1. Description of purpose
    We always want to provide the best service and would like your help to improve, and for which we would like to invite you to take part in surveys or market research studies. This information will only be processed subsequently if you wish to participate in the survey or study. The legitimate interest is to promptly check and detect when the service may deviate from the established quality standards.
  2. Potential data categories
    Identification data; Contact data; Insured Object data; Browsing data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Ensure that your data is kept up to date and accurate for marketing purposes

  1. Description of purpose
    Regulations require us to keep your data accurate and, where possible, up to date. For this purpose, your data may be checked against legitimate external information sources and, in general, publicly accessible sources (public registers, land registry or others you have made manifestly public). The legitimate interest is to maintain data quality, i.e. the correct data, to ensure you are aware of and receive properly prepared commercial communications.
  2. Potential data categories
    Identification data; Data about the insured object.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources.

Sending commercial communications by email, or equivalent electronic notification means related to our products or services, similar to those initially purchased

  1. Description of purpose
    Pursuant to Article 21 of Law 34/2002 on Information Society Services, where there is a prior contractual relationship, commercial notifications may be sent by email or equivalent electronic means regarding our products or services similar to those initially purchased. However, you may object at any time to receiving these commercial communications.

  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Activity data.

  3. Potential sources
    Data provided by you and/or generated through your relationship with us.

It may be the case that, during a telephone call, online, or via any other channel, such as your App, you have given, or may give in the future, your consent for us to process your data. Remember that:


At the time consent is requested, if data other than that now indicated is to be processed, you will be informed of the specific data to be processed.


You may always request to be informed of this data before giving consent.


You may always withdraw or revoke any consent given without providing any reason. In general, these additional processing activities based on your consent, and which you may always withdraw from without any detriment to you, may include:

 

Updating insurance quotes

  1. Description of purpose
    When you request an insurance quote and decide not to accept it immediately, you may consent to having the quoted price updated for you each year, for up to a maximum of two years. Similarly, and in the way you have consented, we will keep you informed of our offers and products by any means including telephone, post and email, SMS, equivalent means of communication, chat or notification during browsing.
  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Socio-economic and demographic data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Enriching your data with external sources for commercial purposes to create a more detailed profile that allows us to tailor our offers and services

 

  1. Description of purpose
    If you so consent, we will add other information from legitimate external sources to your commercial profile, as well as from third-party databases to which you have consented to us receiving your data, so that we can present you with an offer of our products and services that is more tailored or personalised based on that profile.

    This processing allows for more detailed analysis of your preferences, behaviours and needs than those described on the basis of legitimate interest and will be used to determine, more precisely, which products and services best suit you.

    The additional information we will process and, where appropriate, collect from external sources or through promotional surveys we conduct with you, will relate to personal characteristics, social circumstances, academic and professional data, employment details, commercial information, location data, economic, financial and insurance data and transactions of goods and services.
  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Socio-economic and demographic data; Connectivity data; Asset and credit solvency data; Financial data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us; Legitimate external information sources.


Carrying out commercial communications about products other than insurance products or products offered by third parties

 

  1. Description of purpose
    With your consent, we may send you commercial communications about products and services other than our own insurance, or information about third-party products, by any means including telephone, post and email, SMS or equivalent means of communication, chat or notification during browsing. In general, the products or services may be from the financial, insurance, automotive, home, health, investment, real estate, security, telecommunications, leisure, hospitality and travel sectors.

  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Socio-economic and demographic data; Activity data; Connectivity data; Asset and credit solvency data; Financial data.

  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


 

Transfer of your data to third parties for commercial purposes

 

  1. Description of purpose
    With your consent, we may transfer data to third-party companies with whom an agreement has been entered into under which you benefit as a Policyholder or through another loyalty relationship, especially to organisations linked to our loyalty programme.
  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Socio-economic and demographic data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Participation in Loyalty Channels

  1. Description of purpose
    Processing will involve the inclusion of your data in certain services or channels, such as the “Por Ser” Loyalty Plan, prize draws, surveys, or any other products in which you have participated or may participate, in accordance with the terms and information provided in each case to which you consent.
  2. Potential data categories
    Identification data; Contact data; Insured object data; Browsing data; Socio-economic and demographic data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.


Use of cookies and similar technologies for the purposes set out in the “cookies policy”, and which you can consult before starting to browse

  1. Description of purpose
    You may consent to receive advertising tailored to your profile, and generated from your browsing habits. To do so, you may consent to all or some of the website, App or other platform “cookies” for the purposes stated in the “cookies policy”. The purposes for which we use cookies include obtaining your browsing information on our website (Digital Footprint) in order to (i) supplement it with information we already have about you from your relationship with us as a customer, (ii) generate an analytical model which will subsequently be applied to users who have consented, and with the aim of (iii) creating a commercial profile.

    The aforementioned commercial profile will be used internally by us in order to optimise and improve our relations with users, as well as to identify those profiles that are of greater commercial interest.

    Furthermore, the aforementioned profiles with greater commercial interest, if the user has expressly consented to this, will be communicated to our commercial partners so that they can, on the one hand, insert personalised advertising about our products and services and, on the other hand, identify similar profiles to impact, in accordance with their own cookie policies if the user has consented to their installation in their services. In these cases, we do this securely by using an encrypted unique identifier, which we create from the phone or email.
  2. Potential data categories
    Identification data; Insured object data; Browsing data; Activity data.
  3. Potential sources
    Data provided by you and/or generated through your relationship with us.

Time periods. How long will my data be retained?

  • Línea Directa. The recipients of the data will be the technical and commercial services of Línea Directa Aseguradora, either directly with our employees or through agents and approved suppliers supervised by Línea Directa, who will be our data processors. You can consult a list of the categories of suppliers used in ANNEX I, “Categories of recipients”. Contracts are signed with all of them, subject to the models approved by the data protection authorities.
  • Other controllers for the fulfilment of our accounting obligations. For the purpose of carrying out audits, it is possible that your identification data and data on your activity and claims relating to the Policies may be reviewed by audit firms to verify the accuracy of the corresponding accounting information.
  • Other data controllers responsible for ensuring compliance with the policies.
    • Doctors and hospitals involved as a result of claims covered by the Policies, as well as the experts assessing damage or injury, may be the data controllers.
    • In Policies with legal defence cover, the lawyers defending your rights will also be the data controllers.
    • In the event of a claim caused by a third party insured with another company, the data may be communicated to that other insurance company to comply with the Policies, or for the right of subrogation after payment of compensation.
  • Other data controllers in cases of reinsurance and coinsurance. Data may also be communicated to the insurance or reinsurance companies which, for reasons of reinsurance and coinsurance, are involved in the Policy and its claims.
  • Authorities and official bodies in Spain. Your data will be disclosed to the authorities to comply with regulations, such as the National Tax Authority and the Directorate General of Insurance and Pension Funds.
  • Group companies. When you have given your consent, or in cases where there is a legitimate interest, such as fraud control, the data may also be disclosed to companies within the Group, made up of Línea Directa Aseguradora S.A., Línea Directa Asistencia S.L.U, Centro Avanzado de Reparaciones S.L.U., Ámbar Medline S.L.U. and LDActivos S.L.U.
  • Credit information or creditworthiness files. In the event that the Policyholder has a debt that is certain, due and payable to Línea Directa, and provided that the legal requirements for this are met, Línea Directa may report such non-payment to files on asset solvency and credit information, specifically to ASNEF EQUIFAX managed by AsnefEquifax Servicios de Información sobre Solvencia y Crédito, S.L. and BADEXCUG, managed by Experian Bureau de Crédito S.A.
  • Special files in the insurance industry. Data may be disclosed, where legally appropriate, to:
    • Claims Registers and Policy Registers, as provided for by law.
    • Common Information Systems in the Insurance Industry, details of which can be found in ANNEX III of this policy.
    • OFESAUTO. If you travel abroad, it will be necessary to communicate your data to the Spanish Motor Insurance Bureau (OFESAUTO) for the processing and issuance of International Insurance Certificates, formerly known as “Green Cards”, in accordance with Order EIC/764/2017, of 26 July, which stipulates the rules relating to the functioning of the Spanish Motor Insurance Bureau. This is a non-profit association that brings together all insurance companies authorised to operate in Spain in the field of motor vehicle Liability insurance and the Insurance Compensation Consortium.
  • Entities that you specify to us or for which you give us your consent. Finally, to third-party companies with which an agreement has been formalised under which you have some advantage for being the holder of a Policy, or you have a “Línea Directa” card, provided you have given your consent, or there is a legal provision that enables or makes such disclosure lawful.
  • Similarly, if the user has given express consent, the commercial profile may be communicated to our business partners (i.e. Google and Meta) for the purpose of displaying advertising about our products and services in the advertising spaces of their services. This profile will also be used for the purpose of searching for commercial profiles among users of services provided by the aforementioned third parties, in accordance with their own cookie policies if the user has consented to their installation in their services. In these cases, we do this securely by using an encrypted unique identifier, which we create from the phone or email.

What obligations do I have when providing data?

The Policyholder, or anyone applying to take out a Policy, must notify Línea Directa of any changes that occur in the data provided. Similarly, if you provide data from third parties, such as insured persons, beneficiaries, injured parties, or when you act as their representative, whether legally or voluntarily, explicitly or implicitly, you must have the corresponding authorisation or arrange for the appropriate ratification of the procedures carried out and, in any case, you must have informed the data subject of these clauses, which are deemed to be accepted by them.

Transfers of Data outside the European Economic Area and equivalent environments

The general rule is that your data will be processed in Spain, in countries within the European Economic Area, or in countries, sectors, territories or international organisations that have been declared to have an adequate level of protection by the European Commission. This is without prejudice to any assistance we may provide you, if required by the Policy, in other countries where it applies. In the event that, for certain services such as telephone support, assistance or others, it is necessary to use providers that involve data transfers to other environments, agreements would first be signed incorporating the clauses approved by the European Commission’s current Decisions or, alternatively, the existence of binding corporate rules or other appropriate safeguards in accordance with the regulations would be required. For more information about the applicable safeguards at any given time, you can contact the Data Protection Officer.

Possible existence of specific clauses for certain products

Remember that, due to the specific application for certain products, or the taking out of a special Policy requiring additional processing (as is the case with insurance requiring geolocation, for example), or in cases of participation in a campaign or prize draw, as a result of using other channels, such as our App, or by other means, you may have been informed, or even have consented to other additional processing for such products, Policies, campaigns or channels, in which case, remember that the processing, their legal bases, as well as the categories of data and their origin will also be as informed in such agreements, media or channels, which will prevail over these clauses as they are specific to the processing to which they apply. This is specifically the case in the “Por ser” loyalty channel, which has its own privacy policy.

Why is profiling and automated decision-making sometimes necessary?

To set the lowest premium tailored to your personal circumstances, it is necessary to make decisions based on automated, i.e. computerised, analysis of the data collected. The logic of such decisions is to enable us to deal with everyone quickly, objectively and equally in the processes of taking out and renewing insurance, thus using automated systems to weigh up the same circumstances for each person. The result will be the setting of a Policy rate or price. You may always request human intervention to review such decisions.

Similarly, the solvency rules for an insurer require statistical studies and profiles to be carried out for each Insured Person, in order to anticipate and predict the likelihood of a claim occurring and thus, before it happens, have a reserve of funds ready to make all payments (accounting provisions). For this purpose, it is necessary to make complex computer-based decisions (actuarial calculations) and to create profiles of insured persons to manage the risks covered. The consequence of these decisions will not affect you, as they are merely internal accounting calculations.

Finally, modern marketing involves making offers and discounts tailored to your particular profile, i.e. specific characteristics about you based on your age, products taken out, socio-demographic data and the types of data you can review in Section 8 on purposes, i.e. adjustments that require analysis of each person’s specific circumstances using computer tools. Such decisions will not affect you as they will result in you receiving or not receiving certain advertising, which you can always access voluntarily, particularly if you request information about any campaign or promotion. In any case, especially when profiling and/or prior enrichment of your data is based on your consent, we want you to have the right to request human intervention to review and challenge such decisions.

Use of artificial intelligence systems and ethical and regulatory commitment

Ethical and regulatory commitment

The use of IT tools and artificial intelligence (AI) systems is essential nowadays for carrying out any task, and at Línea Directa we believe that such use presents an opportunity to become, and to help others become better and more objective, with a view to adjusting our prices and improving the customer care and service we provide. Artificial intelligence offers an opportunity for this.

At the same time, the use of new technologies must be based on an ethical and regulatory commitment, so we wish to inform you that:

  • We have evaluated our systems and consider that they do not pose significant risks of causing harm to the health, safety or fundamental rights of individuals and do not substantially influence the outcome of decision-making, so in accordance with Article 6 of the Artificial Intelligence Regulation, they do not constitute a high risk.
  • Open AI systems (openAI) are not used, so any information stored and used in the systems is kept solely for the use of Línea Directa and always in secure environments that do not involve international data transfers, or if used, are based on agreements incorporating the clauses approved by the Decisions in force at any given time of the European Commission, or the existence of binding corporate rules or other appropriate safeguards in accordance with privacy regulations.
  • Línea Directa guarantees that any AI systems that may be used will comply with the principles of non-discrimination, transparency and “explainability”. To this end, prior to their implementation, we have reviewed that the use of any new technology is fully compatible with fundamental rights and privacy protection.
  • Línea Directa undertakes that all persons assuming roles of supervision of AI systems or making decisions based on the results of such tools will receive appropriate training or literacy in Artificial Intelligence. To this end, Línea Directa will entrust the supervision of the systems to persons with the necessary competence, authority, support and training.
  • Línea Directa guarantees that any human decision based on the results of an AI system can, if requested, generate clear and meaningful explanations about the role the AI system has played in the decision-making process and the main elements of the decision taken.
  • In cases where automated decisions and profiling may exist, we will always comply with data protection regulations by allowing human intervention (see section 14 on profiling) and always guaranteeing human supervision as a risk mitigation measure.
  • Línea Directa will comply with the “AI” regulations, as well as with any instructions issued by regulatory and supervisory bodies, in particular Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, establishing harmonised rules on artificial intelligence and amending certain regulations (hereinafter Artificial Intelligence Regulation), with full application of privacy regulations.


Use of AI systems

We propose introducing the following systems for these purposes, based on the legitimate interest in improving the quality of our service and reducing premium costs:

  • Auditing of telephone calls, summarising them or, where appropriate, transcribing them, in order to identify how to improve customer service and the marketing of our products, which will generate better sales and cross-selling practices of other products, as well as facilitate the resolution of claims. Under no circumstances is it proposed to incorporate emotion recognition or biometric categorisation systems. In cases where a conversation is transcribed, in whole or in part, it is proposed that it be deleted once the issue raised has been resolved or the service or assistance provided has been determined.
  • To anonymise the information provided in any format so that it no longer contains personal data, for the purpose of its statistical or aggregated use in Línea Directa’s own models.
  • Creation of virtual assistants (chatbots) to answer queries and quickly resolve any issues you may raise, and even to facilitate or fully carry out the contracting process. If you interact directly with the virtual assistant, you will be informed of its use if the use of AI may not be evident, in accordance with Article 50 of the Artificial Intelligence Regulation.
  • To assist in facilitating the opening of claims for any incident, to help you review and complete your data.
  • To assist in readjusting the models for setting provisions or calculating premiums. For more information, please consult our Data Protection Officer.

Review

This policy may be reviewed as a result of the addition of new processing activities, or to adapt to the publication of new regulations or criteria. These changes may be consulted through the usual channels.

Annex I: Categories of recipients and suppliers

  • Línea Directa Group companies
  •  Reinsurers
  •  Insurance brokers
  •  Healthcare and care service centres
  •  Companies with collaboration agreements to offer product or service benefits
  •  Garages
  •  Lawyers
  •  Auditors
  •  Common files for the insurance industry, FIVA, OFESAUTO
  •  Specialised companies such as Meta Group social networks (Facebook and Instagram), Google (Adwords, YouTube, DV360), Amazon, or other similar online advertising companies, where you have consented to receive personalised advertising about our products when using these platforms
  •  Courts, authorities and official bodies in Spain
  •  National Tax Authority
  •  The Directorate General for Insurance and Pension Funds
  •  Insurance intermediaries
  •  Call Centre
  •  Surveys
  •  Claims management
  •  Appraisers
  •  Network of lawyers and court representatives
  •  Care services for injured parties
  •  Management companies
  •  Consultancies
  •  Technology platforms
  •  Hosting
  •  Marketing services
  •  Postal and courier services
  •  Document destruction service
  •  Trusted third-party service

Annex II: Criteria for determining retention periods

The periods set out below are generic or generally refer to situations provided for in the regulations or to pre-established purposes, since in most cases these periods are determined by limitation periods which you may have interrupted by making any claim. To find out the specific period that may apply to your case, please contact our Data Protection Officer. In any case, we can provide you with the following indicative criteria:

  1. Purpose of responding to your requests, offers and quotes.
    If you have requested an insurance quote or offer, your data will be retained for the validity time period of that offer or proposal, which you can consult in that offer or proposal. In all other cases, unless you have consented otherwise, the data will be retained for 10 days from the last contact with us. Data will also be retained to respond to your request in accordance with the terms of that request.

    In any case, you may give your consent for this insurance proposal data to be kept for a longer time period, so that you can conveniently receive the updated price of the quote year after year, i.e. at the end of the annual expiry of the insurance you take out with another company. Remember that you can always withdraw or revoke this consent.

    After these periods, the data may be retained in a phase we call blocking by conditional access or voluntary blocking, initially, and subsequently in legal blocking, after which they would be deleted, with only certain statistical and always anonymous references being kept in some cases.
  2. Purpose of fulfilling the insurance contract entered into and resolving any claim.
    We will retain your data while your Policy is in force and, once it has ended, for the legal time period necessary to deal with any possible exercise or defence of actions or claims. In general, and among other actions, those arising from insurance Policies, according to law, expire after two years for claims for property damage and five years for claims for personal injury, from the time the action could be exercised, and your data must therefore be retained for at least this period of five years, duly accessible to any operator for the purpose of assisting you.

    These limitation periods may be interrupted in accordance with the law, for example by a relevant ongoing claim, or may be calculated from when the action could be exercised.

  3. Purpose of retaining data in Common systems in the insurance industry.
    Data included in these Common systems in the insurance industry, managed by the TIREA organisation, have general retention periods specific to each file, which currently do not exceed five years. See section on Common systems in the insurance industry.

  4. Data blocked by conditional access in certain cases.
    When your data is no longer necessary for the main purpose for which it was collected so that it is not necessary for any operator to access it, but we still need to retain the data to fulfil other obligations or purposes of the insurance sector, we have chosen to limit access to it, resulting in a phase we have called “voluntary blocking” or pseudo-blocking, as opposed to the “legal blocking” imposed by Article 32 of the LOPD, since in the voluntary blocking phase access and viewing of the data will be allowed, but only for the minimum number of people possible and limited to certain purposes. In particular, the maximum retention time periods that could eventually apply to data in this “voluntary blocking” phase, without prejudice to the fact that in most cases the retention period may be shorter, would be as follows:

    1. Retention of data in documents containing pre-contractual information to be made available to the authorities.

      The law requires us to retain documents containing the pre-contractual information we have provided to you for a minimum time period of six years from when the contract ceases to be effective. The same obligation applies to pre-contractual information relating to insurance products or services that are the subject of combined or linked sales practices. Data retained in this way will only be used for this purpose.

    2. Retention of data for the purpose of combating fraud.

      The prevention of insurance fraud is a public interest mission assigned to insurers. Article 100 of Law 20/2015 obliges us to take effective measures to “prevent, impede, identify, detect, report and remedy fraudulent conduct relating to insurance”. In some cases, fulfilling this duty may require taking into account the limitation periods for criminal offences referred to in Article 131 of Organic Law 10/1995, of 23 November. This does not affect the interruption of the limitation period as a result of legal proceedings being brought, in accordance with the law.

    3. Retention of Policy data for inspection purposes by authorities and compliance with legal requirements for pricing and setting provisions.

      The regulations set out a series of insurer infringements for which the limitation period is set at five years for very serious offences. 

      Very serious offences include some whose defence means we need to keep proof of payments, Policy data, such as those relating to the calculation of technical provisions, maintenance of accounts or determination of the required solvency capital, for which it is necessary to analyse risk calculations. At the same time, the Commercial Code requires us to retain data, including correspondence, for at least six years.

      Finally, the regulations do not allow the calculation of insurance premiums or prices to be unchecked, but to be carried out on a technical basis and with sufficient statistical information, according to reasonable actuarial assumptions. Similarly, technical provisions must be based on updated and reliable information and on realistic assumptions, and must be carried out in accordance with sufficient, applicable and relevant actuarial and statistical methods, which requires the retention of historical data during the relationship for this purpose in accordance with such actuarial calculations. This time period may be limited in cases of prolonged relationships when the historical information is no longer useful for actuarial purposes.

    4. Retention of Policy data to deal with claims in exceptional cases.

      As stated, the limitation period for making a claim under a Policy expires after a certain period, which can be up to five years for personal injury. However, the limitation period does not operate automatically, but may be interrupted, for example, by bringing a legal action or an out-of-court claim, and for this reason a prudent additional period of one year is established so that the legal action brought can be notified, since the courts do not forward claims automatically, but only after a certain time depending on their workload. In addition, it should be noted that the limitation period is calculated from when the action could be exercised, which means analysing the time it takes for the injury to be redressed, so that, exceptionally, in cases of ongoing or successive personal injury, the review of a specific case may require data to be retained in the voluntary blocking phase, solely for the purpose of dealing with the possible exercise, filing or defence of claims and for longer periods than those indicated, since, according to the criteria set by the courts, in such cases the action may not be considered time-barred even if more than five years have passed since the claim.

  5. Retention of data associated with a commercial profile created through cookies.
    The commercial profile prepared through cookies will be kept for a period of one year from the last cookie update, after which it will be blocked for the duration of the limitation period related to actions associated with the processing. Once this period has elapsed, the profile will be permanently deleted.

Annex III: Common Information Systems in the Insurance Industry

Línea Directa is the joint controller for Common Insurance Industry Information Systems and as such has adhered to the Code of Conduct promoted by UNESPA (Spanish Insurance Company Association) and approved by the Spanish Data Protection Agency. In this regard we inform you of the following:

If your Policy is for motor insurance:

  • Línea Directa will communicate the historical data of Policies and claims to the Historical Information System for motor insurance, for which it is joint controller of the data processing. Its purpose is to provide rigorous and proven information on claims data at the time of signing the contract by pooling the information obtained through Policies and claims from the last five years, in the terms set out in the Law on Civil Liability and Motor Vehicle Insurance.
  • Línea Directa will communicate historical data on the number of claims related to your insurance or losses in which you have been involved to the Total Loss, Theft and Fire Information System, for which it is the joint controller. Its purpose is to facilitate the automated identification of possible situations of anomaly and risk of fraud, to cooperate with the Security Forces by facilitating the investigation of possible crimes of theft and fraud, among others, related to insured motor vehicles; and to cooperate with the ZARAGOZA CENTRE, the Security Forces, the Traffic Department and the affected insurance company in the identification and location of stolen and compensated vehicles.


If your Policy is a household policy:

  • Línea Directa is in the process of joining the Miscellaneous insurance fraud prevention information system, proceeding from this membership to communicate the claims data related to your insurance and/or your claim, which includes the insurance purchased by you or the claim in which you have been involved, having the status of joint controller for the processing of the aforementioned System. Its purpose is the prevention and detection of fraud, either by forewarning the insurer after the Policy has been issued or by detecting fraud already committed in declared losses. Furthermore, its purpose will be to cooperate with the Security Forces by facilitating the investigation of possible crimes of theft and fraud, among others, related to the insured property.
     

To exercise your data protection rights regarding the data contained in the Common Insurance Industry Information Systems, you may contact TIREA, Ctra. Las Rozas a El Escorial Km 0,3, Las Rozas, 28231, MADRID.

You can find the rest of the data protection information on the websites of:


Furthermore, as part of the Mandatory Automobile Liability Insurance, the Insurance Compensation Consortium is responsible for managing the Computerised File of Insured Vehicles (FIVA). All insurance companies operating in this insurance area are required, from the moment they start their operations, to report all registrations and cancellations of motor vehicles insured by them daily to FIVA.

Data Controller. Who will process your data?

  • The data controller is Línea Directa Aseguradora S.A. Compañía de Seguros y Reaseguros, S.A., with CIF (Company Tax Code) A-80871031 and address at Ronda de Europa, 7, Tres Cantos, Madrid, C.P. 28760.
  • You can contact us by email at the following address: privacidad@lineadirectaaseguradora.com. If you wish to contact Línea Directa, please use the above email, or by calling 917 002 006.
  • If you need to contact our Data Protection Officer, you can do so at dpo@lineadirectaaseguradora.com or by a letter addressed to the same address, including the “Data Protection Officer” as the addressee.

Purposes. Why do we need your data?

Some data uses are necessary (to comply with legislation and contracts) and others are additional (they depend on whether you give your consent or where any legitimate interest is observed), and they are considered compatible because their aim is to send you commercial communications that are really of interest to you, adjusted to your personal profile, or to improve the quality of our services or our products.

  • Necessary data processing, under the contract or in compliance with legislation, involves the following:
    • When you request our products, or when it is time to renew policies, we will use your data to prepare an insurance offer or quote, establishing a price (insurance premium pricing).
    • For pricing, a profile will be produced based on automated decisions, which include consulting common insurance industry claims files, as well as consulting credit files related to compliance or default or default or compliance propensity with respect to monetary obligations, producing profiles that allow us to adjust our prices and be more competitive. See "credit files" section. Public files will also be consulted, such as the land registry (very useful for our Home Insurance in order to complete and check the information you supply to us about your home), or files from the Directorate General of Traffic, for the same purpose in Car Insurance, and which will help us to avoid mistakes about the insured vehicle and speed up the purchase process.
    • We will also use your data to conclude the insurance contract with you, to maintain it, renew it and, in general, to proceed to the management and control of any policy or policies you take out, including the management of any claims that may occur, as well as managing and keeping the corresponding telephone calls. In order to conclude the contract, legislation may sometimes force us to carry out suitability and appropriateness tests, which we will proceed to carry out.
    • All insurers must create accounting provisions to guarantee that we can pay any claims made by any insured customers. This means we need to make profiles and take automated decisions that allow us to predict the statistical risks of claims occurring, which means using your data for these purposes of statistical studies and models, classifications or scoring, as well as preventing fraud in risk selection and claims management, by performing accident analysis.
    • The data may be supervised, and hence communicated, to the administrative authorities responsible for ensuring compliance with legislation and solvency, in this case the General Directorate of Insurance and Pension Funds.
    • To set lower prices and prevent fraud, all insurers can consult common claims files, and they must therefore communicate their data to these files as well. See "common insurance industry files" section.
    • The law authorises us, in order to comply with the insurance policy and its consequences, to use your data to:
      • Determine the health care that should have been provided to the injured party, as well as any compensation that may be appropriate, when this has to be paid by Línea Directa.
      • Suitable payment to health providers or reimbursing the insured or their beneficiaries for any health care expenses that may have been incurred within the scope of a health care insurance contract.
      • In addition, in the case of Línea Directa, please note that it constitutes a group, which may make it necessary to communicate personal data between companies in the group in order to comply with the supervision obligations established by law.
      • Finally, the law also enables us to communicate data to reinsurance companies, if any, that is strictly necessary for the conclusion of the reinsurance contract in the terms set forth in Article 77 of Insurance Contract Law 50/1980 of 8 October, or for carrying out related operations, these being understood to be the performance of statistical or actuarial studies, risk analysis or investigations for customers, as well as any other activity related to or arising from the reinsurance activity.
    • We will also use your data to send you information and quotes that you have requested from us, in the way you have indicated to us, including emails or equivalent means of communication, and in the periods authorized by you to do so.
  • Additional processing covered by legitimate interest, which it is possible to object to:
    • Legislation requires us to keep your identifying data up to date, as well as any other information included as necessary in each contract, and for which public data (public records, land registry data or other data that has been made manifestly public) may be used if it is necessary to fulfil identification obligations or others established in the previous paragraphs.
    • Conducting surveys. We always want to provide the best service and we want you to help us improve. That’s why we may also use your data to conduct quality surveys about the service that we provide, thanking you for your cooperation from now on.
    • It may also be necessary to transfer data to group companies for administrative purposes, or for fraud prevention, based on legitimate interest.
    • We want you to know about us and to be able to benefit from discounts and offers, both our own and those from third parties with which we reach agreements of interest to you and provided that your expectation of privacy is respected. This is why it is possible that processing may involve the sending of commercial communications by any channel, including email or equivalent means of communication, to notify you about customer loyalty activities, promotional surveys, prize draws, etc. on insurance, financial products, the world of cars, housing and decoration, as well as sports and health. Remember that you can always object to this purpose at any time.
    • We may in addition adapt our commercial offers to your particular profile and this will allow us to be more competitive with you. To do this, information will be collected from data related to your own purchasing activity and the policy itself, as well as your browsing. No automated decisions will be made based on this profile that produce legal effects concerning you. Remember that you can always object to this purpose at any time.
    • Updating your data for commercial purposes, and for which public data (public records, land registry data or other data that has been made manifestly public) may be used.
    • Creating behaviour models with pseudonymized and anonymous data, to create new products or improve the service we provide you.
    • Legal entity contact details related to your professional location will also be processed based on legitimate interest, with the purpose of maintaining business relationships or those of any other kind with the legal entity in which the affected person provides their services. The same will apply to data belonging to individual business people when it only refers to them in this capacity and is not processed to establish a relationship with them as individuals.
  • Additional processing, covered by your consent and which you can always withdraw, are:
    • Disclosure of data To third party companies with which an agreement has been concluded and whereby you have some advantage through being a policy holder, or a "Línea Directa" card. Remember that you can always oppose or revoke your consent at any time for this use of your data.
    • To send you commercial communications about products and services from third parties, or products not similar to those you have purchased, by any means including telephone, post and email, SMS, equivalent means of communication, or warning during browsing. Especially in financial, insurance, motor, home, health, investment, property, electronics, telecommunications, leisure, hospitality and travel fields.
    • The use of cookies for the purposes set out in the "cookies policy" that you can consult before you start browsing.

      One of the purposes for which we use cookies is to obtain information about your browsing habits on our website (Digital Fingerprint) in order to (i) expand it with the information we already have about you due to your relationship with us as a customer, (ii) generate an analytical model that will subsequently be applied to users who have consented to it in order to (iii) create a commercial profile. 

      The aforementioned commercial profile will be used internally by us in order to optimise and improve our relations with users, as well as to identify those profiles that are of greater commercial interest. 

      Furthermore, the aforementioned profiles with greater commercial interest, if the user has expressly consented to this, will be communicated to our commercial partners so that they can, on the one hand, insert personalised advertising about our products and services and, on the other hand, identify similar profiles to impact, in accordance with their own cookie policies if the user has consented to their installation in their services. In these cases, we do this securely by using an encrypted unique identifier, which we create from the phone or email.  
    • If it uses geolocation devices, when you consent to the provision of a service that requires them.
    • The inclusion of your data in loyalty channels, prize draws or other products in which you participate or have participated, according to the conditions of these.

Time periods. How long will we keep your data?

  • The data that you give us to request an insurance policy may be kept during the validity of the offer at least, asking you for your consent when it is collected to keep it for a maximum period of two years, in order to offer you our rates at the end of the annual maturity of the insurance that you purchase from other companies. Remember that you can always object to or revoke this consent.
  • Data collected for the conclusion of an insurance contract, or any that arises during the above, will be blocked when it is no longer required for the purposes for which it was collected. This blocking will lead to your data being stored solely at the disposal of public administrations, judges and courts for the purpose of any possible liability arising from processing and for the duration of such liability. Once this period has expired, your data will be deleted.
  • The commercial profile prepared through cookies will be kept for a period of one year from the last cookie update, after which it will be blocked for the time limit related to actions associated with the processing. Once this period has elapsed, the profile will be permanently deleted. 

Why is it sometimes necessary to create profiles and adopt automated decisions?

  • As stated above, to set the lowest rate in accordance with your personal conditions it is necessary to take decisions based on automated or computerized analysis of the data you have given us, or files that may be accessed for this purpose. The logic behind these decisions is to attend flexibly and objectively to everyone in the insurance purchase and renewal processes, considering the same circumstances for everyone, in a computerized form.
  • Insurer solvency rules also oblige us to carry out statistical studies and prepare profiles about each insured customer, in order to anticipate and estimate the probability of a claim occurring. Suitable accounting provisions can therefore be provided to guarantee payment (money reserves foreseen for the payment of claims). To do this, it is necessary to take complex computer-based decisions and create insured profiles with which to manage the risks covered.
  • Finally, modern marketing involves making offers and discounts adjusted to your particular profile, adjustments that require analysis of the specific circumstances of each person using computer tools.

Legitimation. Why do we need your data and possible objection to processing?

  • Legitimation for the necessary processing comes from the request to conclude or the existence of an insurance contract concluded with you, as well as the legal obligations arising from this. You can always see your current contracts in your NUEZ application. In particular, this necessary processing based on law is authorized by Law 20/2015 of 14 July, on the regulation, supervision and solvency of insurance and reinsurance companies.
  • Additional processing that can be objected to is based on Art. 20 et seq. of Law 34/2002 of 11 July, on Information Society and Electronic Commerce Services, as well as the existence of a legitimate interest to send commercial communications to customers and to proceed with the preparation of non-complex personal profiles. The legitimate interest of this party focuses on considering marketing to be an essential purpose of any company, in accordance with recital 47 of the Data Protection Regulation, as well as the consultations and replies given by the data protection authorities. Remember that you can always object.
  • The remaining additional processing is based on the existence of your consent. Remember that you can always revoke or object to it later. The conclusion of the contract or contracts that you want to conclude are at no time subject to or dependent upon obtaining this consent for additional purposes.

What data and processing is obligatory and what are the consequences of not supplying data?

  • The data collection forms include an asterisk for required fields in order to conclude the insurance contract or to request one. Consequently, this data will be necessary for these purposes and without them it will not be possible to continue the operation.
  • Regarding the uses of the data, those purposes for which specific consent is not requested are necessary to conclude the insurance contract, or to fulfil the legal obligations corresponding to this contract or an insurance quote request. The other purposes are optional, require consent or are based on a legitimate interest, so that you can always object to them according to what has been indicated in the previous section and in the basic information, without the withdrawal of this consent or such opposition determining the performance of the corresponding contract or its request. Purposes related to points 2.2 and 2.3 may therefore be optional.

Recipients. Who will handle your data?

  • The recipients of the data will be the technical and commercial services at Línea Directa, as well as companies belonging to the Línea Directa group, for internal administrative purposes, including the processing of customers' personal data. The companies in the Línea Directa group are: Línea Directa Aseguradora S.A., Línea Directa Asistencia S.L.U., Motoclub LDA S.L.U., Centro Avanzado de Reparaciones S.L.U., Ámbar Medline S.L.U. and LDActivos S.L.U.
  • Data may also be communicated to insurers or reinsurers or to third-party Línea Directa partners or suppliers, which intervene in the management of the Policy and its claims due to reinsurance, coinsurance or claims management operations. To insurance claims adjusters, for example, or the brokers the insurance is purchased from. In all these supplier cases there will be contracts that oblige them to maintain due confidentiality.
  • Data can also be transferred, when legally appropriate, to common insurance industry files (see "common insurance industry files" section), as well as the Claims Records and Policy Register provided for by law, and to the General Directorate of Insurance in the event of claims.
  • Also, if the user has expressly consented to this, the commercial profile may be communicated to our business partners (i.e. Google and Meta) in order to insert advertising about our products and services in the advertising spaces of their services. This profile will also be used for the purpose of searching for commercial profiles among users of services provided by the aforementioned third parties, in accordance with their own cookie policies if the user has consented to their installation in their services. In these cases, we do this securely by using an encrypted unique identifier, which we create from the phone or email.
  • Finally, the data may be transferred to a third-party company with which an agreement has been concluded, by which you have some advantage through being a policyholder, or you have a "Línea Directa" card. This is provided that you have given your consent, or that there is a legal provision that makes such transfer possible or lawful.
Rights. What are your rights regarding your data?
  • You have the right to obtain confirmation regarding whether Línea Directa is processing personal data concerning you and, in this case, you have the right to access your personal data and the additional information referred to in art. 15.1 of the Data Protection Regulation.
  • You also have the right to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, or any other cases, according to the provisions of Art. 16 and 17 of the Data Protection Regulation.
  • You may also, in the cases provided for in Art. 18 of the Data Protection Regulation, request restriction of the processing of your data, in which case it will only be kept for filing or defending against complaints, dealing with injunctions or legal requirements.
  • When processing is based on your consent, you have the right to withdraw such consent at any time, without any detriment.
  • If data processing is carried out through cookies, you can withdraw your consent or configure them through the cookie settings panel.
  • You have the right to file any complaints with the appropriate supervisory authority, this being considered to be the Spanish Agency for Data Protection in Spain, without prejudice to the powers that may, if appropriate, be held by other autonomous or supranational bodies, in accordance with the Data Protection Regulation and national regulations.
  • You have the right to request the portability of the data you have provided us, to receive it in a structured, commonly used and machine-readable format, and for it to be transmitted to another data controller, in accordance with Art. 20 of the Data Protection Regulation.
  • In certain circumstances and for reasons related to your particular situation, you may also object to the processing of your data, especially for processing related to the preparation of profiles or automated decisions. In these cases, Línea Directa will stop processing the data, except for compelling legitimate grounds, or for filing or defending against complaints, all in accordance with Art. 21 of the Data Protection Regulation.
  • In cases of decisions based solely on automated decisions that produce legal effects concerning you or that significantly affect you in a similar way, you have the right to obtain human intervention in such a decision, as well as to express your point of view, being able if you wish to challenge such a decision.

Rights. How can I exercise my rights?

  • You can direct your request for rights to the postal and electronic addresses indicated in the Responsible section. Remember that we will not ask you to provide additional information, such as official documents (DNI, NIF or NIE), when your contact and identity have already been verified, unless we request it because there may be reasonable doubts about said identity to protect you and guarantee confidentiality. of your information. If it is necessary to provide an image of these documents, for your safety, please include black and white images, which may pixelate or blur your signature, or you can even add some text indicating that this image is used only by Direct Line for the exercise of your rights. In these cases, please try not to cover up or eliminate the essential data that allows you to verify your identity with the document. These data and images will only be used to verify your identity and only if we ask you to do so after considering the specific case.
  • Should you have any doubts, or if you do not consider that you have been properly attended to, please do not hesitate to contact us and submit your complaint by sending an e-mail to privacidad@lineadirectaaseguradora.com or by sending a letter to the same address.

Origin

  • The information we handle is what you give us about you personally, or is from authorised third parties, such as minors you purchase a product for, beneficiaries, non-policyholders, or third parties involved in a claim. This data will be added to that generated later during the validity period of the Policy.
  • In order to set the insurance premium at the lowest possible amount, as well as to compare and complete your data, the law allows us to access and complete your information with various legally accessible databases, based on legitimate purposes, from files owned by third parties, such as the Land Registry, General Directorate of Traffic files, the SINCO files, credit rating files, as well as files with external statistical data, all of them available without restrictions. Furthermore, in certain cases, the data may be updated with data that has been made manifestly public, such as open social media profiles.

Data categories processed are:

  • Identification data, such as first name, surnames, address, telephone, as well as postal or email addresses
  • Identification codes or passwords, such as the user names and passwords generated to operate our website, as well as the IP addresses leading to a specific operation.
  • Commercial information that may be collected. With respect to cookies, there is a specific cookies policy that you can consult at www.lineadirecta.com
  • Economic and socio-economic data.
  • Claims data.
  • In cases where certain claims exist, or for taking out Health Insurance policies, data about this health category will also be processed.

Common insurance industry files

  • UNESPA

    Línea Directa is the joint controller for Common Insurance Industry Information Systems and as such has adhered to the Code of Conduct promoted by UNESPA (Spanish Insurance Company Association) and approved by the Spanish Data Protection Agency.

    To exercise your data protection rights regarding the data contained in the Common Insurance Industry Information Systems, you may contact TIREA, Ctra. Las Rozas a El Escorial Km 0,3 Las Rozas 28231 MADRID.

  • Insured Vehicles Database (FIVA).

    Under the Mandatory Automobile Liability Insurance, the Insurance Compensation Consortium is responsible for managing the Computerised File of Insured Vehicles (FIVA). All insurance companies operating in this insurance area are required, from the moment they start their operations, to report all registrations and cancellations of motor vehicles insured by them daily to FIVA.

  • Financial solvency files

    In the event that the policyholder has any due and payable debt with Línea Directa, and provided that the legal requirements for this are met, Línea Directa may communicate this non-payment to credit information files, specifically to ASNEF EQUIFAX, managed by the company Asnef- Equifax Servicios de Información sobre Solvencia y Crédito, S.L., and BADEXCUG, managed by Experian Bureau de Crédito S.A.

    Likewise, when deemed appropriate according to the nature of the transaction, Línea Directa will consult solvency files related to the compliance or default or the propensity to default or compliance with respect to financial obligations. If the policyholder is listed at any point in time on any of the files consulted, Línea Directa may decide not to enter into the contract, or not to renew the Policy with this client, without prejudice to the client’s right to claim against this decision.

What obligations do I have when communicating my data?

  • The Policyholder, or whoever requests the purchase of the insurance, must notify Línea Directa of any changes that occur in the data provided. Furthermore, if details are provided about third parties, such as the insured, beneficiaries, injured parties, etc., their consent must be obtained and these clauses must be passed on to them so that they are understood to be accepted by them.