Sign-in

IMA ITALIA ASSISTANCE S.p.A., (Fiscal Code: 09749030152 – VAT n.: 13145490960) (hereinafter "IMA ITALIA"), in the person of its legal representative pro tempore, with registered office in Sesto S. Giovanni (MI), Piazza Indro Montanelli, 20, in its capacity as Data Controller ex art. 4 n. 7) and 24 of the EU Regulation n. 2016/679 (GDPR), informs, pursuant to art. 13 and 14 of the GDPR, that the personal data, described in art. 1, will be processed by IMA ITALIA for the execution of the processing purposes described in art. 2.

 

1. Category of personal data being processed

1.1. IMA ITALIA collects and processes, for the purposes of pursuing the processing purposes described in art. 2, the following information concerning, depending on the factual/contractual circumstances, mainly the following categories of data subject ex art. 4 n. 1) of the GDPR: insured (also policyholder); policyholder; beneficiary ; family member/permittee of the insured/beneficiary; an animal subject to insurance protection; any other subject whose personal information could be processed, if necessary, for the performance of the insurance service:

1. Personal data pursuant to art. 4 n. 1) of the GDPR so-called identification/contact data (e.g. first name; surname; date and place of birth; tax code; VAT number; address of residence/domicile/dormitory; telephone number; e-mail address; degree of relationship; information about the identity document (e.g. type and number of the document; date of issue; expiry date; place/body of issue; nationality); information on the vehicle subject to insurance protection (e.g. registration number plate; model/make; date of registration); insurance policy number; gender; identification information on the travel document; identification elements of the animal subject to insurance protection (e.g. microchip); including, bank/financial data (e.g. bank/post account number) and/or ubication/location; any other information, not described herein by way of example, directly or indirectly linked to the claim and/or to the insurance claim that has occurred/reported/communicated (e.g. telephone recording made with an operator acting on behalf of IMA ITALIA; recording of tele/video medical and/or veterinary consultations), in order to best provide the insurance assistance/coverage contractually agreed with IMA ITALIA; and, finally, any other information, not described herein by way of example, requested and/or entered into the mobile software application made available by IMA ITALIA (hereinafter only "personal data").

2. Particular personal data within the meaning of art. 9 paragraph 1) of the GDPR, processed, if necessary, following the correct, complete and timely management of a claim and/or a request for insurance assistance occurred/reported/reported, in order to provide, in the best way possible, the insurance assistance/coverage contractually agreed to with IMA ITALIA (e.g. information on the state of health or on the need for medical/health/healthcare services/assistance, including at home (e.g. hospitalisation; accident; illness; medical diagnosis/therapy; death; medical expenses) (hereinafter only "particular personal data").

3. Judicial personal data within the meaning of art. 10 of the GDPR, including any information about an active/passive and/or direct/indirect involvement in a civil/criminal/administrative judicial/legal dispute (hereinafter 'judicial personal data').

Given the subjective and objective heterogeneity of the categories of personal information described above, IMA ITALIA points out, in this regard, that it will only process the personal information strictly necessary to perform each of the processing purposes described in art. 2 below, in accordance with the principles under art. 5 of the GDPR, and on the basis of the specific product/contract/insurance policy signed with IMA ITALIA. In accordance with art. 14 paragraph 2) letter f) of the GDPR, IMA ITALIA specifies that the origin of personal information, subject to processing, may possibly derive from the relevant business partner and/or third parties (public; private; publicly controlled) involved, directly or indirectly, in the execution and proper management of the insurance service. Lastly, IMA ITALIA specifies that the subjects, described in greater detail in art. 1.1. above, qualify as data subjects under art. 4 n. 1) of the GDPR, to which must be added, in this regard, any supplier/consultant who provides, directly or indirectly, a service of various kinds that is the subject of insurance protection.

 

2. Purpose of processing and legal basis.

2.1. Personal data and, if necessary and appropriate, particular personal data and/or judicial personal data are/can be processed by IMA ITALIA for the performance of the following processing purpose:

1. Execution, also at a distance, of the (pre)contractual relationship/insurance policy, including the performance of any contractual/regulatory fulfilment connected, directly or indirectly, to the fulfilment of the relevant insurance relationship/purpose, including the possible use of the services made available by means of a specific mobile software application, subject to registration (e.g.: collection of premium; fulfilment of the insurance assistance/coverage/practice, including the management/liquidation of the relevant claim/event covered by the insurance cover; resolution of the insurance claim/event; resolution of the insurance claim/event. collection of the premium; completion of the management/payment of insurance assistance/coverage/practice, including the management/liquidation of the relevant claim/event subject to insurance cover; settlement of a dispute concerning the indemnity/payment of other benefits; customer due diligence, if necessary; prevention, detection and/or prosecution of insurance fraud; determination/assessment/management of an insurance risk; reinsurance; co-insurance; internal management activities within the business group of which IMA ITALIA is a member; recording of a tele/video medical and/or veterinary consultation; telephone recording with an operator acting on behalf of IMA ITALIA; e-call).

In compliance with art. 13 paragraph 2) letter e) of the GDPR, IMA ITALIA specifies that any failure to communicate (even partial, if necessary) personal data and, if necessary, particular personal data and/or judicial personal data may, if necessary, result in the impossibility for IMA ITALIA to perform, correctly and completely, the purpose of processing referred to in art. 2.1. letter a) above.

In compliance with art. 13 paragraph 2) letter c) of the GDPR (or in compliance with art. 14 paragraph 2) letter d) of the GDPR, if applicable), IMA ITALIA informs you of your right to revoke, at any time, any consent you may have given for the processing of particular personal data in order to execute the purpose of processing referred to in art. 2.1. letter a), through the use of contact details described in art. 7, without such an event affecting the lawfulness of the processing based on the consent provided before the revocation: taking this into account, IMA ITALIA specifies, however, that any lack of consent or any revocation of consent previously provided affects, without any doubt, the possibility for IMA ITALIA to implement, fully and completely, the processing purpose referred to in art. 2.1. letter a) (in particular, with regard to the execution of the insurance policy, including the management of the insurance assistance/coverage/practice, and the management/liquidation of the relevant claim/event subject to insurance cover).

In this regard, IMA ITALIA points out that the legal basis of the processing purpose referred to in art. 2.1. letter a) is to be found in the following legal provisions, in addition to Legislative Decree n. 209/2005: art. 6 paragraph 1) letters b) c) of the GDPR; art. 9 paragraph 2) letter a) of the GDPR; art. 4.7. of Recommendation R(2002)9 of the Committee of Ministers to member states on the protection of personal data collected and processed for insurance purposes, to be read in conjunction with Art. 10 of the GDPR, and Art. 2 octies paragraph 3) letter d) of the amended Legislative Decree n. 196/2003 (Privacy Code).

2.2. Personal data and, if necessary and appropriate, particular personal data and/or judicial personal data are/can be processed by IMA ITALIA for the performance of the following processing purpose:

2. Recognition/exercise/defence of a right/interest, including in court.

In this regard, IMA ITALIA specifies that the legal basis for the purpose of the processing referred to in art. 2.2. letter b) is to be found in the following regulatory provisions: art. 6 paragraph 1) letter f) of the GDPR; art. 9 paragraph 2) letter f) of the GDPR; art. 4.7. of Recommendation R(2002)9 of the Committee of Ministers to member states on the protection of personal data collected and processed for insurance purposes, to be read in conjunction with art. 10 of the GDPR, and art. 2 octies paragraph 3) letter e) of the Privacy Code. In compliance with art. 13 paragraph 1) letter d) of the GDPR (or in compliance with art. 14 paragraph 2) letter b) of the GDPR, if applicable), IMA ITALIA specifies that the legitimate interest pursued, if necessary and appropriate, through this purpose of processing, is to protect its rights/interests, even in court, in the face of potential (or alleged) conduct deemed unlawful/illegal.

2.3. Personal data are/can be processed by IMA ITALIA for the following purposes:

3. Handling/resolving/addressing a complaint;

4. Statistical activities, also aimed at improving knowledge of the insurance market;

5. Verification of the quality of the services offered (customer satisfaction), by means of a special questionnaire/interview.

In this regard, IMA ITALIA specifies that the legal basis for each processing purpose referred to in art. 2.3. is found in the following specific regulatory provisions: for the execution of the processing purpose referred to in art. 2.3. letter c): art. 6 paragraph 1) letter c) of the GDPR, to be read, in conjunction with (also by analogy, if necessary), ISVAP Regulation n. 24 of 19.5.2008; for the execution of the processing purpose referred to in art. 2.3. letter d): art. 6 paragraph 1) letters c) f) of the GDPR, to be read, in conjunction with (also by analogy), IVASS Regulation n. 36 of 28.2.2017; for the processing purpose referred to in art. 2.3. letter e): art. 6 paragraph 1) letter f) of the GDPR.

In compliance with art. 13 paragraph 1) letter d) of the GDPR (or in compliance with art. 14 paragraph 2) letter b) of the GDPR, if applicable), IMA ITALIA specifies that the legitimate interest pursued through the processing purpose described in art. 2.3. letter d) is to improve and deepen knowledge of the insurance market; on the other hand, the legitimate interest pursued through the purpose of processing described in art. 2.3. letter e) is to understand any areas/areas for improvement in the services provided and, then, to produce a report on behalf of IMA ITALIA and/or its business partner.

2.4. Personal data are/can be processed by IMA ITALIA for the following purposes:

6. Advertising/promotional/commercial activities (including market research) of one or more insurance products, to be carried out, in compliance with the principles/prescriptions under art. 182 of Legislative Decree n. 209/2005, directly or through intermediaries, by automated/electronic/telematic means (e.g. e-mail; website; mobile app; social page; newsletter) or by non-automated/traditional means (e.g. paper mail; sms; articles).

In compliance with art. 13 paragraph 2) letter c) of the GDPR (or in compliance with art. 14 paragraph 2) letter d) of the GDPR, if applicable), IMA ITALIA informs you of your right to withdraw, at any time, any consent you may have given for the processing of your personal data in order to carry out the purpose of the processing described in art. 2.4. letter f), through the use of the contact data described in art. 7 below, without this event affecting the lawfulness of the processing based on the consent you gave before such withdrawal.

In this regard, IMA ITALIA specifies that the legal basis of the processing purpose referred to in art. 2.4. letter f) is found in the following regulatory provisions: art. 6 paragraph 1) letter a) of the GDPR, to be read, together with art. 82 and 83 of IVASS Regulation n. 40 of 2.8.2018, and art. 4.8. of Recommendation R (2002)9 of the Committee of Ministers to Member States on the protection of personal data collected and processed for insurance purposes.

 

3. Retention period.

3.1. In accordance with art. 13 paragraph 2) letter a) of the GDPR (or in accordance with art. 14 paragraph 2) letter a) of the GDPR, if applicable), IMA ITALIA communicates the following retention periods/criteria, after which the personal data and/or particular personal data and/or any judicial personal data will be subject deletion, destruction or anonymisation, unless further storage is necessary in order to comply with a legal/regulatory obligation or in order to protect/establish a right/interest, including in court: (i) for the performance of the processing purpose referred to in art. 2.1. letter a): in general, 10 years pursuant to art. 2220 paragraph 1) Italian Civil Code, to be read in conjunction (and by analogy, uf necessary) with art. 5 paragraph 5) and 8 paragraph 1) of ISVAP Regulation n. 27 of 14.10.2008 (to be read, in turn, in conjunction with art. 101 and 165 of Legislative Decree n. 206/2005); with exclusive regard to the recording of the activity of tele/video veterinary consultancy: in general, up to n. 3 months after the final termination of the contractual relationship between IMA ITALIA and the relevant supplier used, for this purpose, by IMA ITALIA; with exclusive regard to the registration to a specific mobile software application: until the registered interested party manifests, by conclusive behaviour, the intention to de-register or until the latter is allowed to use such mobile software application; (ii) for the performance of the processing purpose referred to in art. 2.2. letter b): in general, n. 10 years from the final termination of any judicial/judicial dispute (see by analogy: the document "National archiving system - guidelines for the selection and discarding of documents", signed by the Inland Revenue italian); (iii) to perform the processing purpose referred to in art. 2.3. letter c): in general, n. 5 years from the final settlement of the claim, in accordance with the provisions of the relevant organisational procedure prepared by IMA ITALIA in accordance with ISVAP Regulation n. 24 of 19 May 2008; (iv) for the performance of the processing purpose referred to in art. 2.3. letter d): in general, n. 2 years; (v) for the performance of the processing purpose referred to in art. 2.3. letter e): in general, n. 1 year; (vi) for the performance of the processing purpose referred to in art. 2.4. letter f): until revocation of consent.

 

4. Target audience.

4.1. In compliance with art. 13 paragraph 1) letter e) of the GDPR (or in compliance with art. 14 paragraph 2) letter b) of the GDPR, if applicable), IMA ITALIA specifies that personal data and/or any particular personal data and/or any judicial personal data may be subject to communication, if necessary and appropriate, to one or more recipients under art. 4 n. 9) of the GDPR, identified, in general, by category as follows: (i) for the performance of the processing purpose referred to in art. 2.1. letter a): subjects authorised to process pursuant to art. 4 n. 10), 29 and 32 paragraph 4) of the GDPR by IMA ITALIA (hereinafter "subjects authorised to process by IMA ITALIA"); subsidiaries/parent companies/facilitators that are part of the business group of IMA ITALIA (e.g. IMA SERVIZI S.c.a.r.l.), in compliance with Recital n. 48) of the GDPR, and art. 30 septies of Legislative Decree n. 206/2005 (to be read, together with IVASS Regulation n. 38 of 3.7.2018); subjects/suppliers that are part, in various ways, of the so-called insurance chain, better described in the Italian Privacy Guarantor's Order of 26.4.2007 [web doc. no. 1410057] or whose professional (and non-professional) services are necessary/functional for the complete preparation/management of the insurance file/practice (e.g. intermediary/distributor/agent/broker; adjuster; reinsurer; co-insurer; liquidator; doctor (insurance fiduciary); craftsman/specialist; health/social (social) worker/team); companies/professionals providing services connected, directly or indirectly, to the performance of the processing purpose in question (e.g. ICT company; legal/tax consultant); IVASS; ANIA; subjects legitimately operating within the SIC (Credit Information System); business partners; third parties (public or private or publicly controlled) involved, directly or indirectly, in the performance and proper management of the insurance service (e.g. health facility; air carrier); police/judicial/financial authorities; health facility, including public emergency services; (ii) for the performance of the processing purpose referred to in art. 2.2. letter b): subjects authorised to process by IMA ITALIA; subsidiaries/parent companies/facilitators that are part of the business group of IMA ITALIA; companies/firms/professionals that provide services connected, directly or indirectly, to the performance of the processing purpose in question (e.g. legal advisor); IVASS; commercial partner; (iii) for performance of the processing purpose referred to in art. 2.3. letter c): parties authorised to process the data by IMA ITALIA; subsidiaries/controlling companies/faculty members of the business group of IMA ITALIA; IVASS; companies/companies/professionals who provide services directly or indirectly connected to performance of the processing purpose in question (e.g. legal advisor); commercial partner; (iv) for performance of the processing purpose referred to in art. 2.3. letter d): subjects authorised to process by IMA ITALIA; companies controlled/controlling/part of the IMA ITALIA business group; IVASS; (v) for the execution of the processing purpose referred to in art. 2.3. letter e): subjects authorised to process by IMA ITALIA; companies controlled/controlling/part of the IMA ITALIA business group; companies/businesses/professionals who provide services connected, directly or indirectly, to the execution of the specific processing purpose (e.g. call centre/customer care/ICT companies); commercial partners; (vi) for the execution of the processing purpose referred to in art. 2.4. letter f): subjects authorised to process by IMA ITALIA; companies controlled/controlling/part of the IMA ITALIA business group; companies/businesses/professionals who provide services connected, directly or indirectly, to the execution of the specific processing purpose (e.g. distributor/intermediary; (web) marketing company/agency).

 

5. Transfer.

5.1. Personal data and/or any particular personal data and/or any judicial personal data are/may be stored in automated/partially automated/non-automated files belonging to, or in any case traceable, even indirectly, to IMA ITALIA, and located within the European Economic Area (EEA).

 

6. Rights of the data subject.

6.1. In relation to personal data and/or any particular personal data and/or any judicial personal data, IMA ITALIA informs you of your right to exercise the following rights, which may be subject to the further limitations provided for in Articles 2 undecies and 2 duodecies of the Privacy Code: right of access pursuant to art. 15 of the GDPR: right to obtain confirmation of whether or not personal data is being processed, as well as the information referred to in Article. 15 of the GDPR (e.g. purpose of processing, storage period); right of rectification under art. 16 of the GDPR: right to correct, update or supplement personal data; right to erasure under art. 17 of the GDPR: right to obtain the deletion or destruction or anonymisation of personal data, where the conditions listed in the same article apply; right to restriction of processing under art. 18 of the GDPR: the right to obtain the limitation of processing where the conditions set out in art. 18 apply; right to data portability under art. 20 of the GDPR: the right to obtain the personal data provided to IMA ITALIA in a structured, commonly used and machine-readable format (and, where required, to transmit it directly to another data controller), where the specific conditions set out in the article exist (e.g. legal basis for consent and/or execution of a contractual agreement and/or execution of a contractual agreement). legal basis of consent and/or performance of a contract; personal data provided by the data subject); right of objection under art. 21 of the GDPR: right to obtain the cessation, on a permanent basis, of a given processing of personal data; right to lodge a complaint with the Supervisory Authority (i.e. the Italian Data Protection Authority) under art. 77 of the GDPR: right to lodge a complaint where it is considered that the processing under analysis violates national and EU data protection legislation.

6.2. In addition to the rights described in art. 6.1. above, IMA ITALIA points out that there is, where possible and conferring, the right to exercise, on the one hand, the (sub)right provided for in art. 19 of the GDPR ("The data controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectification or erasure or restriction of processing carried out pursuant to art. 16, 17(1) and 18, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests"), to be considered connected and related to the exercise of one or more of the rights governed by art. 16, 17 and 18 of the GDPR; on the other hand, IMA ITALIA specifies that there is, where possible and conferrable, the option of exercising the right provided for by art. 22 paragraph 1) of the GDPR ("The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her or significantly affects him/her in a similar way"), subject to the exceptions provided for in paragraph 2) below.

6.3. In accordance with art. 12 paragraph 1) of the GDPR, IMA ITALIA undertakes to provide the communications referred to in art. 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible, easily accessible form and in plain and clear language: this information will be provided in writing or by other electronic means where appropriate or, at the request of the person concerned, will be provided orally provided that the identity of the latter is proven by other means.

6.4. In compliance with art. 12 paragraph 3) of the GDPR, IMA ITALIA informs that it undertakes to provide information about the action taken regarding a request pursuant to art. 15 to 22 of the GDPR without undue delay and, in any case, no later than one month after receipt of the request; this term may be extended by 2 months if necessary, taking into account the complexity and number of requests (in this case, IMA ITALIA undertakes to inform of such extension and the reasons for the delay, no later than one month after receipt of the request).

6.5. The rights described above (with the exception of the right pursuant to art. 77 of the GDPR) may be exercised by means of the contact details set out in art. 7 below.

 

7. Contact details.

7.1. IMA ITALIA can be contacted at the following address: ufficioprotezionedati@imaitalia.it.

7.2. The Data Protection Officer (DPO) under art. 37 of the GDPR, appointed by the business group to which IMA ITALIA belongs, can be contacted at the following address: dpoimaitalia@imaitalia.it.

 

Sesto S. Giovanni (MI), 29.10.2024 (date of last update).

 

IMA ITALIA ASSISTANCE S.p.A.

(in the person of its legal representative pro tempore)

 

For further information, IMA ITALIA refers, in its entirety, to the glossary/definition of the relevant condition of insurance issued by IMA ITALIA itself.