MEDIAN – Corretores de Seguros, S.A. registered with the ASF – Autoridade de Supervisão de Seguros e Fundos de Pensões, ensures compliance with the legal obligations arising from compliance with Regulation (EU) 2016/679 of the European Parliament and the Council (GDPR) and other legislation in effect and related to the issue of protecting personal data, in its processing of personal data.

By its nature, the insurance brokerage activity involves processing and sharing personal data. During the life cycle of an insurance policy, MEDIAN in the exercise of consulting and insurance brokerage, receives personal data on Customers, Potential Customers, Former Customers, Insured Persons, Third Parties/Injured Parties and other owners of personal data with which it interacts.

Thus, this Privacy Policy is directed at all private persons, whose personal data MEDIAN receives in connection with the services it provides.

You can find detailed information on the Privacy Policy as the following points:

I. Who is “Responsible” for processing my personal data?

II. What personal data will be processed?

III. What is the purpose of processing my personal information and what is the basis of the lawfulness?

IV. How will my personal data be processed?

V. Who are the recipients of my personal data?

VI. How long will my personal data be processed?

VII. What rights do I have over my personal data?

VIII. Who may I contact to obtain a response to my questions?

I. Who is “Responsible” for processing my personal data?

MEDIAN – Corretores de Seguros, S.A. is responsible for processing the personal data collected, by automated means or not, from its collection, organisation, conservation and elimination.

MEDIAN may also act as subcontractor, proceeding with processing your data on behalf of another entity responsible for the processing, which shall take place namely with insurance companies, when MEDIAN provides services in the context of managing and carrying out an insurance contract to which the owner of the data is a party (e.g., for purposes of claim management).

lI. What personal data will be processed?

In the context of providing services, MEDIAN processes the following categories of personal data:

a) Identification Data, regarding the policyholder, insured persons, injured persons and beneficiaries (e.g., name, address, place of birth, nationality, citizen’s card, sex, date of birth, telephone, e-mail address, taxpayer number, civil status, profession, driving license);

b) Data regarding the submission and management of claims in the areas of health, personal accidents and life (e.g., description of the claim, medical information, legal beneficiaries, payment order to be filled in by the beneficiary, proof of IBAN);

c) Data regarding the submission and management of claims in the area of workplace accidents (e.g., description of the claim, due date, premiums, extras, bonuses, meal vouchers, supporting data for managing the claim);

d) Data regarding the submission and management of claims in the automotive area (e.g., data on submission of Auto DAA claims, identification of third parties injured and witnesses);

e) Data regarding the submission and management of claims in other areas (e.g., description and submission of claims);

f) Data identifying the insured object (e.g., type of vehicle, plane or boat, registration, brand, model, year manufactured, chassis number, registration date, cylinder capacity, identification of other insured objects, housing, housing contents and animals);

g) Collection data (e.g., NIB/IBAN, name and owner of the Account, address, policy number);

h) Data on health and life habits (e.g., information regarding life habits, such as diet, sports, alcohol consumption, smoking, biometric indices, history of illnesses).

III. What is the purpose of processing my personal information and what is the basis of the lawfulness?

The main purpose of processing personal data is for the provision of consulting and insurance brokerage services by MEDIAN, including in the event of claim, and based on pre-contractual procedures or on the signing of a contract between the Customers and MEDIAN or between the insurance companies and reinsurance companies with whom the Customers entered into insurance or reinsurance contracts.

IV. How will my personal data be processed?

The personal data will be processed by MEDIAN, in the context of the purposes indicated previously, according to the policy and internal standards of MEDIAN and using suitable technical and organisational methods to promote safety and confidentiality, namely with regard to unauthorised or illegal processing of your personal data and its respective loss, destruction or accidental damaging.

V. Who are the recipients of my personal data?

MEDIAN will send the personal data that is essential to providing the services of insurance brokerage and consultation or to compliance with its legal obligations, to the following entities:

– The insurance or reinsurance companies with which insurance or reinsurance contracts have been entered into;

– Public authorities, such as Tax Authorities or Judicial Tribunals; and – Providers of computer services to MEDIAN.

VI. How long will my personal data be processed?

The personal data of users shall be preserved for the duration of the insurance or reinsurance contracts and for a period of 10 years for tax obligations and 7 years for compliance with obligations in matters of prevention of money laundering and financing terrorism.

VII. What rights do I have over my personal data?

At any time, you may:

1. Request access to the information we have about you; As owner of the personal data, you have the right to obtain confirmation that the data that concerns you is or is not being processed and, if so, to access your personal data ad access the information provided by law.

2. Request correction of the information if it is incorrect or incomplete As owner of the personal data, you have the right to have MEDIAN, without unjustified delay, correct the incorrect or incomplete information that concerns you.

3. Request the deletion of your personal data As owner of the personal data, you have the right to request that MEDIAN delete your data, without unjustified delay, and MEDIAN is required to delete your personal data, without unjustified delay, when one of the following reasons is applicable:

a) The personal data is no longer necessary for the purpose for which it was originally collected or processed;

b) You have withdrawn your consent for the processing of the data (in the event processing is based on consent) and there is no other reason for it to be processed;

c) You oppose the processing and there are no prevailing legitimate interests that justify processing.

4. You request limiting the processing of your personal data As owner of the data, you have the right to obtain and request that MEDIAN limit the processing of your data if any of the following applies:

a) Disputing the accuracy of the personal data, during a period that allows MEDIAN to verify its accuracy;

b) The processing of data is lawful and the owner of the data opposes the deletion of the personal data and requests, instead, limits on its use;

c) MEDIAN no longer needs the personal data for processing purposes, but this data is requested by the owner for purposes of declaring, exercising or defending a right in a court process;

d) If you opposed processing, until it is confirmed that the legitimate reasons of the person responsible for processing prevail over those of the owner of the data.

5. Oppose the processing of your personal data In cases where the processing of data is done for purposes of the legitimate interests pursued by MEDIAN; or the processing of data is done for purposes of direct marketing, you may also, at any time, oppose the processing of your personal data.

6. If the processing depends on your consent, you have the right to remove it.

If the consent is legally necessary for the processing of personal data, the owner of the data has the right to remove consent at any time, although this right does not compromise the lawfulness of the processing done based on the consent previously given or the later processing of the same data, based on other grounds, such as compliance with the contract or the legal obligation to which MEDIAN is subject.

If you want to exercise any of your personal rights, please contact us, in writing, at the e-mail geral@median.pt or by letter, sent to Rua Cidade de Bolama, 10 – 7º.B, 1800-079 Lisbon.

Your requests will be processed with special care so that we can ensure the efficacy of your rights. You should be aware that, in certain cases (for example, due to legal requirements), your request may not be immediately satisfied.

In any event, you will be notified of the measures taken in this regard, within one month of from the time the request was made.

You also have the right to submit a complaint to the National Data Protection Commission.

VIII. Who may I contact to obtain a response to my questions?

For any issues related to the protection and privacy of your personal data, you may contact us, in writing at the email geral@median.pt or by letter, sent to the address Rua Cidade de Bolama, 10 – 7º.B, 1800-079 Lisbon.

This policy entered into force on 25 May 2018 and may be subject to change. Should this occur, MEDIAN will update and date the new version.