Privacy statement for processing of personal data in the context of health insurance, long- term care insurance and accident at work insurance

This privacy statement explains the reason for the processing of your personal data in the context of the ECB health insurance, long-term care insurance and accident at work insurance, the way they are collected, handled and protected, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights, the Data Protection Officer and the European Data Protection Supervisor.

While the ECB is the controller of your personal data, the processor is Allianz Worldwide Partners Health & Life Irish Branch (“Allianz”).

What is our legal framework?

All personal data are processed in accordance with European Union data protection law, that is to say in line with Regulation (EU) 2018/1725 (‘EUDPR’).

Why do we process personal data?

The processor collects and processes your personal data in the context of health insurance, long-term care insurance and accident at work insurance, which are necessary for:

• administering insurance contracts (claims)
• preventing and detecting fraud, money laundering and terrorist financing
• informing you about Allianz products and services that may be of interest to you and sending you a copy of the “My Health Matters” newsletter, with your explicit consent

For the purposes indicated above, the processor will administer, collect and process personal data they receive about you from the controller, the previous administrator of the insurance, and medical providers.

What is the legal basis for processing your personal data?

Your personal data is processed by the ECB’s processor in the context of the ECB’s performance of a task in the public interest related to the contractual relationship with ECB personnel, based on:

REGULATION (EU) 2018/1725, Art. 5(1)(a): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (including management and functioning of the institution)

REGULATION (EU) 2018/1725, Article 10(2) in conjunction with Articles 4(1)(a) and 5(1) regarding the processing of health data and with Article 48 of Regulation (EU) 2018/1725, ‘Transfers subject to appropriate safeguards’ (EU Standard Contractual Clauses & Transfer impact Assessments) and Allianz’ approved binding corporate rules known as the Allianz Privacy Standard (Allianz’ BCR) establishing adequate protection for personal data and which are legally binding on all Allianz Group companies

Conditions of Employment for Staff of the European Central Bank, Article 33 (ECB health insurance cover against medical and dental expenditure), Articles 33a and 33b (long-term care insurance), Article 34 (occupational disease or accident at work insurance), Article 36 (a)(iii) (cover under the ECB health insurance, long-term care insurance and accident insurance scheme for members of staff who are unemployed following termination of their contract with the ECB), Article 36.a (c) (continued cover under the ECB health insurance, long-term care insurance and accident insurance scheme during cooling-off period), Article 36b. (ECB health insurance and long-term care insurance for surviving spouse and/or dependents), Article 37.a (d) (ECB health insurance and long-term care insurance for pensioners or dependants who receive a spouse’s or children’s pension), Article 38 (pensioners) in conjunction with Annexes III and IIIa

Conditions of Short-Term Employment for Staff of the European Central Bank, Article 29 (health insurance for short-term contract employees, their dependent spouses and their dependent children), Article 29a.(long-term care insurance for short-term contract employees, their dependent spouses and their dependent children), Article 29b.( insurance cover under the ECB health insurance and/or under the ECB long-term care insurance for their former spouses), Article 30 (full insurance cover in case of occupational disease or accident at work), Article 31a. (b) continued cover under the ECB health insurance, long-term care insurance and accident insurance scheme during cooling-off period.

Staff rules of the European Central Bank: Article 6.2 and Annex III (ECB health insurance), Article 6.2a and Annex IV (Long-term care insurance)

Rules for Short-term Employment: Article 6.1 (medical and dental plan), Article 6.1a (Long-term care insurance), 6.2 (Accidents, accidents at work and occupational disease)

Decision of the European Central Bank of 4 August 2015 on the rules governing the traineeship programme of the European Central Bank, and repealing Decision ECB/2010/NP4 (ECB/2015/NP13), Article 17 (trainees’ mandatory accident at work cover, optional health insurance cover)

Contract with AWP Health & Life (private limited company) (‘Allianz’) (Health and long-term care insurance services and related) PRO – 001804 – 2019.

Who is responsible for processing your personal data?

The ECB is the controller for the processing of your personal data. Allianz is responsible for this processing.

Who will be the recipients of your personal data?

Recipients of your personal data are authorised Allianz staff members. Access to data is strictly regulated by a need-to-know approach.

Allianz may contact third parties and/or share your data with:

• medical providers confirming the coverage, and medical evacuation and repatriation providers
• the sub-contractor responsible for shredding (as approved by ECB)
• Allianz Technologies which provides IT support, system development and storage
• Allianz uses Third Party Administrator Olympus (US) for processing of personal data of insured members working in an office of the ECB outside the EEA (US), and members of staff on external secondment to the US, including their insured dependents, as well as for claims of other insured persons, originating in the US
• persons involved in the investigation, in case of fraud
• Citi Bank for the execution of claims payments

Your personal data may be processed by the parties specified above, subject always to contractual restrictions regarding confidentiality and security, in line with applicable data protection laws and regulations. Allianz will not disclose your personal data to parties who are not authorised to process them.

What categories of personal data are collected?

The processor will collect and process these personal data:

• Surname, first name
• Date of Birth
• Gender
• Address
• Contact Details (email address, telephone numbers)
• Identification Document
• IP addresses when visiting our webpage without disabling Cookies
• Nationality
• Marital Status
• Occupation
• Employer details
• Language
• Dependents

The processor also collects and processes “sensitive personal data” about you resulting from medical reports or from death certificates, your medical claims history, details of physical and psychological health or medical conditions, credit/debit card and bank account details.

The processor collects and uses your personal data that you provide to them and that they receive about you for a number of specified purposes (from the ECB, third parties such as other insurers, medical providers, fraud prevention agencies and investigators) and with your explicit consent unless applicable laws and regulations do not require them to obtain your explicit consent.

Without your explicit consent, the processor processes your personal data based on their legitimate interests and/or to comply with their legal obligations. Legitimate interests which the processor uses include the recording calls for training purposes and ensuring the network and information security of their systems. The processor will not use their legitimate interest to process your personal data when your interests, rights and freedoms take priority.

Without your explicit consent, the processor may also collect and process your data for the protection of your vital interests or the vital interests of another natural person, when processing is necessary for the performance of a contract, for compliance with a legal obligation to which the controller is subject, for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity, for the legitimate interests of the insurer or a third party (unless overridden by your interests, rights or freedoms).

Your explicit consent may be needed in the context of insurance contract administration, for marketing purposes and your experience on their website or mobile application.

Will your personal data (in a clear or encrypted form) be processed (e.g. transferred, accessed or stored) in third countries or by international organisations?

Your personal data may be processed both inside and outside of the European Economic Area (EEA), subject always to contractual restrictions regarding confidentiality and security in line with applicable data protection laws and regulations. In the absence of an Adequacy decision, a processor may transfer personal data to a third country or to an international organisation only if the processor has provided appropriate safeguards.

Allianz may process personal & health related data using sub-contractors located outside the EEA, namely India and the United States and has provided appropriate safeguards. See above Section ‘What is the legal basis for processing your personal data?’, 3rd paragraph.

Within the Allianz Group:

Allianz Technology India (since approx. 2010) & Allianz Assistance India (since 2018)

Outside of the Allianz Group:

Allianz Technology, from 2022 to Microsoft Ireland (MS365 Suite) who use subcontractors in the US

Allianz Technology, from September 2024 subcontract to Accenture Ireland who use subcontractors in India, those sub-contractors are part of the Accenture Group

Allianz uses EGain Communications. The processors are processors located in the US & India, upgrading to the cloud version in 2021.

How long will the ECB keep personal data?

The period of data storage by Allianz is 10 years from the date of collection of your personal data. At the end of the retention period your data will be deleted or anonymised.

What are your rights?

You have the right to access your personal data and correct any data that is inaccurate or incomplete. More specifically you have the right to:

Access your personal data held about you and to learn the origin of the data, the purposes and ends of the processing, the parties to whom the data may be disclosed

• Withdraw your consent at any time where your personal data is processed with your consent
• Obtain your personal data in an electronic format
• Exercise your right to data portability
• Delete your personal data

You have (with some limitations) the right to delete your personal data from the processor’s records if it is no longer needed for the purposes indicated above, subject to regulatory personal data retention requirements and to object to or to restrict the processing of your personal data in line with EUDPR.

You have the right to object to the processor processing your personal data -for example where you have contested the accuracy of your personal data, for the period enabling the processor to verify its accuracy or where when processing claims the processor may use automated decision-making technology to process your health data. You have rights to object to such processing by the processor or appeal any decision made through its use. You can request that a person make the decision on your claim.

You have the right to tell the processor to stop processing personal data. Once you have informed the processor of this request, the processor no longer processes your personal data unless permitted by applicable laws and regulations.

You have the option to delete your MyHealth account directly through the MyHealth app or portal.

You may exercise these rights by contacting the processor providing your name, email address, account identification, and purpose of your request.

To safeguard the interests and objectives referred to in Article 25(1) EUDPR, your rights may be restricted.

Who can you contact for queries or requests?

Contact point at external third party: DPO contact for Allianz: AP.EU1DataPrivacyOfficer@allianz.com

You can exercise your rights by contacting ECB.Helpline@Allianz.com.

You can also directly contact the ECB’s Data Protection Officer at dpo@ecb.europa.eu for all queries relating to your personal data.

Addressing the European Data Protection Supervisor

If you consider that your rights under the EUDPR have been infringed as a result of the processing of your personal data, you have the right to lodge a complaint with the European Data ProtectionSupervisor at any time.