Data protection policy

Definition

Axeria IARD, a French public limited insurance company, registered with the LYON Trade and Companies Register under number B 352 893 200, whose registered office is located at 129 avenue Félix Faure, 69003 LYON, and whose postal address is 26 rue du Général Mouton Duvernet, 69003 LYON, attaches great importance to the protection of your personal data in accordance with the General Data Protection Regulation and the French Data Protection Act.

The purpose of this Privacy Policy is to inform Data Subjects of the existence of the Data Processing implemented by Axeria IARD in its capacity as Data Controller and the procedures for its implementation.

1. DEFINITIONS

The following terms, whether used in the singular or plural in this Privacy Policy, shall have the following definition:

Account:   Axeria IARD:   Brokers / Managing General Agents: Candidate:	means the personal account created by any natural person to access the Extranet on the Site.   means the company, acting in its capacity as Data Controller, referred to in the legal notice accessible from the Site. means brokers who have an individual Account on the Extranet.   means any natural person of legal age who applies to Axeria IARD via the “Career” tab on the Site, which links to the platform published by HelloWork, whose confidentiality policy can be accessed by clicking here.
Data Controller:     Data Processor:	means the person, whether natural or legal, who determines the purposes of the Processing and the means by which it is carried out. means the natural or legal person, public authority, department or other body which processes Personal Data on behalf of the Data Controller.
Data Subjects:   Extranet:   Insureds:     Intermediate archiving:	means the natural person whose Personal Data is processed by Axeria IARD as defined in this Privacy Policy. means the private computer network controlled by Axeria IARD that uses Internet technology to connect a defined group of authorized Users. means any natural person of legal age who takes out an insurance policy with Axeria IARD, for their personal and/or professional needs, in accordance with the terms and conditions described in the “Our solutions” section of the Site.   means the removal of Personal Data that is still of administrative interest to Axeria IARD (such as in the event of litigation) and/or in the event of a legal obligation, into a separate database, logically or physically separate and to which access is restricted in any event. This archive is an intermediate step before the relevant Personal Data is deleted or made anonymous.
Personal Data:	means the personal data of the Data Subject, as defined in the Personal Data Regulations, collected and processed by Axeria IARD.
Personal Data Regulations:       Privacy Policy:   Processing:   Specific rights:	means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), the French Data Protection Act, and any other applicable data protection regulation. means the rights granted by the Personal Data Regulations to Data Subjects with regard to the Processing of their Personal Data. means any operation or set of operations carried out by Axeria IARD in its capacity as Data Controller using Personal Data collected from the Site or directly from Axeria IARD. means this policy on the confidentiality and protection of the Personal Data of Data Subjects implemented by Axeria IARD.
Site:	means the website accessible at the URL address: https://axeria.fr/en/ on which this Privacy Policy is hosted.
Terminal(s) :   Users:	means the hardware equipment (computer, tablet, smartphone, telephone, etc.) used by Data Subjects to consult or view the Site and/or any other digital medium published by a third party. refers to all users of and visitors to the Site, including Insureds, Candidates, Brokers / Managing General Agents and prospects.

 

Processing of your personal data

We use your Personal Data to enable you to access, use and improve the Site, and generally in connection with your relationship with Axeria IARD in order to:

• Creating and managing an Account to access the Extranet: this Processing is based on Axeria IARD’s legitimate interests, for which Personal Data is kept for a period of three (3) years from the last contact with the Data Subject.

 

• Using the Site: this Processing is based on Axeria IARD’s legitimate interest in enabling Users to browse the Site, for which Personal Data is kept for the duration of browsing on the Site.

 

• The preparation of commercial statistics, analyses and marketing tools (in particular classification, scoring, etc.): this Processing is based on the consent of the Data Subjects, for which the Personal Data is kept for a period of thirteen (13) months.

 

• Management of requests to exercise Specific Rights under the conditions set out in Article 8 – Specific Rights: this Processing is based on a legal obligation incumbent on Axeria IARD, for which Personal Data is kept in an active database for the duration of the request, then in an Intermediate Archive for a period of five (5) years.

 

• Managing recruitment via the “Career” tab on the Site: this Processing is based on pre-contractual measures, for which Personal Data is kept during the recruitment process.

 

• Retention of applications: this Processing is based on Candidates’ consent to Axeria IARD retaining their applications to contact them again later. Where applicable, Personal Data is retained for a period of two (2) years.

These processing operations are carried out in compliance with the Personal Data Regulations.

Each User is invited to read this Privacy Policy, which is available on the Site or may be obtained on request from Axeria IARD by sending an e-mail to the following address: dpd[@]axeria-iard.fr.

Collection of your personal data

Axeria IARD collects the following categories of Personal Data from you when you browse the Site, create an Account and then add to it as you go along, or when you contact Axeria IARD by telephone, electronically or in person:

• Identification data: surname, first name, gender, date of birth, postal address, e-mail address, telephone number.
• Data relating to professional life: CVs and covering letters sent by Candidates via the “Career” tab on the Site, professional situation of victims of a claim.
• Data relating to the insurance contract taken out with Axeria IARD: contract number, client number, claim number, date of entry into force and expiry date of the contract, product(s) taken out, related contractual guarantees, data relating to the driving license, number of the registration plate.
• Economic and financial information: bank details, monitoring the accounting status of contracts taken out.
• Connection data: User IDs and passwords (not stored in clear text) used to access their Account on the Site.
• Browsing data (date, time, IP address, pages viewed) of the Data Subject when browsing the Site.

Data storage and exercise of specific rights

1. 1. STORAGE OF PERSONAL DATA

   The Site is hosted by the company whose contact details are available by clicking here.

   Every precaution has been taken to store the Personal Data of Data Subjects in a secure environment and prevent it from being distorted, damaged or accessed by unauthorized third parties. Personal Data transmitted by the Data Subject will never be passed on to third parties for commercial purposes, nor will it be sold or exchanged.

   2. RECIPIENTS OR CATEGORIES OF RECIPIENTS

   During our business, we may use Data Processors to provide certain services on our behalf. As a result, some of your Personal Data may be transmitted. However, our Data Processors may not use your Personal Data for any purpose other than those requested.

   The collected Personal Data is reserved for the exclusive use of Axeria IARD and the following Data Processors:

   • In charge of hosting the Site.
   • In charge of the development and maintenance of the Site.

   As the Data Controller, Axeria IARD undertakes not to transfer Personal Data outside the European Union. In the event of such a transfer, Axeria IARD undertakes to implement appropriate safeguards in accordance with the European General Data Protection Regulation (GDPR), and in particular to implement the Standard Contractual Clauses adopted by the European Commission in their current version.

   Recipient of Personal Data	Type of Personal Data transferred	Purpose of the planned transfer	Data localisation	Level of protection offered by the country or exception provided for in the Personal Data Regulations
   OVH	All Personal Data processed from the Site	Site hosting	France	Suitable
   Web Adn	All Personal Data processed from the Site	Website facilities management maintenance	France	Suitable

    

   3. HYPERTEXT LINKS

   On the Site, Users may access other websites (in particular HelloWork) and social networks (LinkedIn) via hypertext links. If Users decide to access these sites from the Site, they leave the Site. Axeria IARD invites Users to consult the privacy policy of the website and/or social network concerned in order to understand how their Personal Data is shared and used in this context.

   4. DATA SECURITY AND CONFIDENTIALITY

   In accordance with the Personal Data Regulations, Axeria IARD implements all appropriate technical, physical, and organisational measures with regard to the nature of the Personal Data and the risks presented by the Processing, to preserve the security and confidentiality of Users’ Personal Data, in particular to prevent it from being deformed, damaged, or accessed by unauthorised third parties.

   5. SPECIFIC RIGHTS

   In accordance with the Personal Data Regulations, the Data Subject may, at any time, benefit from the following Specific Rights of/to:

   • Access your Personal Data
   • Correction
   • Deletion
   • Limitation of Processing
   • Portability
   • Objection
   • Post-mortem instructions
     • Access rights

   The Data Subject may obtain from Axeria IARD confirmation as to whether Personal Data relating to him or her is being processed and, where Personal Data is being processed, access to such Personal Data and the following information:

   1. The purposes of the Processing
   2. Categories of Personal Data
   3. The recipients or categories of recipients to whom the Personal Data have been or will be communicated
   4. Where possible, the intended retention period for Personal Data or, where this is not possible, the criteria used to determine this period
   5. The existence of the right to ask Axeria IARD to rectify or delete Personal Data, or to limit the Processing of Personal Data, or the right to object to such Processing
   6. The right to lodge a complaint with the French competent supervisory authority (CNIL)
   7. Where Personal Data is not collected from the Data Subject, any available information as to its source
   8. The existence of automated decision-making, including profiling, and, at least in such cases, useful information concerning the underlying logic and the significance and intended consequences of such processing for the Data Subject

   Where Personal Data is transferred to a third country or to an international organization, the Data Subject has the right to be informed of the appropriate safeguards with respect to such transfer.

   Axeria IARD provides a copy of the Personal Data being processed.

   Axeria IARD may charge a reasonable fee based on administrative costs for any additional copies requested by the Data Subject.

   Where the Data Subject submits his or her request electronically, the information shall be provided in a commonly used electronic form, unless he or she requests otherwise.

   The Data Subject’s right to obtain a copy of his or her Personal Data must not infringe the rights and freedoms of others.

   • Rights of rectification

   The Data Subject may obtain from Axeria IARD, as soon as possible, the rectification of any Personal Data concerning him or her that is inaccurate. The Data Subject may also request that incomplete Personal Data be completed, including by providing an additional declaration.

   • Erasure rights

   The Data Subject may obtain from Axeria IARD the deletion, as soon as possible, of Personal Data concerning him or her where one of the following reasons applies:

   • Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed by Axeria IARD
   • The Data Subject has withdrawn his/her consent to the Processing of this Personal Data and there is no other legal basis for the Processing
   • The Data Subject exercises his/her right to object under the conditions set out below and there is no compelling legitimate reason for the Processing
   • The Personal Data has been processed unlawfully
   • Personal Data must be deleted to comply with a legal obligation
   • The Personal Data has been collected from a child.

    

   • Limitation rights

   The Data Subject may obtain from Axeria IARD the limitation of the Processing of his/her Personal Data where one of the following grounds applies:

   • Axeria IARD shall verify the accuracy of the Personal Data following a challenge by the Data Subject to the accuracy of the Personal Data
   • The Processing is unlawful and the Data Subject objects to the erasure of the Personal Data and instead requests that its use be restricted.
   • Axeria IARD no longer requires Personal Data for the purposes of Processing, but it is still necessary for the Data Subject to establish, exercise or defend legal claims
   • The Data Subject has objected to the Processing under the conditions set out below and Axeria IARD verifies whether the legitimate reasons pursued prevail over the alleged reasons.
     • Right to data portability

   The Data Subject has the right to receive from Axeria IARD Personal Data in a structured, commonly used and machine-readable format where:

   • The Processing of Personal Data is based on consent or on a contract
   • Processing is carried out using automated processes.

   Where the Data Subject exercises his or her right to portability, he or she has the right to have the Personal Data transmitted directly by Axeria IARD to another Data Controller designated by him or her, where technically possible.

   The Data Subject’s right to the portability of his or her Personal Data must not infringe the rights and freedoms of others.

   • Right to object

   The Data Subject may object at any time, on grounds relating to his or her particular situation, to the Processing of his or her Personal Data based on Axeria IARD’s legitimate interests. Axeria IARD will then no longer process the Personal Data, unless it can demonstrate that there are compelling legitimate grounds for the Processing which override the interests and rights and freedoms of the Data Subject, or may retain the Personal Data for the establishment, exercise or defense of legal claims.

   • Post-mortem instructions

   The Data Subject may provide Axeria IARD with instructions regarding the retention, deletion and sharing of his or her Personal Data after his or her death, which instructions may also be registered with a “certified trusted digital third party”. These directives, or a sort of “digital will”, may designate a person to be responsible for their execution; failing this, the heirs of the Data Subject will be designated.

   In the absence of a directive, the heirs of the Data Subject may contact Axeria IARD in order to obtain information:

   • To access the processing of personal data for the purpose of “organizing and settling the estate of the deceased“
   • Receive communication of “digital assets” or “data resembling family souvenirs, which may be passed on to heirs“
   • Close the Data Subject’s Account on the Site and oppose the continued Processing of his/her Personal Data.

   In any event, the Data Subject may inform Axeria IARD at any time that he or she does not wish his or her Personal Data to be communicated to a third party in the event of his or her death.

   6. EXERCISE OF SPECIFIC RIGHTS

   These rights may be exercised at any time by contacting Axeria IARD by e-mail at the following address: dpd[@]axeria-iard.fr.

   For the purposes of enforcing its rights under the conditions set out above and in the event that Axeria IARD has doubts about the person making the request, Axeria IARD may ask the latter to prove his or her identity by providing his or her surname, first name and e-mail address and to accompany the request with a copy of a valid form of identification.

   A reply will be sent to the Data Subject within a maximum of one (1) month following the date of receipt of the request.

   If necessary, this period may be extended by two (2) months by Axeria IARD, which will notify the Data Subject, taking into account the complexity and/or number of requests.

   Should the Data Subject request the deletion of his or her Personal Data, Axeria IARD may nevertheless retain such Personal Data in the form of Intermediate Archiving for the period necessary to meet its legal obligations, or for evidentiary purposes during the applicable limitation period.

   The Data Subject may also lodge a complaint with the competent supervisory authority/ In France, this is the CNIL, whose address is 3, Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07.

    

   Version in force on: 28 march 2025