Privacy Policy and Subcontracting
Privacy and Personal Data Protection Policy
At AXA Wealth Europe, we are fully committed to respecting your privacy and protecting your personal data. This statement explains how AXA Wealth Europe, as an entity of the AXA Group, collects, uses and protects your personal data when you are a prospective customer, policyholder, insured person or insurance beneficiary. It also informs you of your data protection rights under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (GDPR).
This statement may be updated from time to time. The date of the latest update is indicated at the beginning of the document.
Data Controller
The data controller is AXA Wealth Europe S.A., an insurance company whose registered office is at 1 Place de l’Étoile, L-1479 Luxembourg, and which is registered with the Luxembourg Trade and Companies Register under number B206515.
As data controller, AXA Wealth Europe determines the purposes and means of processing your personal data and is your primary contact for any questions relating to the processing of that data.
Categories of Personal Data Processed by AXA Wealth Europe
The individuals whose personal data are processed by AXA Wealth Europe include:
- Individual customers;
- Any other individuals involved in processing relating to a transaction, whether acting as authorised representatives, partners, suppliers, directors, employees, involved third parties, legal representatives, other guarantors or contact persons, as well as users of the AXA Wealth Europe website.
Personal data means any information relating to an identified or identifiable individual. An identifiable individual is someone who can be identified directly or indirectly. Different pieces of information that could, when combined, lead to the identification of a particular individual also constitute personal data. Anonymised or aggregated information that does not (or no longer) identify a particular individual is not considered personal data.
This includes, in particular:
- Identification data, such as surname, first name, home address, email address and telephone number;
- Data relating to family or marital status, household composition and protective arrangements;
- Data relating to contract administration;
- Data relating to economic, financial and asset circumstances;
- Data relating to professional circumstances;
- Data required to assess risk;
- Health data, including medical reports;
- Data relating to personal characteristics such as age, sex, lifestyle, consumption habits and leisure activities;
- Judicial data and information from the Public Prosecutor’s Office relating to claims, offences, etc.
The personal data collected and processed by AXA Wealth Europe are provided by the policyholder, the insured person, the insurance beneficiary or a third party, either when applying for an insurance policy or in connection with the performance of a life insurance contract.
AXA Wealth Europe collects and processes only data that are relevant and strictly necessary to enter into a contract and achieve the purpose pursued by that contract.
Purposes of Processing and Legal Bases
The processing of personal data includes any operation performed on that data, such as collecting, recording, using, disclosing, modifying, archiving or deleting it.
The main legal basis and purpose of this processing are related to the implementation and performance of the insurance contract, in accordance with the Law of 27 July 1997 on insurance contracts and the Law of 7 December 2015 on the insurance sector.
The table below sets out the purposes for which your personal data are processed and the corresponding legal bases under the GDPR.
Purposes relating to the conclusion and performance of the insurance policy
| Purposes | Legal bases |
|---|---|
| Assessment of your needs and pricing Analysing your circumstances to advise you. Assessing risks to calculate your premium. | Taking steps at your request prior to entering into a contract |
| Combating money laundering and the financing of terrorism KYC checks. Checks against official international sanctions lists. | Legal obligations |
| Day-to-day management of your contracts Creating and amending your contracts (endorsements, cancellation). Managing your payments and premiums. Adjusting our offers (discounts). | Performance of the insurance contract |
| Complaints and disputes Handling your complaints. Defending our rights in legal proceedings. | Performance of the insurance contract |
| Management of premium payments | Performance of the insurance contract |
| Online customer area Creating and managing your access to our website and mobile application. | Performance of the insurance contract |
| Marketing communications By electronic or postal means (newsletters, promotional offers, news, competitions). Additional offers and customer loyalty communications to existing customers by electronic means concerning similar services. Note: You may object easily and at any time. | Consent Legitimate interest |
| Customer satisfaction surveys Asking for your feedback on our services, reception or management of your contract in order to improve the quality of our services. Note: You may object easily and at any time. | Legitimate interest |
| Governance Preparing statistics and actuarial studies. Combating fraud. | Legitimate interest |
| Legal obligations Meeting our pre-contractual information obligations. Exchanging information with judicial authorities. Managing dormant policies. | Legal obligations |
For the purposes listed above, AXA Wealth Europe does not make decisions solely by automated means; human involvement is always included.
Data Retention Periods
Personal data are retained only:
- For as long as necessary to fulfil the purposes for which they were collected, that is, throughout the performance of your life insurance contract;
- After the contract ends, for the applicable statutory and limitation periods. Data may be retained for up to 30 years due to the long-term nature of these financial products, due diligence obligations (KYC / AML-CFT) and regulatory time limits for locating beneficiaries after the insured person’s death or the end of the contract.
- Prospective customers (where no contract is concluded): Your data are retained for a maximum of three years from the date of collection or your last contact with us.
- Life insurance: Data are retained throughout the life of the contract and for up to 30 years after it ends (through full surrender, maturity or the death of the insured person).
Disclosure of Personal Data to Third Parties
AXA Wealth Europe may disclose your personal data to its service providers, suppliers and intermediaries in connection with the management of insurance contracts.
AXA Wealth Europe shares personal data with its intermediaries and processors in accordance with the professional secrecy requirements set out in Article 300 of the Law of 7 December 2015 on the insurance sector and the requirements governing the processing of personal data by processors under Article 28 of the GDPR.
In its capacity as an insurer, AXA Wealth Europe may, in certain circumstances, disclose some personal data to other insurers, reinsurers, insurance or reinsurance brokers and other intermediaries and agents, lawyers, auditors, IT service providers, business partners, and governmental and mediation authorities located in the Grand Duchy of Luxembourg or abroad.
Your data may also be disclosed to administrative, social security, tax and judicial authorities.
Transfers Outside the European Union
Personal data may be transferred to a country outside the European Union in the following permitted circumstances, and subject to the strict limits and conditions laid down by Luxembourg law on insurance secrecy:
- The transfer is made to a country that ensures an adequate level of protection, as determined by the European Commission or assessed as such by a competent authority;
- The transfer is governed by the standard contractual clauses adopted by the European Commission;
- The transfer is made to an AXA Group entity that has signed binding corporate rules (“Our commitments | AXA”), which ensure an adequate level of protection;
- The transfer is permitted under one of the exceptions set out in Article 49 of the European data protection regulation, including where the data subject has given explicit consent, where the transfer is necessary for the performance of insurance contracts, to protect human life, or to establish, exercise or defend legal claims.
Only data that are relevant to the purpose of the transfer may be transferred. To ensure that personal data are processed lawfully, AXA Wealth Europe undertakes to provide complete information about the purpose and nature of the data and the country or countries receiving them before any transfer or upon request by the data subjects.
Processing by Service Providers
In its ongoing effort to improve service quality, AXA Wealth Europe may outsource certain services to third parties in accordance with the principles described above and subject to the conditions and limits laid down by the law on the insurance sector (Article 300 of the Law of 7 December 2015 on the insurance sector).
To ensure a high level of service and provide its customers with access to advanced technologies, AXA Wealth Europe may use service providers or processors, including cloud computing services, that comply with Circular LC 21/15 of the Commissariat aux Assurances and provide for encrypted data storage within the European Union under the control of AXA Wealth Europe (such as Microsoft Azure, Microsoft 365 and Amazon Web Services). In all cases, the data disclosed are protected in accordance with high security standards.
Some processors also hold PSF (Professional of the Financial Sector) certification issued by the CSSF (Commission de Surveillance du Secteur Financier), or PSA (Professional of the Insurance Sector) certification issued by the CAA (Commissariat aux Assurances).
The Company may outsource the following services and processing operations to external or intra-group service providers:
| Purpose of outsourcing | Service provider | Provider’s country of establishment | Categories of data | Data location |
|---|---|---|---|---|
| Printing and mailing services | Victor Buck Services S.A. (PSF) | Luxembourg | Data contained in communications; personal data required for mailing (e.g. addresses, contract details, name(s) of the policyholder(s), etc.). | Luxembourg |
| IT infrastructure services | NTT Luxembourg S.A. (PSF) | Luxembourg | Personal data and information contained in contracts and databases. | Luxembourg, Germany, France, the Netherlands, the United Kingdom |
| Software services | Salesforce.com | France | No access to personal data. | France |
| Physical archiving services | LAB Luxembourg S.A. (PSF) | Luxembourg | Personal data and information contained in contracts. | Luxembourg |
| Asset valuation services: calculation of net asset value, accounting reports, reports monitoring investment compliance, and subscription/redemption statements. | UI efa S.A. (formerly European Fund Administration S.A.) | Luxembourg | Product-related information (no personal data involved). | Luxembourg, France, Germany, Belgium |
| Financial information service: platform providing regulatory documents (e.g. PRIIPs, SFDR, etc.). | Confluence (formerly AMFINE Services & Software SAS) | France | Product-related information (no personal data involved). | France |
| Tool for screening personal data against watchlists used to combat money laundering and the financing of terrorism and to implement restrictive measures imposed by the EU, UN, OFAC and OFSI; risk management within the AXA Group relating to laws and regulations on anti-money laundering and counter-terrorist financing, international financial sanctions and embargoes. | AXA Group Operations SAS (intra-group) | France | Personal data required to identify data subjects (including personal data of any party involved in or connected with a business relationship and beneficial owners); personal data relating to policyholder transactions, such as surrenders/payments and contract termination; personal data collected when the contract is concluded and throughout its term; publicly available information (e.g. press, internet, etc.) relating to policyholders. | France, Belgium, Germany, Portugal |
| Digital application module and connection for insurance intermediaries and customers, enabling them to take out, view and manage contracts; application maintenance. | Quantalys | France | No access to personal data. | France |
| Identifying application users when they create a customer account; application maintenance. | Harvest France | France | Personal data required to create the customer account (surname, first name, company name, telephone number and email address, etc.) and data contained in contracts. | Luxembourg, Germany, France |
| Managing the digital application and the data relating to it. | Simac (PSF) | Luxembourg | Personal data contained in contracts. | Luxembourg |
| Personal and confidential electronic access and connection method using an electronic signature or another electronic certificate issued and managed by trusted third parties, including Cryptolog International SAS, a certification authority that issues and manages electronic certificates in accordance with Luxembourg legislation on electronic commerce and electronic signatures. | Cryptolog International SAS (Universign) | France | Electronic identification data (e.g. email address, IP address, telephone number, electronic signature, etc.) and personal data contained in contracts. | France |
Rights of Data Subjects
Under the GDPR, you have the following rights:
Right of access
Every data subject has the right to access the data held by AXA Wealth Europe that relate to them. Before granting access, the data controller will always verify the identity of the person making the access request.
The data controller will provide the requested data within one month of receiving the request.
The right of access is generally free of charge for the data subject. However, if it places an excessive burden on the Companies, a fee may be charged.
Right to withdraw consent
Any data subject whose personal data are being processed may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.
Right to rectification
Any person whose personal data have been collected as part of a processing activity may, without undue delay, have incomplete data completed or inaccurate data corrected.
Right to erasure
Data subjects may also ask the data controller to erase their personal data without undue delay where:
- The data are no longer necessary for the processing;
- The data subject withdraws consent and there is no other legal basis for the processing;
- The data subject objects to the processing;
- Erasure is necessary to comply with a legal obligation.
Right to object or restrict processing
Any data subject may request the restriction of the processing of their personal data where:
- The data subject contests the accuracy of the data and requests that processing be suspended so the data controller can verify their accuracy;
- The data subject does not want their data erased but wants its use to be restricted;
- The data are outdated but are needed by the data subject to establish, exercise or defend legal claims.
Right to data portability
Data subjects have the right to receive the personal data concerning them that they have provided to AXA Wealth Europe in a structured, commonly used and machine-readable format. They also have the right to transmit those data to another data controller without hindrance from the controller to which the personal data were provided. This right may be exercised where processing is automated and based on consent.
All requests should be sent to: dpo@axa.lu.
AXA Wealth Europe reserves the right to refuse to respond to a request that is manifestly unfounded or excessive (for example, a repeated request). If a request is refused, AXA Wealth Europe undertakes to explain the reasons for the refusal and the available options for lodging a complaint with the relevant supervisory authority.
To help us process your request as quickly as possible, please provide the following information:
- Your customer number;
- Your surname;
- Your first name;
- Your email address;
- Your telephone number;
- The subject of your request;
- A description of your request;
- A document proving your identity (passport, identity card, etc.).
Remedies and Complaints
AXA Wealth Europe is committed to protecting your data. If you disagree with how your data are handled, please contact our Data Protection Officer (DPO) using the contact details given above.
If you are not fully satisfied with our response, you may lodge a complaint with the National Commission for Data Protection (Commission Nationale pour la Protection des Données, CNPD) at 15, Boulevard du Jazz, L-4370 Belvaux, or online using its official complaint form.