Privacy policy of HanseMerkur

2 Conclusion of an insurance contract via the website

The data given by you within the framework of the conclusion of an insurance contract will be processed for handling processes within the booking process and for any subsequent insurance pay-out process. Only data will be collected, saved and used that are absolutely necessary for the handling processes.

The following customer data will be collected and saved by us:

• Personal data (e.g. name, address, date of birth, e-mail address)
• Travel information (e.g. travel date, travel destination, travel price, travel booking date)
• Payment information (e.g. account holder, IBAN & BIC / credit card number, credit card company, credit card holder)
• Date when the insurance was taken out

The legal basis for the data processing is Art. 6(1)(b) of the GDPR. The processing is necessary for the conclusion and the fulfilment of the contract.

The data you provide when taking out a policy online may be used by HanseMerkur to check for any unusual activity (e.g. simultaneous online policy purchases using different customer accounts). HanseMerkur has a legitimate interest in carrying out such checks.

To prevent fraud, we also use the services of Risk.Ident GmbH, Am Sandtorkai 50, 20457 Hamburg, when operating our website.

Risk.Ident collects and processes data using cookies and other tracking technologies to identify the user's device and gather further data on website usage. This data is not linked to a specific user. Whenever Risk.Ident collects IP addresses, these are encrypted immediately.

The data is stored by Risk.Ident in a database for the purpose of fraud prevention. The database also stores data on end devices transmitted by us to Risk.Ident, the use of which has already led to (attempted) fraud. In this context, too, no association is made with specific users.

As part of the application process on our website, we retrieve a risk assessment for the user’s device from the Risk.Ident database. This risk assessment of the likelihood of a fraud attempt takes into account, amongst other things, whether the device has connected via different service providers, whether the device has a frequently changing geographical location, how many transactions have been carried out via the device, and whether a proxy connection is being used.

The legal basis for processing the data for the purpose of fraud prevention is Article 6(1)(f) of the GDPR.

4 Use of cookies

When you visit the websites, so-called cookies are stored on your computer, depending on the area. Cookies are small text files in which the provider of a website stores data relevant to it in order to facilitate surfing on the website. Such a cookie cannot be read by any website other than the one that placed the cookie. HanseMerkur does not store any of your personal data in the cookies. The maximum lifetime of the cookie is 90 days. At the end of this period, they are automatically deleted. A new cookie is set each time you visit the website. If a cookie exists, the information is updated. This corresponds to deleting and resetting the cookie.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognised even after a page change.

The purpose of using analytics cookies is to improve the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimise our offer.

Advertising-related cookies are used for the purpose of presenting you with customised advertisements.

When accessing our website, users are informed by an info banner about the use of cookies for analysis purposes and referred to this privacy policy. In this context, there is also a reference to how the storage of cookies can be prevented in the browser settings. The legal basis for the processing of personal data using cookies is Art. 6 para. 1 lit. f GDPR.

How can I manage cookies?

As an Internet user, you can decide for yourself whether you want to accept cookies or block them completely. We can no longer guarantee the correct display and full functionality of our website if cookies are disabled.

Cookies are stored on the user's computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically.

What types of cookies do we use?

We use four types of cookies on our website: Generally Required Cookies, Functional Cookies, Performance Cookies and Advertising Cookies.

We use generally necessary cookies (session cookies) for the general use of our website. In this way, certain actions performed by the user are saved. These cookies are necessary for functional navigation on the website and for the use of certain website functions. This makes it easier for the user to visit our website, as it allows them to make optimum use of various areas of our site.

Functional cookies (session cookies) enable us to customise our website to the personal preferences of our users by saving the entries and selections made, such as name, region or language settings. These settings are only valid for visits to our website and cannot be used by other websites.

Performance-related cookies (persistent cookies) help us to measure the data traffic and functionality of our website. This allows us to recognise which areas of our site users visit most frequently and whether any error messages appear on these pages. In this way, we create a more user-friendly experience when using our website.

We use advertising-related cookies (persistent cookies) to present the user with customised advertisements. We also use these cookies so that we can track how often certain adverts appear to a user.

Further information on session cookies and persistent cookies

Session cookies store information that is used during your current browser session. As soon as you close the browser, these cookies are automatically deleted. Persistent cookies store information between two visits to the website so that you can be recognised as a returning user on a subsequent visit.

Basic information about cookies:

You can prevent the setting of cookies in your browser - and thus also any storage or collection of data - by deactivating cookie storage in your browser.

• Internet Explorer
• Mozilla Firefox
• Google Chrome
• Safari
• Opera

Overview of cookies used

We use the following cookies: Overview

6 Customer and product reviews

We have integrated company and product reviews on our website to give our customers the opportunity to post review insurance. At the same time, we want to improve our internal quality management. When you click on the customer review link after completing your online booking or online application, you will be redirected to a questionnaire at eKomi. To prevent multiple reviews, we forward an anonymised ID to eKomi. eKomi also stores your IP address. eKomi is committed to handling your transmitted data in compliance with data protection regulations and takes all organisational and technical measures to protect your data.

We also work with Trustpilot A/S ("Trustpilot") and Google to collect customer feedback. Trustpilot also asks for your name and email address. If you would like to know more about how Trustpilot  or Google processes your data, you can view the company's privacy policy here. The Google privacy policy can be found on the Google website.

The data is processed in accordance with Art. 6 (1) lit. a GDPR. Your feedback will help us to improve this process and products for all customers on a continual basis.

8 Security of your personal data when using this website

On our website, we provide a contact form and an online application, which can be used to send us a message or to take out an insurance policy directly via our website. If you use this option, the data you enter into the input mask will be transmitted to us and stored. The personal data that we collect through service functions and forms based on your consent to the collection, processing and use of your personal data are transmitted in encrypted form over a secure Internet connection to our computer, where they are stored and secured. The encryption process used complies with the latest technology standards (TLS or SSL). The other personal data processed during the sending is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

When you transmit your personal data – e.g. by submitting a claim notification, by using the HanseMerkur RechnungsApp (invoicing app), by making an online application, by requesting a quotation or advice and by confirming this privacy notice – you declare that you consent to the storage and processing of the data that you have submitted for the purpose of processing and responding to queries (where required) within the required scope. Depending on the matter in hand, it may be necessary to forward this data to authorised third parties, or to process it using an automated system.

Where we obtain the consent of the user to processing the data, the legal basis for data processing is Art. 6 (1) lit. a GDPR and with respect to online transactions, Art. 6 (1) lit. b GDPR. The legal basis for health data processing is Art. 9 (2) lit. a GDPR.

The data will be deleted when they are no longer necessary for the purposes for which they were collected. For personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation ends when the circumstances indicate that the matter in question has been definitely resolved. The additional personal data collected during the sending process will be deleted at the latest after seven days.

Users are entitled to revoke their consent to the processing of personal data at any time.

10 Service – request documents & change contact information

On our website, you have the possibility to request specific documents or to change your contact information using forms. Please note that we offer different forms for different purposes (e.g. copy of insurance policy or confirmation of Covid-19 travel conformation conformation or cancellation of insurance). In order to send you the requested documents or change confirmations, it is necessary for you to provide us with the personal data requested in the forms. This is the only way we can correctly process your requirements and send you the requested documents or change confirmations to the e-mail address stored for your contract. If the verification of your provided data is successful, your request can be processed automatically.

Please note that we always send the requested documents to the e-mail address you used while booking in order to ensure that no unauthorized persons can access your information. If no e-mail address is stored for your contract, we will check whether an alternative e-mail address is stored in the customer database of HanseMerkur, which can be used as a substitute.

Please understand that, for security reasons and to protect your data, we are unable to send the requested documents to an alternative e-mail address that is unknown to us. For any queries regarding the requested documents, please provide us with your preferred e-mail address. We will use that e-mail address only to contact you for clarification. This e-mail address will not be added to our databases and of course, the e-mail address will not be passed on to third parties.

Based on your entered name, insurance policy number and date of birth, we will check whether the processing can be automated or not. An automated process takes place if an exact assignment has been possible without doubt based oft the entered information.

On the basis of the opt-in provided by you in the context of the document request, processing takes place on the basis of consent pursuant to Art. 6 para. 1 lit. a EU-DSGVO.

Rights

Rights of data subjects

You can request information about the personal data we hold about you by writing to the above address. In addition, under certain circumstances, you may request your data to be rectified or deleted. You are also entitled to restrict the processing of your data and to have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format.

Right to object

You have the right to object to the processing of your personal data for direct marketing purposes. If we process your data to protect legitimate interests, you can object to the processing of data on compelling legitimate grounds relating to your particular situation.

Right to complain

You have the option to complain either to the data protection officer specified above or to a data protection supervisory authority. The data protection supervisory authority responsible for us is:

Hamburg Commissioner for Data Protection and Freedom of Information
Klosterwall 6,
20095 Hamburg

back to the homepage of the data protection area