Privacy notice

Data controller

Assicurazione Castello di Annone, with offices in Asti, Castello di Annone and Rocchetta Tanaro.

Purposes and legal basis

The data collected through the forms (personal details, date of birth, contact details, identity document, IBAN) are processed for:

• Preparing the insurance quote and handling the request to take out the policy (legal basis: steps taken at the request of the data subject before entering into a contract, art. 6.1.b GDPR);
• Complying with legal obligations in insurance matters (art. 6.1.c GDPR).

Recipients

The data may be disclosed to Reale Mutua Assicurazioni to issue the policy and to parties authorised by law. They are not passed to third parties for marketing purposes.

Retention

The data are kept for as long as needed to perform the contract and for the subsequent legal obligations (at least 10 years from the end of the contractual relationship).

Vital signs and reflex test

The tools in the personal area that use the camera (vital signs, the reflex test of the alcohol test) process the images only in the browser of your device. No frame and no measured value is sent to the agency, to Reale Mutua or to third parties, and the agency has no access to them. Only the check-in dates, the badges earned and the values of the last scan (shown in the summary of the Health section) stay on the device, in the browser storage, and you can delete them at any time from the tool itself.

The results are not used for quotes, discounts, premiums or insurance assessments. The tools are optional, free and for adults only; they are not medical devices and give estimates for information only.

Strike alerts by email

Anyone who turns on the transport strike alerts on the map page gives their email address, the city of interest and, if they choose, the means of transport to follow. The data are processed on the basis of consent (art. 6.1.a GDPR), given by ticking the box in the form and confirmed by clicking the link we send to the address given, to send alerts on strikes affecting the city, the region, nearby airports or the whole country, and commercial communications from the agency about its own insurance products. We keep the date and text of the consent given and the IP address from which it was given.

Consent can be withdrawn at any time through the link at the bottom of every email: once withdrawn, sending stops and the subscription is deactivated. Addresses are not passed to third parties; emails are delivered through the technical provider of the sending service, which acts as data processor. The strike data shown come from the public calendar of the Italian Ministry of Infrastructure and Transport.

Monthly cyber check

Anyone who turns on the monthly re-check in the personal area asks us to check the email address of their account every month against archives of stolen data and to receive an email only if it appears in a new breach (art. 6.1.b GDPR). The address is sent to the XposedOrNot service, which returns the result. We keep the address, the language, the date of the last check, the text of the consent and the list of names of archives already known, to recognise new ones; we do not keep the details of the breaches. Every email contains the link to turn the service off, which can also be done from the personal area; once it is off, the checks stop.

Car insurance renewal reminder

Anyone who turns on the car insurance (RC auto) renewal reminder gives their email address, the vehicle's number plate and the expiry date of the policy. The data are processed to provide the service requested by the data subject (art. 6.1.b GDPR): to send an email on the expiry date if the renewal does not show up, and to check the renewal when the data subject tells us they have paid. The service starts only after clicking the link we send to the address given. For car plates, cover can be checked on the expiry date and after the payment notice through a technical provider (Openapi S.p.A.), which receives only the plate and acts as data processor; for other plates we use only the declared date. Commercial communications from the agency are sent only to those who accept them with the optional tick box (art. 6.1.a GDPR). We keep the date and text of the consents and the IP address from which they were given.

Every email contains the link to stop receiving reminders: once withdrawn, sending stops. Addresses are not passed to third parties; emails are delivered through the technical provider of the sending service, which acts as data processor.

Meeting request from the BTP simulator

Anyone who, from the comparison between investing through a bank and through a life policy in the BTP simulator, asks for an introductory remote meeting gives their first name, surname, email, mobile number and province of residence, states the solution they prefer to explore and a day and time slot. Together with the request we keep the simulation result they had in front of them (bond, amount, estimated gain), the text of the consent given, the date and the IP address from which it was given.

The data are processed on the basis of consent (art. 6.1.a GDPR) and of the pre-contract steps requested by the data subject (art. 6.1.b GDPR), solely to contact them again and arrange the meeting. The meeting is free and with no obligation; nothing is taken out through the form. Confirmation emails are delivered through the technical provider of the sending service, which acts as data processor. The data are not passed to third parties and are kept for twelve months from the request, unless a contractual relationship begins; consent can be withdrawn at any time by writing to one of the agency's offices.

Financial analysis report from the BTP simulator

Anyone who, from the BTP simulator, fills in the financial analysis questionnaire and asks for the PDF report gives their first name, surname and email address and the answers to the questionnaire: date of birth, employment status and sector, income band, band of cash in the account, band and type of investments, whether they have a pension fund and where their severance pay (TFR) goes. The answers are bands, not exact amounts, and stay in the browser until the report is requested. Together with the request we keep the calculated report, any simulation the data subject had in front of them, the text and version of the consent given, the date and the IP address from which it was given. Anyone who also asks for the meeting additionally gives mobile number, province, day and time slot, under the rules of the previous section.

The data are processed on the basis of consent (art. 6.1.a GDPR) to send the report by email and for informative and commercial communications on savings, retirement planning and protection, including by automated means. The report is an informative and educational analysis generated automatically from the answers: it is neither investment advice nor a personal recommendation, and it involves no purchase. The PDF is downloaded from a signed personal link that cannot be guessed and is valid only for that report. Emails are delivered through the technical provider of the sending service, which acts as data processor. The data are not passed to third parties and are kept for twenty-four months from the request, unless a contractual relationship begins; consent can be withdrawn at any time by writing to one of the agency's offices, and withdrawal stops communications with no effect on what has already been sent.

Together with the report we send an email to confirm the address. Only if the data subject confirms with the personal button is their account on the site created (or the existing one with the same email linked): the profile stores first name, surname, date of birth, employment status, any mobile number and the consent given, and the report remains available in the personal area. Without confirmation no account is created.

Rights of the data subject

You can exercise the rights of access, rectification, erasure, restriction, portability and objection by writing to one of the agency's offices. You may write in English.

Complaints

You have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).