Privacy Policy regarding the “Autonom Protect” Application

This Privacy Policy concerns the services provided by Alpha Software Providers S.R.L., the holder of the rights to the Application, with its registered office in Romania, Bucharest, District 1, 25 Argentina Street, Ground Floor, registered with the Trade Registry under no. J40/7995/2022, Sole Registration Code 46029978 (the “Company”), through the “Autonom Protect” Application (the “Application”).

Your personal data will be processed in order to provide claims management services relating to the insurance contract concluded with one of the Insurers using the Application, for the purpose of managing claims, as well as any services ancillary to claims management.

The Company undertakes to implement high standards of confidentiality and transparency regarding the personal data it processes for the use of the Application, in accordance with the provisions of the General Data Protection Regulation 2016/679 (hereinafter the “GDPR”), as well as any other legislation applicable in Romania. The protection of and complete transparency regarding the processing of your personal data in the Application are objectives of the utmost importance to us, which is why we have implemented this Privacy Policy (hereinafter the “Privacy Policy”).

When you use the services available in the Application, you agree to the terms of this Privacy Policy. The terms and expressions used in this Privacy Policy have the meanings assigned to them in the Terms and Conditions of Use of the Application, available at https://alphasoftware.ro/AIP/termeni_si_conditii, which supplement this Policy.

The Application may contain links to other websites. This Privacy Policy applies only to the Application. You should therefore carefully read the privacy policies of other websites. We do not control or review any of these third-party websites and, for this reason, we accept no liability for any direct or indirect damage related to their content, operations or services. If you choose to visit external websites through links available in the Application, you do so at your own risk.

Use of the Application involves the processing of users’ personal data, and the types of personal data differ depending on how the user chooses to interact with the Application’s features. To make these types of data easier to understand, you will find useful information below about how this data is processed.

1. Creating a user account

For the purpose of creating a User Account in the Application, the personal data we process is: surname, first name, telephone number, email address, and the date and time when the account was created and the session was initiated.

These categories of data are provided directly by the User when the account is created.

If you use a Google/Facebook/Apple account to create your account, your personal data is transmitted to us by those providers and consists of: surname, first name, telephone number and email address (used by you to sign in to those accounts). Information about the types of data transmitted to us is displayed to users when they first sign in using their Google/Facebook/Apple accounts.

2. Claim notification

The Application allows claim notifications to be submitted by injured parties or insured persons.

2.1. Claim notification submitted by the injured party

If the injured party completes the claim notification, the following personal data must be submitted to the Company:

• Data concerning the injured party
  surname, first name, personal numerical code (CNP), home address, email address and telephone number;
  • If the driver of the damaged vehicle is not the injured party, the same categories of data indicated above, belonging to that driver, will be transmitted;
  • Copy of the identity card and driving licence;
• Data concerning the insured asset and other assets involved in the Vehicle Incident
  vehicle type, model and registration year, vehicle registration certificate/identity card; chassis number; registration number;

This data is entered both in the form and at step 2 of the notification, where photographs of the registration certificate are uploaded.

To make the claim notification easier to complete, the controller provides the user with a feature that automatically fills in information about the damaged vehicle on the basis of an automated query. The automatic completion of information about the damaged vehicle is performed without transmitting any other personal data to third parties, except for the registration number. When the registration number field is completed, the chassis number, vehicle type and model may be filled in automatically. The User may always choose either to enter this information manually or to agree to the query carried out by the controller in relation to the registration number provided.

• Data concerning the vehicle incident
  Date, time, details of the location where the incident occurred, a description of the incident and the damage, and the official report issued by the Police or the amicable accident statement concluded between the insured person and the injured party;
  • Images of the damaged vehicle.
• Data concerning the insured person
  Copy of the identity card (provided at step 2 of the notification);
  • Photograph of the insurance policy
  • insurance policy number and series
• Data concerning witnesses
  Surname, first name, email address, telephone number and a copy of the identity card.

2.2. Claim notification submitted by the insured person

• Data concerning the insured person
  Insurance policy series and number

If the at-fault party is not the same person as the insured, the following categories of personal data will be provided: surname, first name, personal numerical code (CNP), home address, email address and telephone number.

• Data concerning the vehicle incident
  Date, time, details of the location where the incident occurred, a description of the incident and the damage, and the official report issued by the Police or the amicable accident statement concluded between the insured person and the injured party;
  • Photographs of the damaged vehicle.

2.3. Where the claim notification is completed by a repair shop authorised by the injured party, the same categories of data as those mentioned at point 2.1 will be provided to us by the repair shops and not directly by the injured party. The injured party chooses the actual method by which the claim notification data is submitted.

3. General use of the Application

The Application allows biometric authentication to be enabled if the device used by the User to access the Application supports it. In this regard, you should be aware that the Company does not store or process your biometric data, as the operating systems used by mobile devices do not allow such information to be transmitted to the Company.

After authentication in the Application, the system will automatically record information concerning the User’s session, namely:

• IP address, type of device used for access, date and time the account was accessed, date and time the claim notification was completed, and date and time of any changes made to the data in the “My Profile” section, as applicable.

The Application provides a messaging service through which the claims inspector and the User may communicate and provide various information that may prove necessary for managing and authorising the claim file. In this context, we have access to information concerning:

• the content of these conversations, the date and time of the conversations, conversation history, and documents transmitted.
• incomplete claim notifications – if the User does not complete the notification process, the information, data and documents uploaded by the User to the Application will not be transmitted to the Insurer and will not be stored after the Application session ends. Throughout the Application session, the data entered in the notification form will remain stored so that the User can return to step 1.
• to use the Application and fulfil its stated purpose, the User must allow the Application to access the camera or photo gallery, the storage space on the User’s device and the User’s location. These permissions may be withdrawn at any time through the permission settings of the device used. If permission is withdrawn, certain features will no longer be available, as these permissions are required in order to provide services through the Application.
• push notifications concerning messages in the Application – once the ability to send messages to the claims inspector has been enabled, the User will receive push notifications when a message from the inspector is received in the Application. To disable these notifications, the User may change the relevant option at any time in the settings of the device used.

Given that the personal data referred to at point 2 above is processed by the Company in its capacity as a processor, on the basis of instructions issued by the Insurers, please also read the data processing policy of the Insurer that issued the policy.

In addition to your personal data, we may collect personal data concerning representatives of the company whose employee or agent you are, natural persons together with whom you were involved in a Vehicle Incident, or their authorised representatives, as well as data from publicly available sources.

Under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation”), the Company is required to process the personal data provided by Users securely and solely for the specified purposes.

We collect and process your personal data for the following purposes:

• Creating and administering the User account – to allow access to the Application.
• Providing the online claim notification completion service – to create and administer the account in the Application.
• Electronic management of claim notifications – to prepare and manage the claim file.
• Ensuring the confidentiality and security of the Application – to implement appropriate security measures that enable user actions to be logged and security incidents to be prevented.
• Preparing statistical reports
  to allow us to evaluate our activity and improve the quality of the services we provide.

The legal basis for processing this data, as applicable, is:

• The insurance contract concluded between the Insured and the Insurer and the steps required to perform claims management obligations and the obligations ancillary thereto (Article 6(1)(b) of the General Data Protection Regulation);
• Making available to the user the feature that automatically completes information about the damaged vehicle – the controller’s legitimate interest – Article 6(1)(f) of the Regulation. The legitimate interest consists in providing users with features that reduce the time required to complete the claim notification and reduce situations in which data is completed incorrectly. The User may enter this information manually if they object to this processing; the legal obligation incumbent upon the controller of your personal data (Article 6(1)(c) of the General Data Protection Regulation);
• The legitimate interest of the Company or of the controller in improving the services offered to users, evaluating our activity and ensuring the security of the Application (Article 6(1)(f) of the General Data Protection Regulation);

For data provided under point 1, the retention period differs depending on whether or not the account is used for the purpose for which it was created:

• If the email address is not verified, the data provided is automatically deleted from the database no later than one month after the date on which it was provided.
• If you have verified the email address but do not submit any claim notifications in the Application, the User account may be deleted six months after the date of the last activity in the account.
• If you have submitted claim notifications in the Application, they will cease to be accessible to Users within two years after the last notification was completed in the Application.

The personal data provided under point 2 may be retained from the time it is provided until the insurance ends, as well as for a period of 15 years from the time the insurance ends and, where necessary, for a longer period, namely until the final resolution of legal proceedings for the defence of rights in court, in accordance with the legal obligations incumbent upon the Insurers.

Your personal data provided for the purpose of creating the Account and submitting the claim notification will be retained for two years after the last activity in the Account. However, if a claim file has been opened, the information/data provided will be retained for a period of 15 years.

The personal data provided for use of the Application is strictly confidential and is processed and transmitted to our partners (for example: insurers, claims consultants and experts, IT and system administration service providers, subcontractors and advisers, and other persons directly involved in providing the service you require) solely for the purpose of fulfilling one of the purposes mentioned above. It is stored on an Amazon cloud server located in Europe and is not transferred outside the European Economic Area.

Where the injured party asks a partner repair shop to submit the claim notification on their behalf, the repair shop will have access to the data described at point 2.1 of this Policy and will act as an independent controller. The injured party is responsible for reviewing the repair shop’s privacy policy; the Company is in no way responsible for the manner in which the repair shop processes this data using its own means (telephones/tablets/other mobile devices).

If the injured party does not want the repair shop to have access to this data, they may create an account in their own name in the Application in order to submit the claim notification.

Use of the Application in any manner constitutes unconditional acceptance that this information will be included in the Company’s database and used and processed by the Company, its affiliates and their partners for the performance of the activities mentioned above.

We require our partners to safeguard the security of your personal data, to use it only for the purposes established by the controller and to handle it in accordance with the law. We process this data in accordance with the purposes, legal bases and methods established by the controller.

Your personal data may also be transmitted to the competent public authorities in order to comply with legal obligations or conduct any investigations in accordance with applicable legal provisions.

We inform you that, under the provisions of EU General Data Protection Regulation 679/2016, where we process your personal data, you have the following rights:

• right of access, under which you may ask us, free of charge, to confirm whether or not we process personal data concerning you. You may also ask us for a copy of the data we process about you and request other information about your personal data, such as what data we hold, what we use it for, to whom we disclose it, whether we transfer it abroad and how we protect it, how long we retain it, what rights you have, how you may lodge a complaint and where we obtained your data, insofar as this information has not already been provided to you through this notice. Requests must include relevant information that enables us to identify you in our database. We will resolve your request within a maximum of 30 days;
• right to rectification, which you may exercise
  • by accessing your User account in the Application and changing the data available in the “My Profile” section, with regard to the data referred to at point 1; or
  • by submitting a request asking us to amend the information we already hold about you. You may submit such a request when you find that your data is incomplete or inaccurate. We may seek to verify the accuracy of the data before rectifying it;
• right to erasure, under which we are required to erase the personal data we process about you. This right applies only where the data is no longer necessary for the purposes for which it was collected; or you have withdrawn your consent (where the processing was based on consent) and there is no other legal basis for the processing; or you exercise a legal right to object under Article 21(1) or (2) of the General Data Protection Regulation; or the data has been processed unlawfully; or we have a legal obligation to erase it. However, we are not required to comply with your request to erase your personal data where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. When submitting an erasure request, please bear in mind that erasing the data may be a complex process.
• right to restriction of processing, which you may exercise where you contest the accuracy of the data, consider the processing unlawful or object to the erasure of the data. After this right is exercised, we may continue to store the data, but other processing operations will be possible only with your consent, except in the cases expressly provided for by law;
• right to data portability, which you may exercise only where processing is based on your consent or on a contract and only if your data is processed by automated means. If you meet these conditions, you may submit a request to transfer the data to the data controller of your choice. Please note, however, that data inferred or derived from the data you provided cannot be the subject of such a request.
• right to object to processing, at any time, on grounds relating to your particular situation, to the processing of your personal data on the basis of our legitimate interest, if you believe that your fundamental rights and freedoms override that interest. You may also object at any time to the processing of your personal data for direct marketing purposes (including profiling), insofar as such processing takes place, without giving any specific reason, and we guarantee that your data will no longer be processed for this purpose. Please note, however, that a reasonable period of time (72 hours) may be required to register and resolve your request, during which you may still receive marketing communications from us.

Please note that the data referred to at point 2 is processed on the basis of the Insurers’ instructions; therefore, requests concerning those categories of data must be addressed to those Insurers.

You may contact the national authority responsible for resolving such requests at any time, namely the National Supervisory Authority for Personal Data Processing. The authority’s contact details are:

National Supervisory Authority for Personal Data Processing Address: 28-30 General Gheorghe Magheru Boulevard, District 1, postal code 010336, Bucharest, Romania; Telephone: +40.318.059.211 or +40.318.059.212; Email: anspdcp@dataprotection.ro

Without affecting your right to contact the supervisory authority at any time, we ask you to contact us beforehand, and we promise to make every effort necessary to resolve any issue amicably.

The User may request the exercise of any of the rights listed above by sending a written, signed and dated request to: mobileapps@alphasoftware.ro.

Refusal to provide the data required in order to provide the Services available in the Application makes it impossible for those services to be provided.

If the User changes personal data already provided in the Application while operations relating to the Services available in the Application are in progress (not completed), the data held when those operations were initiated will be retained for the performance of those operations.

The Company does not ask its Users, through any means of communication (telephone/email, etc.), for confidential information such as bank account details, personal passwords, etc. If the User discloses such information to third parties, the User bears full responsibility for their actions. Accordingly, where such data is disclosed, the Company cannot be held liable for any damage whatsoever.