Privacy Policy

Abbreviations:

GDPR is used in the text below as an abbreviation for the EU General Data Protection Regulation (Regulation (EU) 2016/679). DBL is used in the text below as an abbreviation for the Danish Data Protection Act.

The data controller responsible for the processing of your personal data is:

Auto Claim Handling Denmark A/S, Midtager 20, DK-2605 Brøndby ("ACHD") Please note that this Privacy Policy does not apply to Ayvens Denmark A/S, which provides vehicle financing, vehicle sales, and fleet management services. Services provided by this company and other companies within the Ayvens Group are subject to separate privacy policies.

Responsibility of Business Customers Where ACHD's customers, in their capacity as employers, have access to personal data relating to their employees, such as drivers, the customer acts as the data controller.

This Privacy Policy describes our processing of personal data in connection with claims handling.

We process information relating to vehicle owners and users, witnesses to incidents, passengers, and other third parties who may be involved in a claim.

We receive personal data from:

• •
  You
• •
  Your employer, where applicable, if the vehicle is leased through your employer
• •
  The vehicle
• •
  Repair shops and service centres
• •
  Insurance companies
• •
  Persons who have been involved in or witnessed an incident, such as an accident, and their representatives, including insurance companies and lawyers
• •
  Public authorities, such as the police, courts, or other local authorities
• •
  Our review of publicly available information
• •
  The Danish Central Business Register (CVR)

International databases used to identify management and ownership structures and to identify individuals subject to international sanctions

We need to collect personal data in order to carry out our claims handling activities. We verify the information on the basis of documents, data, or information obtained from reliable and independent sources, such as the Danish Central Business Register (CVR).

We process the following personal data for the purposes set out below:

• •
  Your name, contact details, and employer
• •
  Date of birth and copies of identification documents, such as a passport, driving licence, health insurance card, national ID card containing a unique identification number, and baptism, birth, or name certificates
• •
  Financial information
• •
  Other documentation, such as proof of source of funds, payslips, utility bills, etc.
• •
  Adverse media information
• •
  Status as a Politically Exposed Person (PEP), or as a close family member or close associate of a PEP
• •
  Sanctions imposed under international regulations
• •
  Where applicable, nationality and personal identification number (required by law for the payment of compensation)
• •
  Vehicle registration number, make and model, and Vehicle Identification Number (VIN)
• •
  Insurance information, third-party claims, police reports, witness statements, and any fines, fees, and charges imposed
• •
  Information relating to damage and incidents, such as offences or accidents, including the extent, location, timing, and costs involved; assistance provided; property damage and personal injury; other health-related information; photographs from incidents; the number and identity of passengers in the vehicle; information about third parties, including the identity of passengers and drivers in other vehicles; and the identity of witnesses.

In connection with the payment of compensation, ACHD processes personal data for anti-money laundering and counter-terrorism financing purposes, as Dutch anti-money laundering legislation applies across the Group by virtue of the parent company's banking licence in France.

French and European legislation require an identification procedure to be completed before ACHD can make any payment. These obligations include, among other things, the identification and verification of the recipient of the payment.

If we refuse to pay compensation, we record the name of the claimant, the reason for the refusal, and the documentation reviewed.

In addition, we process personal data where necessary for the following purposes:

• •
  Claims and Incident Management. We register and manage incidents in which you and/or the vehicle may be involved in order to: provide claims handling services, such as repairs and other follow-up actions, payment of compensation, and reporting to public authorities; and manage related financial claims relevant to insurance matters.
• •
  To Communicate with You. When you contact us, for example in relation to a claim or case.
• •
  To Pursue Other Legitimate Interests, including:

• 1.
  1.
  providing a high standard of service, for example by responding to your enquiries and enquiries from third parties;
• 2.
  2.
  fulfilling our claims handling agreements with Ayvens Denmark A/S;
• 3.
  3.
  protecting our rights, your rights, or the rights, data, security, business operations, or property of third parties, including the implementation of security measures;
• 4.
  4.
  complying with legal obligations or responding to requests and orders from public authorities; and
• 5.
  5.
  establishing, exercising, or defending legal claims, including the mitigation of potential losses.

We process personal data on the following legal bases:

• •

  Our public interest obligations, pursuant to Article 6(1)(e) of the GDPR, including:

• •

  compliance with French and European legislation relating to anti-money laundering, counter-terrorist financing, and sanctions.

• •

  Our legitimate interests, pursuant to Article 6(1)(f) of the GDPR, including:

• 1.
  1.
  providing a high standard of service, for example by responding to your enquiries and enquiries from third parties;
• 2.
  2.
  providing claims handling services;
• 3.
  3.
  assessing repair costs in accordance with our claims handling and deductible rules;
• 4.
  4.
  complying with legal obligations or responding to requests and orders from public authorities;
• 5.
  5.
  enforcing our terms, conditions, and policies; and
• 6.
  6.
  protecting our rights, your rights, or the rights, data, security, business operations, or property of third parties, including the implementation of security measures.

• •
  Processing is necessary for the establishment, exercise, or defence of legal claims, pursuant to Article 9(2)(f) of the GDPR.
• •
  We process personal identification numbers on the basis of Section 11(2)(1) of the Danish Data Protection Act (DBL), in conjunction with Section 11(1)(1)(a) of the Danish Anti-Money Laundering Act and the French and European legislation referred to above.

We may disclose or transfer personal data to the following recipients:

• •
  Where we process transactions that give rise to a suspicion of money laundering or terrorist financing, or where we are otherwise required to notify the Danish or French authorities, we will disclose the relevant information to those authorities.
• •
  Supervisory authorities and tax authorities.
• •
  The financing company, such as Ayvens Danmark A/S, acting both as a data controller and as a data processor on behalf of ACHD.
• •
  The owner or driver of the vehicle.
• •
  Our customers (your employer, where the matter relates to a business arrangement).
• •
  The customer's authorised (international) fleet manager.
• •
  Other third parties, such as repair shops, installers, roadside assistance providers, insurance companies, vehicle rental agencies, and similar service providers.
• •
  Suppliers, including companies that assist us in operating our business, such as providers of IT network maintenance, infrastructure services, security systems, and facility access control.
• •
  Recipients in special circumstances, such as the police, other public and governmental authorities, and supervisory authorities.

We retain your personal data for as long as necessary or permitted for the purposes described in this Privacy Policy and in accordance with applicable legislation.

The criteria used to determine our retention periods include:

• •
  The duration of the claims handling process.
• •
  Whether we are subject to a legal obligation to retain the information.
• •
  Whether retention is advisable in light of our legal position (for example, with regard to applicable limitation periods, litigation, or regulatory investigations).

We retain personal data in accordance with the provisions of the Danish Bookkeeping Act, under which accounting records must be retained for at least five years plus the current financial year.

Pursuant to French and European financial legislation, certain information must be retained for periods of 5, 10, and 30 years respectively, after which it is deleted.

For anti-money laundering and related purposes, personal data is retained for five years from the date of payment or the refusal of payment of compensation.

Our suppliers use data processors and sub-processors located in countries outside the European Economic Area (EEA). Some countries outside the EEA are recognised by the European Commission as providing an adequate level of data protection in accordance with EEA standards.

For transfers from the EEA to countries that the European Commission has not determined to provide an adequate level of protection, we transfer personal data on the basis of, for example, the European Commission’s Standard Contractual Clauses for transfers to third countries. You may obtain a copy of these by contacting ACHD.

We transfer personal data to Australia, China, India, Indonesia, Mexico, Suriname, Thailand, Türkiye, the United States, and Japan (adequate third country).

If you wish to exercise your rights as further described below, please use the contact details provided below to do so.

You have the following rights:

• •
  Right of Access: You have the right to obtain access to the personal data we process about you, including information about how such personal data is processed, its sources, and related information.
• •
  Right to Rectification: You have the right to have inaccurate personal data corrected.
• •
  Right to Erasure: Under certain circumstances, you have the right to have personal data erased before it would otherwise be deleted in accordance with our general deletion procedures.
• •
  Right to Restriction of Processing: Under certain circumstances, you have the right to obtain restriction of the processing of your personal data. Where you are entitled to such restriction, we may only process your personal data, other than for storage purposes, with your consent or for the establishment, exercise, or defence of legal claims, the protection of another natural or legal person, or for reasons of important public interest.
• •
  Right to Object: Under certain circumstances, you have the right to object to the processing of your personal data, including where our processing is based on our legitimate interests under Article 6(1)(f) of the GDPR or where the purpose of the processing is direct marketing. For example, if you no longer wish to receive communications from us regarding surveys, you may opt out using the unsubscribe options included in the communication or by contacting us via the rights request form or the general contact details provided below.

For further information about your rights, please refer to the guidance published by the Danish Data Protection Agency (Datatilsynet), which explains the rights of data subjects, at www.datatilsynet.dk.

You are welcome to contact the Ayvens Group Data Privacy Office at data_protection.denmark@ayvens.com to exercise your rights. In your request, we encourage you to be as specific as possible regarding the personal data to which your request relates. For your protection, we will only process requests concerning personal data associated with the specific email address provided in your request, and we may ask you to verify your identity before implementing your request. We will endeavour to respond to your request as quickly as reasonably practicable and, in any event, within the time limits required by law. Please note that we may need to retain certain information for record-keeping purposes and/or to complete transactions that were initiated before the request for amendment or deletion was made. There may also be residual information that remains within our databases and other records that cannot be removed.

If you exercise your rights, we will also process personal data in connection with receiving and responding to your request. If there is any doubt regarding your identity, we are entitled to request additional information necessary to verify your identity. We will process and record such additional information for this purpose.

If you wish to lodge a complaint about our processing of your personal data, you may submit a complaint to the Danish Data Protection Agency (Datatilsynet). Contact details are available at www.datatilsynet.dk.

As email communications are not always secure, you should not include your CPR number or other sensitive personal information in emails sent to us.

We reserve the right to amend or update this Privacy Policy. The date shown as "Last Updated" at the top of this document indicates when this Privacy Policy was most recently revised. Any changes to this Privacy Policy will become effective when we issue the revised Privacy Policy.