Data protection is an integral part of insurance operations. This page contains information on how Nordea Insurance Finland Ltd processes your personal data.
At Nordea Insurance Finland, we process individuals’ personal data for a number of reasons. When we write «you», we mean you as a customer, a potential customer, our customer’s employee or other relevant party, such as a beneficial owner, authorised representative and a key person of a company.
1. What personal data Nordea Insurance Finland Ltd collects
Personal data is in most cases collected directly from you or generated as part of the use of Nordea Insurance Finland's services and products. Sometimes additional information is required to keep information up to date or to verify the correctness of the information we receive.
The personal data we collect can be grouped into the following categories:
- Identification information: personal identity number and name. We are obliged to collect documentation of this type of information in the form of copies of your passport, driving licence or the like.
- Contact information: phone numbers and addresses, including postal address – in the case of a foreign address, also the home country.
- Profile information: number of underage children, information on next-of-kin and information related to profession and employment relationship.
- Financial information: type of agreement, transaction data, credit history and insurance history.
- Information related to legal requirements and taxation: tax rate, country of taxation or foreign tax payer reference, information related to customer due diligence and anti-money laundering requirements.
- Information on special categories of personal data: health information is collected for granting temporary disability, serious illness, permanent disability and in claims cases. Moreover, information related to your unemployment fund is needed for unemployment insurance and for us to know whether you are a member of a trade union. The Finnish data protection act allows insurance companies to process health data, as it is essential for assessing the risks of the insured and for processing claims. Nordea Life Assurance Finland requests health data that is relevant upon concluding an insurance contract from the insured and, with a power of attorney provided by the insured, from physicians, hospitals, maternity clinics, occupational health care units, mental health services, social welfare units, other insurance companies and pension institutions. Nordea Life Assurance Finland may disclose health data to Nordea Insurance with the consent of the insured.
Personal data we may collect from you:
Nordea Insurance Finland collects information you provide directly to us. For example, we collect personal data on new customers, such as their name, personal identification number, e-mail address, phone number and income and credit information to be able to provide them with the product or service in question. We also collect information which you provide us with in our digital channels, such as messages (feedback, requests etc) you have sent us. Phone calls and chat conversations with you may also be recorded and stored for verification of orders, documentation, and for quality control and development purposes. For security purposes, we may have cameras in our branches and at ATMs.
Personal data that we may collect from third parties:
- Publicly available and other external sources; register held by governmental agencies (such as population registers and registers held by tax authorities, company registration offices, enforcement authorities, etc), sanction lists (held by international organisations such as the EU and UN as well as national organisations such as the Office of Foreign Assets Control (OFAC)), registers held by credit-rating agencies and other commercial information providers providing information on eg beneficial owners and politically exposed persons.
- Health information from health care units (in connection with personal insurance policies).
- From other entities in the Nordea Group or other entities which we collaborate with.
2. How Nordea Insurance Finland Ltd may use your personal data and the lawful basis for doing so
We use your personal data to comply with legal and contractual obligations as well as to provide you with offers, advice and services.
Entering into and administration of service and product agreements (implementation of an agreement)
The main purpose of our processing of personal data is to collect, process and authenticate personal data prior to giving an offer and entering into an agreement with you as well as documenting, administering and completing tasks subject to an agreement.
Examples of the implementation of an agreement:
- Insurance policy issuing or payment of insurance claims
- Customer service during the agreement period
- Possible establishment, exercise or defence of legal claims and collection procedure
Fulfilment of requirements and obligations laid down in the law, regulations or decisions by public authorities and supervisory authorities (legal obligation)
In addition to the implementation of an agreement, compliance with our obligations defined in the law, regulations and authoritative decisions require processing of personal data.
Examples of legal obligations requiring personal data processing:
- Know Your Customer (KYC) requirements
- Preventing, investigating and uncovering money laundering, terrorist financing, and fraud
- Sanctions screening
- Bookkeeping regulations
- Reporting to the tax authorities, the police as well as the enforcement and supervisory authorities
- Risk management obligations, such as credit and insurance risks and capital adequacy requirements
- Other obligations related to service or product specific legislations, for example securities, funds and insurance legislation.
Marketing, product and customer analyses (legitimate interest)
Personal data are also processed in connection with marketing, product and customer analyses. Marketing measures, and the development of processes, business and systems are based on the processing of personal data. In this way, we can improve our products and services offered to customers.
Nordea Insurance Finland Ltd has a legitimate interest in using profiling for customer analyses made for marketing purposes, for example.
We herewith ask for your consent to Nordea Insurance Finland Ltd and Nordea Life Assurance Finland Ltd disclosing to one another information on special categories of personal data needed for attending to a claim or customer relationship, such as health information.
Giving your consent is entirely voluntary and you may withdraw your consent if you wish. If you withdraw your consent to the disclosure of your health information, you must terminate your insurance policy.
3. Automated decision-making and profiling
We may utilise automated decision-making in some cases. Automated decision-making is permitted in legislation governing insurance companies. Automated decision-making means that a decision concerning you may be made fully based on automated data processing without human involvement. Automated decision-making is based on the information provided by the customer.
We may use automated decision-making when making decisions on whether to insure the customer. As a result of automated decision-making, an insurance policy may be granted or an insurance case may be forwarded to manual further processing.
By using automated decision-making, we aim to expedite the handling of your case and to make sure that, for example, insurance decisions are fair. For instance, you may receive confirmation that your insurance has become valid right after you have submitted your application. If you are dissatisfied with an automated decision you have received, you can ask for the case to be reprocessed by a natural person on behalf of the data controller. You have the right to state your position, receive an account of the decision made and dispute the decision.
Buying and changing an insurance policy
We utilise automated decision-making when making decisions on whether to grant insurance.
Such decisions are based on the information provided by you as well as our insurance guidelines, which comply with the applicable legislation, insurance terms and conditions and good insurance practice.
We utilise automated decision-making when making decisions on whether to grant insurance when you fill out a health declaration when applying for insurance, buying insurance through our digital channels or providing information on the state of health of the insured.
Termination of an insurance policy
An insurance policy can be terminated automatically due to invoices being left unpaid.
We may also use profiling when processing personal data. Profiling means the automatic processing of personal data whereby these data are used to assess certain characteristics of a person. Profiling is used when insurance policies are purchased.
4. Who Nordea Insurance Finland Ltd may disclose or transfer your personal data to
We may disclose/transfer your personal data to other parties, such as the authorities, Nordea Group companies, suppliers, payment service providers and business partners. Before disclosing or transferring your data we will always ensure that we respect the relevant financial industry secrecy obligations, such as insurance secrecy.
We send information on insurance indemnities subject to tax to the Finnish Tax Administration. At times we may also disclose data to, for instance, the enforcement authorities upon request.
Customer due diligence data and other personal data may also be disclosed to the police for raising an official investigation into money laundering or terrorist financing. In addition, the same data may be disclosed to the National Bureau of Investigation for raising an official investigation into such crimes with which property or a criminal benefit related to money laundering or terrorist financing has been obtained.
Nordea Group companies
Nordea Insurance Finland Ltd may share information with Nordea Life Assurance Finland Ltd. Based on your consent, we may also share information belonging to special categories of personal data, such as health information. Conversely, information not belonging to special categories of personal data may be shared with Nordea Bank Abp.
Nordea Bank Abp acts as an agent for Nordea Insurance Finland Ltd handling customer-facing communication, such as selling and partly managing insurance policies. Therefore Nordea Bank Abp, Nordea Insurance Finland Ltd and Nordea Life Assurance Finland Ltd, which owns Nordea Insurance Finland Ltd, have customer data systems in common. This means that Nordea Bank Abp, Nordea Insurance Finland Ltd and Nordea Life Assurance Finland Ltd act as a controller together.
Nordea Insurance Finland collaborates with partners in order to offer products and services to customers. Our partners have been chosen carefully and we have contracts that include the processing of personal data in place with selected suppliers.
The customer authorises Nordea Insurance Finland to request health data from health care units for issuing the insurance policy and processing insurance claims.
Transfers of personal data to third countries
The personal data of Nordea Insurance Finland Ltd’s customers may be processed outside the European Economic Area. In these cases, the standard contractual clauses (EU model clauses) approved by the European Commission are used. You can obtain a copy of the EU standard contractual clauses used for data transfers by Nordea at www.eur-lex.europa.eu by searching with the keyword 32010D0087.
5. How Nordea Insurance Finland Ltd protects your personal data
Keeping your personal data safe and secure is at the centre of how we do business. We use appropriate technical, organisational and administrative security measures to protect any information we hold from loss, misuse and unauthorised access, disclosure, alteration and destruction.
6. Your privacy rights
You as a data subject have rights in respect of personal data Nordea Insurance Finland holds on you. You have the following rights:
a) Right to request access to your personal data. You have a right to access the personal data we are holding on you. In many cases, this information is already present to you in your online services from us. Your right to access may, however, be restricted by legislation, protection of other persons’ privacy and consideration for the Nordea Group’s business concept and business practices.
b) Right to request rectification of inaccurate personal data. If your personal data are incorrect or incomplete, you are entitled to have the data rectified, with the restrictions that follow from legislation.
c) Right to request erasure. You have the right to request erasure of your personal data in the following cases:
- you withdraw your consent to the processing and there is no other legitimate reason for processing,
- you object to the processing and there is no justified reason for continuing the processing,
- you object to processing for direct marketing,
- processing is unlawful or
- when processing personal data on minors, if the data were collected in connection with the provision of information society services.
Due to the financial sector legislation we are in many cases obliged to retain personal data on you during your customer relationship, and even after that, e.g. to comply with a statutory obligation or where processing is carried out to manage legal claims.
d) Right to restriction of processing of personal data. If you contest the correctness of the data which we have registered on you or the lawfulness of the processing, or if you have objected to the processing of the data in accordance with your right to object, you may request us to restrict the processing of these data to storage only. The processing will only be restricted to storage until the correctness of the data can be established, or it can be checked whether our legitimate interests override your interests.
e) Right to object to data processing based on our legitimate interest. You can always object to the processing of personal data about you for direct marketing and profiling in connection to such marketing.
f) Right to data portability. You have a right to receive personal data that you have provided to us in a machine-readable format. This right applies to personal data processed only by automated means and on the basis of consent or of implementation of an agreement. Where secure and technically feasible, we can also transmit the data to another controller.
Your request to exercise your rights as listed above will be assessed given the circumstances in the individual case. Please note that we may also retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.
Nordea Bank Abp and Nordea Insurance Finland Ltd collect, process and analyse data regarding the use of our webpages. Network traffic data are data connected to visitors on the website and data processed in communication networks for sending, distributing or making messages available.
You can adjust your web browser settings to accept or reject cookies. If you choose to reject cookies, you may still use our websites and some services; however, your access to some functionalities and areas of our website or services may be restricted substantially.
For more information about cookies, please visit nordea.fi/en (link at the bottom of the page).
8. How long Nordea Insurance Finland Ltd stores your personal data
We store your data as long as necessary for the implementation of an agreement and as required by the storage provisions laid down in the applicable laws and regulations. If we store your data for other purposes than the implementation of an agreement, such as for anti-money laundering, bookkeeping and capital adequacy requirements, we store the data only if necessary and/or mandated by the law and regulations for the respective purpose.
- Bookkeeping regulations: up to ten years.
- Details of the implementation of an agreement: up to ten years after the end of the customer relationship to defend against legal claims, if any
- Preventing money laundering and terrorist financing: minimum five years after termination of the business connection or the performance of the individual transaction.
- Rejected insurance applications: three years.
- Insurance offers: nine months after an offer has been made.
10. Contacting us or the data protection authority
You can also lodge a complaint or contact the data protection authority in any of the countries where we provide services or products for you.