Luko deeply care about your personal data and your privacy. As a broker and an insurer, Luko may collect and process different type of personal data for which a good level of compliance and security is applied.
- We don’t sell your personal data : Luko is independant and don’t share your personal data to any third party without your consent. Also, Luko is vigilant to apply the minimization principle and collect only the strict necessary.
- We provide a high level of security : Luko is highly involved in implementing strong technical and organizational measures in order to provide a high level of security for its customer.
- We care about your privacy : During the creation of new product and features, Luko’s pay attention to implement Privacy-by-design and integrate GDPR principles from the beginning.
What is the GDPR and the key notion ?
- Personal data : any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly.
Eg : name, phone number, age, email address, IP address, job title… - Data processing : any operation or set of operations which is performed on personal data or on sets of personal data.
Eg : collection, storage, modification, extraction, erasure… - Data Controller : the entity who determines the means and the purposes of the processing.
Eg : Luko decides to collect your payment method for invoicing. - Data Processor or sub-processor : the entity that act on the behalf of the Data Controller.
Eg : AWS is the entity that store the personal data.
Who is the point of contact (Data Protection Officer) ?
The Data Protection Officer (DPO) is the internal point of contact for any issue related to the GDPR. He will be able to answer any question, to request the exercice of your rights.
You can reach out directly to him :
By email at the address: dpo@luko.eu.
By postal mail: Luko - 91 rue du Faubourg Saint Honoré 75008 PARIS
Who is the data Controller ?
The Data Controller is “Luko” who determines the purposes and the means of the data processing. Due to its insurance activity and depending on the product, Luko has several entity :
- Luko Insurance AG :
c/o WeWork
Neue Schönhauser Str. 3-5
10178 Berlin, Allemagne
Amtsgericht Charlottenburg (Berlin): HRB 188013 B
Soumis à la BaFin, Dreizehnmorgenweg 13-15, 53175 Bonn, Allemagne - Allianz Direct Versicherungs-AG/Succursale France :
Allianz Direct Versicherungs-AG/Succursale France is a Société de droit étranger with a capital of €819,200, registered with the trade and companies register of Bobigny under number 953 811 338. Operating under the brand Luko, Allianz Direct Versicherungs-AG/Succursale France is an insurance distributor.
What data are collected and processed ?
- Identification data : Name, Surname, gender, Date and place of birth
- Contact details : phone number, email address
- Professional data : socio-professional category
- Housing data : postal address, flat surface, type of housing, status of occupation
- Payment data : encrypted credit card number, IBAN
- Claim data : contract, pictures and video, the content the claim and any data needed to analyse the claim
- Internet data : logs, IP address, Geolocation points
- Health data related to your Mortgage : height, weight, total or partial work stoppage, total or partial work stoppage for the last 10 years, holder of a pension, annuity or allowance for incapacity for work, covered at 100% for medical reasons by a social security organization, under medical treatment of more than 21 days in the 5 last years, hospitalization in the last 10 years, condition or disease requiring medical supervision in the last 10 years, accident resulting in after-effects, a disorder of the spine or any other musculoskeletal disorder in the last 10 years, a neuropsychic affection or any other psychic and psychiatric affection in the last 10 years, positive result to test on hepatitis B and C viruses or on the human immunodeficiency virus (HIV),
- Loan data : Bank providing the loan, type of loan, total amount, rate, first deadline, co-borrower
- Lifestyle informations : smoker or not, practice of extreme sport, work position, high risk work, recent travel to a high risk country, politically exposed
What are the aim of the Processings and on what legal basis?
In order to provide its insurance services Luko may process data to put at your disposal different product and services. According to the GDPR, each processing relies on one of these 4 legal basis :
- Consent : Under the GDPR, consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Ex : If you would like to subscribe to Luko’s newsletter. - Performance of a contract and pre-contractual obligations : Luko may process your data in order to provide its insurance services and products, as well as to comply with pre-contractual obligations such as providing a quote adapted to your needs for your housing insurance.
Ex : When you are requesting a quote, Luko will send it to you via email. - Legal or regulatory obligations : Luko may process your personal data to comply with its legal or regulatory obligations, such as combatting money laundering, terrorist financing, and insurance fraud.
Ex : As a broker and insurer, Luko has the duty to fight against terrorism and verify your identity. - Legitimate interest of Luko while preserving your right to privacy : In order to offer you a high level of service and quality, Luko may process personal data while preserving your fundamental rights, such as you right to privacy.
Ex : Luko can keep the personal data you provided, if you would like to finish your quote another time.
General to all Luko’s insurance product (PNO, MRH, MRI, NVEI, Mortgage)
Providing a quote adapted to your needs for your housing insurance
Purpose
In order to provide a quote adapted to your needs, Luko may collect the following data to perform the highest level of service. Following the duty to provide the most appropriated price, Luko will lead continuously a review, acceptance, control and monitoring of risk.
Categories of personal data
- Identification data
- Contact details
- Data related to your housing
Legal basis
Execution of pre-contractual information
Retention period
3 years from the last proof of interest from you.
Management of your insurance contract
Purpose
During the lifetime of your insurance contract, Luko will process your personal data to execute its obligation and provide a good level of services, as defined in your General Condition. In application of your contract, your personal data will be processed to manage your claim.
Categories of personal data
- Identification data
- Contact details
- Professional data
- Housing data
- Payment data
Legal basis
Execution of the insurance contract
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Phone call to finalize your quote
Purpose
If you have consented, Luko can call you back in order to details the different offers to which you can be interested in.
Categories of personal data
- Identification data
- Contact details
- Contractual data
Legal basis
Consent
Retention period
- Duration of the contract and 5 years after its termination (article 2224 Civil code)
- Phone call will be stored for 2 years (Insurance code)
Management of your claim
Purpose
In application of your insurance contract with Luko you may have to report a claim in order to allow Luko to assess your claim and seek compensation. Then, these the data you provided will be analysed by the claim manager for the purpose of assessing your eligibility to be compensated.
During the analysis of your claim, you might have to provide further proof and any contextual element that could be helpful for the processing of your case. In this case you may use our in-house service video consultation called “Docteur House”.
Categories of personal data
- Identification
- Contact data
- Claim data
- Location data
- Internet data
Legal basis
Execution of the insurance contract
Retention period
- 2 years to contest the amount of your compensation
- 5 years for any kind of legal action undertaken against Luko
Send you tips and offer about Luko’s product, improve the quality of services
Purpose
During your onboarding and your lifetime at Luko you may receive tips and news offer about Luko’s product and partner’s offer that are similar to the one who have subscribed to.
Categories of personal data
- Identification data
- Contact details
- Type of insurance contract
Legal basis
- Consent of the prospect
- Legitimate interest of Luko to suggest similar product
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Management of the unpaid invoices
Purpose
Following your obligation set in your insurance contract, you have to pay the amount of money defined in the particular condition in order to benefit from the insurance cover from Luko. If you're not able to pay and you are liable to do so, Luko may engage a procedure to recover the missing funds.
Categories of personal data
- Identification data
- Contact details
- Payment data
Legal basis
Legitimate interest of Luko to recover the unpaid invoices
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
For the management and execution of the assistance contract (with Opteven, your assistant)
Purpose
Categories of personal data
- Identification data
- Contact details
- Professional data
- Housing data
- Payment data
Legal basis
Execution of the insurance contract
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Fight against fraud :
Purpose
Luko put all the measures at its disposal to analyze and detect act that can show an anomaly or inconsistency, management of this anomaly and inconsistency, constitution of liste of person suspected to have committed act of fraud.
Categories of personal data
- Identification data
- Internet data
- Contractual data
Legal basis
Legitimate interest of Luko to prevent fraud and miscellaneous behaviors on its Platform.
Retention period
Duration of the contract and 2 years after its termination.
Elaboration of statistics and actuarial studies :
Purpose
Insurance companies have to provide evidence on the appropriateness of the level of their technical reserves, as well as the the applicability and appropriateness of the methods and the appropriateness of the underlying statistical data the underlying statistical data they use.
Categories of personal data
- Housing data
- Contractual data
Legal basis
- Legitimate interest of Luko to comply with its own legal obligation and provide appropriate risk assessment
Retention period
Duration of the contract, after its termination the data are anonymised.
You have subscribed to Mortgage
Providing a quote adapted to your needs for Mortgage
Purpose
In order to provide an adapted quote for your subscription to Mortgage, Luko as a broker has the duty to analyse your personal situation to have a better understanding of your risk.
If the loan is above 200.000,00 €, in compliance with the new legal framework, Luko can ask your further information on your health status, as required by our insurance partner.Categories of personal data
- Identification data
- Contact details
- Professional data
- Housing data
- Payment data
- Health data related to your Mortgage
- Loan data
- Lifestyle informations
Legal basis
Contractual and pre-contractual obligations
Retention period
If the contract is not signed : 120 days from the creation of the Quote
If the contract is signed : 5 years from its termination
Interaction with Luko
Participating to marketing campaign and lottery
Purpose
During its promotional campaign, on social media and other support, Luko may process your personal data if you decide to participate to the market campaign and lottery.
Categories of personal data
- Identification data
- Contact details
- Picture, if relevant
Legal basis
- Legitimate interest of Luko to promote its product
- Execution of the lottery rules
Retention period
Duration of the contract and 5 years after its termination (article 2224 Civil code)
Creation of your personal account
Purpose
You can freely download the MyLuko application in order to benefit from the different services offered on the application.
Categories of personal data
- Identification data
- Contact details
- Internet data
Legal basis
Legitimate interest of Luko to provide a high level of services and enhance the app services
Retention period
3 years after the last connection of the user.
Measuring the satisfaction of our members
Purpose
In a quality approach, Luko is dedicated to provide the best services and willing to hear from its user. Thus, you can leave a comment and/or a grade about your satisfaction and your experience with Luko.
Categories of personal data
- Identification data
Legal basis
Consent
Retention period
the duration of your consent; You can withdraw your consent at any time and request the deletion of your personal data.
For audience measurement (analytics) and the smooth running of our Platform
Purpose
Luko will process your personal data to analyse your behaviour on the Platform and propose you the best services adapted to you special needs.
Categories of personal data
- Identification data
- Behavioural data
Legal basis
Legitimate interest of Luko to analyse the use of the Platform and application in order to promote user-oriented features
Retention period
24 months from the collection of the data
Handling request under GDPR and consumer code
Purpose
Under the GDPR you can ask your rights to be granted. You can easily do such by filling a dedicated form and contacting the DPO at dpo@luko.eu.
Categories of personal data
- Identification data
- Contact details
- Contractual data
Legal basis
Execution of the chapter 3 of the GDPR.
Retention period
5 years after the reception of the request.
How did we obtain your data ?
- Directly : via our website and the MyLuko application.
- Indirectly : through a partner or an aggregator.
Who are the recipient ?
Internal
The main recipient are internal recipient and the data are exchanged internally within the different Luko’s entity.
External
In the management of its activities Luko has outsourced some services :
- Level 1 Customer support : for minor question and low risk issue, the request are processed by an external (Sitel)
- Insurer : Wakam, Mila, SADA, MunichRe, Luko Insurance AG, MNCAP
- For the treatment of your civil liability and bodily damage : Stelliant
- Commissaire de Justice : in charge of the unpaid invoices
Principal service providers
- Amazon Web Services : to store your data and provide access to the App.
- Intercom : to process all your requests received by the Customer Support.
- Stripe : to process the payment of your contract.
- Braze and Mailjet : to send the essential communication related to your contract or any other kind of communication.
What is the retention period ?
Luko's Data Life Cycle for an Insured
1. Onboarding: Account creation and administration: processing and collection of data for the life of the account until it is closed.
2. Use of Services: data is collected and processed to ensure the performance of the Services and retained, at a minimum, for the duration of the use of the Services.
3. Off-boarding: Closing the Luko account: archiving in an intermediate database until the limitation period in terms of the fight against fraud and/or money laundering (5 years from the closing of the account) has expired.
4. Final data purge: Luko's internal purge mechanism for deletion from all databases. Archived data is only accessible by the legal, compliance and IT departments for the purpose of investigating fraudulent use of the Services.
How Luko preserve the security of your data ?
Technical measures
- Pseudonymisation of your personal data in the database in order to prevent the potential damageful impact of a data breach
- Robust password policy at the moment of the Luko’s account creation
- Systematic encryption of data on the hosting servers at the time of data transit (between the application and the servers) and during storage
- Implementation of a team dedicated to incident management, monitoring of security controls and ongoing verification of the effectiveness of security measures
- User access to the Platform monitored and protected by a system for detecting and preventing brute-force attacks, access from multiple IP addresses and multiple access from a single IP address.
Organizational measures
- Physical protection of the premises and control at the entrance
- Logging and traceability of connections
- Policy of management of the authorizations of each personnel who can have access to the data
- Authentication procedures for people accessing data with personal and secure access via confidential identifiers and passwords.
What are your rights ?
You can request the exercise of your rights, at any time, by reaching out to the DPO. But first, in order to process well you request, you have to specify the scope of your request and justify your identity by providing a unique number like your contract number.
- 1
Right to access
You can request at any time the access of your data and obtain them in a format easy to read.
- 2
Right to rectification
You can request the modification of some of your personal data if your status evolve throughout time. For example, if you move out and your home address changes you can notify the people to take into account this modification.
- 3
Right to deletion
You can request the deletion of your personal data in some circumstances, depending on the legal basis on which your data are being processed. As the majority of data are processed on the basis of the execution of your labour contract and/or legal and regulation obligations, Luko is under to archive and store these data for a longer period of time.
You can request the deletion of your data through this webform. - 4
Right to withdraw your consent
You have the right to withdraw their consent to the processing of their personal data at any time. Luko may rely on consent as a legal basis for processing personal data in some cases. If you wish to withdraw your consent, you can contact the Data Protection Officer (DPO) at dpo@luko.eu to make a request.
- 5
Right to portability
You can request you right to data portability, which allows you to obtain and reuse your personal data across different services. Please note that this right only applies to personal data that you have provided to Luko, and only in cases where Luko processes your personal data with your consent or as part of a contract.