La protection de vos données personnelles

Societe Generale Life Insurance Broker (hereinafter "SGLIB") is an insurance brokerage company (approved as a Luxembourg law brokerage institution by the CAA on the basis of the law of 7 December 2015 on the insurance sector as amended. SGLIB belongs to the Societe Generale Group.

SGLIB has always built strong and lasting relationships with its clients and partners based on mutual trust and mutual interest. The protection of privacy and the confidentiality of the information you give us are essential for us.

The purpose of this policy is to inform you in a transparent manner of the treatment that may be implemented throughout the banking relationship, with respect to clients, prospects, natural persons involved in a relationship with a client such as a representative, legal representative, surety, designated contact, an employee or beneficial owner and its partners ("you " or "your").

These data processing is carried out within the framework of and in accordance with the provisions of the European General Data Protection Regulation No 2016/679 of 27 April 2016 ("GDPR").

In particular, we wish to inform you about:

• Why are your personal data used (purposes) and what are the legal bases for processing?
• What categories of data are processed and where they come from;
• Who are the recipients of the data being processed;
• What are the retention periods;
• What are your rights?

Processing Manage

Your personal data are processed by Societe Generale Life Insurance Broker, Societe anonyme registered with the RCS of Luxembourg under the number B144695 and with its registered office at 11, Avenue Emile Reuter, L-2420 Luxembourg.

Tel: (+352) 26 27 330 | Fax: (+352) 26 27 33 09

The broker - in his capacity as processing manager - ensures that the necessary arrangements are made for compliance with the legal requirements concerning personal data.

Why are your personal data used (purposes) and what is their legal basis?

SGLIB collects and processes the data necessary to carry out its activities, in order to:

Execute your contractual and pre-contractual requests

The broker uses your data to offer life insurance and capitalization contracts, including: [Article 6, 1. (b) GDPR]

• Provide you with information about life insurance and capitalization contracts;
• Identify your needs in order to further customize the relationship and exercise your duty to advise in an increasingly relevant way;
• Manage your relationship with him;
• Assess if he can offer you a contract and under what conditions;
• Perform the operations necessary for the management of the contracts to which you have subscribed through the broker; 

Fulfill a legal obligation

The broker uses your data to fulfill various obligations, including: [GDPR Article 6, 1(c)]

• Respond to official requests from duly authorized public or judicial authorities;
• Combating money laundering and terrorist financing;
• Comply with applicable legislation on international financial sanctions and embargoes;
• Fight tax evasion and fulfill its obligations with respect to tax returns or controls;
• If the broker finds a criminal violation, report the violation to the competent authorities if necessary;
• Enforce the rules on the distribution of insurance, in which it must in particular: 
  • Establish security measures to prevent abuse and fraud;
  • Detect unusual transactions;
  • Enforce vigilance measures against certain categories of persons;
  • Declare certain transactions to the competent authorities. 

Pursue the legitimate interest of the broker: [Article 6, 1. (f) GDPR]

The broker processes your data to distribute life insurance/capitalization contracts, improve its risk management and defend its interests in court, including treatments such as: 

• Establish and retain evidence of operations;
• Ensure the physical and logical security of its information system;
• Prevent fraud and damage to property and persons.

All treatments are implemented taking into account your interests and fundamental rights. 

How does SGLIB determine life/capitalization insurance products that match your situation or profile?

The broker offers life/capitalization insurance products that may be suitable for you on the basis of: 

• Your country of residence;
• Classifications required by current regulations (AML, DAC, FATCA, IDD, ESG, etc.);

The broker uses the above treatments as a decision-making aid but does not implement any automated decision-making processes that have legal effects on the persons concerned. Human intervention is always provided for in the decision-making process.

What are the categories of data processed and where do they come from?

SGLIB may collect various data about you, including:

• Identification data: name, address, date of birth, nationality, identity documents, e-mail address, telephone number, number of dependent children;
• Personal Life Data: center of interest, matrimonial regime;
• Business Data: professional status, position title;
• Economic and financial information: transaction data, taxation and residence, account Number, amount of income, valuation of assets;
• Data from video surveillance.
• Data, ratings and ratios related to your investor profile and your preference for sustainability and other data necessary for sound management of the broker’s risks in accordance with the law.

This personal data may have been collected directly from you or generated during the underwriting process and during contractual relations or obtained from third parties (whether or not from publicly available sources): 

• Its co-brokers and business partners;
• Insurance companies from which you have entered into contracts through the broker;
• Third parties (e.g. public authorities or institutions, institutions operating professional databases, other financial institutions, fraud prevention bodies, or data providers), in accordance with the data protection regulations.

Who are the recipients of the data being processed?

SGLIB is bound by professional secrecy and cannot only share your personal data under strict conditions or with your consent.

Subject to the terms and conditions set out in Article 300 of the law of 7 December 2015 on the insurance sector concerning professional secrecy with regard to insurance, and depending on the purpose of the processing, your personal data may be communicated within the framework of their usual duties and within the limits of their duties to:

• Certain entities of the Societe Generale Group (e.g. consolidated risk management);
• Supervisory, financial, fiscal, administrative or judicial authorities, public bodies or public bodies on request and to the extent permitted by law;
• Certain regulated professionals such as lawyers, notaries or auditors;
• Its contractual partners: co-brokers, business dealers and insurance companies;
• Its subcontractors and providers only for the purposes of the services to be performed on its behalf, in particular the distribution of insurance products or consolidated risk management, particularly in relation to combating money laundering and terrorist financing.

Please find below an up-to-date table of subcontractors used by SGLIB:

The broker is also required to share your data when the solicitor-client privilege is waived by law, in particular with respect to tax administrations and supervisory authorities (CAA, CNPD, etc.) Secrecy shall not be held against the judicial authority acting in criminal proceedings, as well as in civil proceedings where a specific text expressly provides for it.

Specific transfers of certain personal data

Given the international dimension of SGLIB, in particular, certain treatments that may involve transfers of personal data to countries not members of the European Economic Area (EEA), whose laws on personal protection differ from those of the European Union. In this case, unless the country concerned has been officially recognized by the European Commission as guaranteeing an adequate level of protection of personal data, the broker will ensure that the transferred personal data is protected by appropriate standard contractual clauses or other guarantees mentioned by the GDPR.

In particular, your personal data may, within the limits permitted by the applicable regulations, be communicated to the official bodies and the authorized administrative and judicial authorities of countries not members of the European Economic Area (EEA).

The client, its legal representatives, respectively, confirm that they have informed the beneficial owners, the death beneficiaries named by name and any other third party concerned of the obligations of the broker described above, have obtained their mandate and consent to the transfer and processing of the data in question and that they will forward it to the broker on request.

What are the retention periods?

The personal data referred to in subsection four (4) shall be processed, depending on the situation, for different purposes or purposes. For each of these purposes there is a category of data, a period of retention of the data beyond which it is no longer used, archived, anonymized and/or deleted.

The length of time your data is kept varies and depends on the nature of the data, the purposes for which the retention periods imposed by the applicable legal and regulatory provisions are added.

The broker keeps your data for the longest period of time required by the applicable regulations. Time limits may also be extended in the case of legal proceedings. In this case, the data are kept until the end of the legal proceedings and then archived according to the applicable statutory limitation periods. Where a personal data is collected for more than one purpose or several legal and regulatory provisions are applicable cumulatively, it shall be kept until the longest period of storage or archiving has expired. Different conservation periods apply, in particular as regards:

• Customer data, the majority of information is retained for the duration of the contractual relationship for ten years after the termination of the contractual relationship;

• Data collected for pre-contractual purposes, without an effective conclusion of a contract: when you have contacted the broker for a product or service request or a simulation and your request has not been followed by a subscription, the broker will keep your data so that you can re-issue a simulation or keep a record of the advice they have been asked to provide. Such data shall be kept for a period of five years or more, if required by the competent authorities, for the purposes of combating money laundering and terrorist financing and combating fraud from the time of collection. 

What are your rights?

You have the following rights, within the limits and conditions imposed by law:

• The right to information: In the hope that this policy will answer your questions, you can contact the Data Protection Officer (DPO) of the broker for further information.

• The right to access your data. You can access your data by contacting the broker's DPO. Please note, however, that the broker processing a large amount of data and in accordance with the law, you may be asked to specify, before any data is provided, which data or processing operations your request relates to. 

• The right to correct your data when it is incorrect or obsolete.

• The right to withdraw your consent if you have given your consent for the processing of your personal data; it should be noted that such a withdrawal does not have retroactive effect and will not prevent the broker from pursuing lawful treatment, including those required by law. 

• The right to file a complaint with the National Data Protection Commission (CNPD, Complaints Service, 15 Boulevard du Jazz L-4370 Belvaux, www.cnpd.public.lu) when you consider that the processing of your data is not in accordance with the law. 

In some cases and according to the conditions laid down by law (in which case the broker will check beforehand that these conditions are fulfilled), you also have the following rights: 

• The right to request the erasure of your data.
• The right to request the limitation of the processing of your data.
• The right to object to the processing of your data for prospecting purposes or for any other legitimate reason (except lawful and compelling reason for the broker to continue processing).
• The right to portability of the data you have provided to the broker, to the extent technically possible. 

If you have any questions about the processing of your personal data by SGLIB, and if you have any questions about the exercise of your rights, you can contact our DPO by e-mail at lux.dpooffice@socgen.com or by mail to Societe Generale Luxembourg, DPO, B.P. 1271, L-1012 Luxembourg. 
For all your requests, please attach a copy of your ID so that we can identify you. This policy may evolve to best protect your personal data. The latest version is available on the broker's website.

Our Commitments

Data protection within SGLIB applies to all Personal Data processed by it under the conditions set out in the Personal Data Protection Policy below. Data subjects are:

• Clients who are natural persons, the representatives and beneficial owners of legal entities, contact persons, prospects;
• Employees of SGLIB (staff), external service providers, Volontaires Internationaux en Entreprise [French program for interns to work in French companies abroad], apprentices, interns or candidates.

Personal Data Protection Policy (PDF, 180.04 KB)

Our Responsibilities

As part of its business, SGLIB acts as Data Controller for personal data which is entrusted to it, within the meaning of the GDPR. The Data Controller ensures that the necessary steps are taken to comply with legal requirements for the protection of Personal Data.

In some cases, SGLIB is itself sub-contracted by clients who entrust their Personal Data to it. In this setting, SGLIB agrees to comply with all the requirements of Article 28 of the GDPR.

Contact Information:

Societe Generale Life Insurance Broker, a public limited company under Luxembourg law
Ms. Anne Hélène Kieffer, Managing Director (CEO)
Societe Generale Life Insurance Broker
11 Avenue Emile Reuter
L-2420 Luxembourg
Tel.: +352 26 27 330
Fax: +352 26 27 33 09
Luxembourg Business Register No. B 144695

Our Data Protection Officer

For SGLIB,  Jean-Denis Brangier is appointed as Data Protection Officer based on Article 37 of the GDPR.

Contact Information:

Jean-Denis Brangier, Data Protection Officer
Societe Generale Luxembourg
11 Avenue Emile Reuter
L-2420 Luxembourg
Mail : lux.dpooffice@socgen.com

Employees and external service providers, subcontractors

Training specific to the processing of personal data is provided to all SGLIB employees.

Any person called upon to work for SGLIB, as an employee or as an external service provider, must comply with these Personal Data protection measures, as well as obligations related to the Luxembourg and European legal, banking, and financial framework.

Subcontractors who process personal data on behalf of SGLIB (within the meaning of Articles 4.8 and 28 of the GDPR) are also subject to compliance with personal data protection measures. They must comply in particular with the obligations of the Regulation, Article 28, which are notified to them by SGLIB. They must comply with a confidentiality clause and contractual security obligations.

Your Data

Your data consists of:

• Identification data: name, address, date of birth, nationality, identity documents, e-mail address, telephone number, number of dependent children;
• Professional data: professional status, position title;
• Economic and financial information: tax and residence, account number, income amount, tax brackets, wealth valuation;
• Sensitive data: guardianship, trusteeship, possible convictions, possible health data (loan insurance, employees, etc.);
• Electronic conversations and communications.

This Personal Data is collected:

• directly from the data subjects;
  • when searching for or providing information about proposed services, products or jobs, or;
  • when purchasing contracts or policies;
  • and during contractual relationships;
• generated by client, employee, partner or third party activities;
• from third parties and/or public sources where required by law.

SGLIB only collects and processes Personal Data strictly necessary for its business to provide high quality products and services tailored to the needs of its clients, and to manage human resources, partnerships and purchasing under the best conditions. 

As part of its business, SGLIB uses personal data to:

• effectively perform its duties such as managing contracts, human resources, and all products and services it offers and the prevention of fraud;
• comply with national and international legal and regulatory obligations, such as anti-money laundering provisions or preventing terrorism financing, and
• identify needs in order to further customise the relationship and exercise its duty to advise in a more relevant way.

These uses are based on:

• contractual relationships (employment contract, life insurance and capitalisation contract, etc).
• legal and regulatory texts or legitimate interests,
• or, for more specific uses, consent.

In addition, SGLIB shall only retain Personal Data for the duration necessary for such uses and/or in accordance with applicable legal requirements. 

Processing Your Personal Data

Clients, representatives and beneficial owners of clients who are legal entities, employees or third parties, you entrust personal data to SGLIB. This information is necessary to perform the operations and services concerning you, and is processed.

This processing corresponds to any operation or set of operations performed or not using automated processes and applied to personal data or a set of personal data such as collecting, recording, structuring, retaining, adapting or altering, etc. (within the meaning of GDPR Article 4-2).

Processing performed by SGLIB is intended in particular to: 

• manage the brokerage relationship of the life insurance or capitalisation contract;
• manage Human Resources;
• manage relationships with third parties;
• prevent fraud;
• comply with legal and regulatory obligations, including management of AML operational risk and the prevention of terrorism financing and determination of tax status;
• process disputes;
• the processing of Personal Data generated by serious misconduct or actions;
• commercial prospecting, setting up commercial events and advertising campaigns, and video surveillance.

SGLIB, in accordance with the GDPR requirements (Article 30-1), maintains a record of processing of Personal Data.

For all processing of Personal Data, SGLIB implements retention rules (retention period and ultimate fate) so that processed data is kept in production systems only as long as necessary. 

Your Rights

SGLIB ensures the exercise of data subjects’ rights in accordance with the GDPR. The client, the employee and the third party, and more generally any relevant natural person has, in accordance with Articles 13-22 of the GDPR, a right of information, access and rectification, erasure, restriction of Processing, as well as the right to portability of his/her Personal Data.

Any data subject may object at any time, for reasons related to his/her particular situation, to his/her Personal Data being Processed.

The exercise of some of these rights may result, on a case by case basis, in SGLIB being unable to provide the product or service. In addition, some of these rights may not be exercised if this were to lead to the destruction or modification of information for which there is otherwise a legal or contractual reporting or retention obligation.

No payment is required to provide information to data subjects and to make any communication and take any action in the exercise of the rights of data subjects.
Nevertheless, in accordance with Article 12.5 of the GDPR, in case of manifestly unfounded or excessive claims, including due to their repetitive nature, the data controller may either demand payment for reasonable costs or refuse to respond. 
Data subjects are informed in particular by this page of our website and by SGLIB of the processing of their Personal Data and the rights they may exercise. 

The Client may exercise these rights by contacting the SGLIB Personal Data Protection Officer by:

• contacting their regular banking adviser,

• sending a request by mail or email in the same manner as existing for claims as set forth in the General Information contained in the document entitled: « SGLIB Study ».

For enquiries regarding your data processing and rights, contact our DPO: lux.dpooffice@socgen.com

Any data subject may also lodge a complaint with the National Commission on Data Protection (CNPD), the supervisory authority in charge of compliance with the Personal Data obligations, at the postal address: 1, Avenue du Rock’n Roll, L-4361 Esch-sur-Alzette or via their website www.cnpd.lu.

Protecting and securing your data

SGLIB’s core business is the security of its clients’ information. The confidentiality of personal data is ensured with the same strict level as the protection of its clients’ finances. In no event shall personal data be sold or transferred to third parties. The trust of our clients, employees and partners is the priority of SGLIB. Risk analyses are conducted and necessary measures are taken to eliminate or mitigate identified risks. Related responsibilities are assigned.

In addition, an incident response procedure, as well as quick and secure communication with the relevant person(s) and the supervisory authority, is implemented.

SGLIB also uses technical and organisational data processing systems that ensure the Personal Data are protected as soon as they are created.

Learn more about Personal Data communications to third parties and transfers of personal data to third countries or international organisations.

Communications

SGLIB provides information relating to the protection of Personal Data to data subjects:

• to Clients and third parties: especially via its external website

• to its Employees: especially via its intranet site.

Contact person for additional information about data protection

Jean-Denis Brangier
Data Protection Officer
lux.dpooffice@socgen.com