Introduction

In line with the Data Protection Act 2019, which came into force 11^th November 2019, all data processors and handlers are required to conform with the Act, our statement herein is an introduction of how we collect, handle, process and store any form of data that we come into contact with.

It is therefore, important that you read this Data Protection Statement and, if you are a principal member under any of our policy of insurance, we encourage you to share this statement with the beneficiaries of your policy and ensure that they have given you consent to act on their behalf.

This GA Privacy Statement relates to the collection, usage, disclosure and storage of your Personal Data throughout the GA Insurance processes and your data shall not be used for commercial purposes unless consent is obtained. By applying for insurance cover or any other services, you will be deemed to have given consent to handling and processing of your personal data.

The personal data we process in relation to you and/or your company is provided by you/your representative, third parties, collected through the GA website, publicly available sources or generated during your application for your insurance and/or processing of your insurance claim with us, and through any media and our authorized insurance agents and brokers.

When we collect and process your personal information, we ensure to keep it safe and to never sell it. We look after it properly and process it in accordance with our privacy principles set our below,

WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?

Personal information you provide is processed fairly, lawfully and a transparent manner.

Personal data that we may process, as appropriate throughout the insurance and claim process, but is not limited to:

• name and contact details (such as telephone number, e-mail address and postal address);
• date of birth;
• profession
• gender;
• marital status;
• spouse and children
• video, photographic images or audio recordings submitted or made as part of the insurance issuance and claim process.
• Bank accounts
• Medical reports and medical history.

We may also process sensitive or special personal data where relevant to the insurance and claim processes, including where necessary to accommodate any disability needs.

When exercising our rights and obligations under the insurance contracts, it may be necessary to process sensitive data categories. Such sensitive may include but not limited to;

• claim record;
• medical history
• previous claim experience available
• racial/ethnicity information;
• Country of origin
• Religion

HOW WE COLLECT YOUR PERSONAL DATA

The personal information we require about you (and, if applicable, other people insured under your insurance policy) will be gathered and stored as set out in this Data Protection statement.

Whilst there are several ways, we collect Personal Data we mainly obtain your information through the following means:

Approved Intermediaries

We may collect data directly or through our approved and authorized insurance intermediaries and those appointed or acting on your behalf.

Service providers

We collect your data through various service providers that include but not limited to;

1. Re-insurance companies, locally and internationally.
2. Our external advocates
3. Investigators
4. Assessors
5. Loss adjusters
6. Medical practitioners and medical institutions
7. Insurance investigators
8. Courier services
9. Travel insurance agents

All these service providers have been approved or empaneled by GA to provide the respective services.

Our marketing teams

If you are an insurance intermediary/consultant or business partner, we may also collect your information from our day-to-day business activities with you, business referrals and your attendance at events, categories being collected and processed are as per Data Protection Act 2019 laws of Kenya.

Our marketing team will collect documents from you and transmit the same to the company for processing of your insurance policy and claims where appropriate. This data will be used as per the intended purpose and in an event the data shall be used for commercial purpose, the same will be done in strict adherence of section 37 of the Data Protection Act 2019.

Your Personal Data may also be collected from third parties during claim processing such as references from previous insurer and government authorities/bodies.

PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA

If you are a customer, we mainly use your personal information so that we can provide a quote, set up, administer and manage your policy, including carrying out a risk survey, and to asses and pay claims as part of an insurance contract. However, there are several other reasons why we use your personal information as set out below;

• To consider whether to enter into an insurance relationship with you;
• To comply with any legal right or obligations to which we are subject to.
• To Processing of any claim in respect of an existing policy of insurance.
• Subrogation/Recovery

and includes but is not limited to the following:

• to process your insurance policy
• to determine whether you have an insurable interest in the subject matter.

If you are an intermediary/consultant or business partner, we mainly use your personal information for day-to-day business activities with you and to provide you with information relevant to our services in accordance with our marketing strategy, including a periodic newsletter, invitations to events and communication of new products.

TO WHOM WE MAY DISCLOSE YOUR PERSONAL DATA

GA operates a branch network hence any authorized persons working in our network may come into contact with your data.

Your Personal Data may be disclosed to any of the following for any of the purposes outlined above:

• professional advisers, third party service providers, agents or independent contractors providing services to the GA Insurance;
• to our reinsurance
• any person in connection with litigation or other legal proceedings, to obtain legal advice or for establishing, exercising or defending legal rights;
• any person to whom disclosure is allowed or required by Law and/or Regulation;
• any court, tribunal, Regulatory Authority or Governmental Entity;
• any criminal records bureau, credit bureau or credit reference agency when conducting background checks;
• to third parties to provide references at your request or with your consent; and
• third parties to whom we may transfer our rights and/or obligations under any agreement, including but not limited to a potential merger or acquisition of all or part of the Group’s business.
• Subrogation

In some circumstances, we may provide your personal data to a third party who will determine how and why it will be processed.

HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

Personal Data is retained as long as necessary for the purpose for which it is collected and to meet legal, regulatory and operational requirements. Retention periods may differ for each insurance policy taken. At the end of the retention period, non-identifiable data is kept for management information purposes. GA has also put in place Data retention policy in line with Data Protection law.

GA Insurance may also retain your contact information for the purposes of inviting you to renew any of your insurance policy from time to time and may use your contact to send you notifications notifying you of our various products, renewal notice and claim updates.

HOW WE PROTECT YOUR PERSONAL DATA

The security of your Personal Data is important to us and GA Insurance Ltd implements technical and organizational measures to safeguard your personal data.

As a responsible organization, GA Insurance manages its insureds data and authorized personnel may access your Personal Data. Your Personal Data may therefore be transferred to insurance brokers, agents, Reinsurers, GA external advocates, other advisors or third-party service providers, and other third parties authorized to act on our behalf in a country that may not offer equivalent data protection or privacy laws to that of the country where you are located. When using external service providers, we require that they adhere to security standards mandated by GA Insurance Ltd and regardless of where personal data is transferred, we take all steps reasonably necessary to ensure that it is kept securely.

When transferring your data to European Union (“EU”) and your personal data is processed in a country outside of the EU, we will put in place contractual clauses approved by Data Protection Commissioner as provided for under the law and by the EU Commission as providing an adequate level of protection.

You should be aware that the Internet is not a secure form of communication and sending and receiving information over the Internet carries with it risks including the risk of access and interference by unauthorized third parties. We do not accept responsibility or liability for the confidentiality, security or integrity of your Personal Data in connection with its transmission over the Internet.

MINORS

GA insurance do not issue insurance policy to a minor any personal data belonging to a minor where a policy of insurance has been taken out by a parent or guardian on behalf of the minor, shall be processed/handled in accordance with section 33 of the Data Protection Act 2019.

YOUR RIGHT TO OBJECT TO OR RESTRICT THE PROCESSING OF YOUR PERSONAL DATA

In some circumstances you may have the right to object to how GA processing your Personal Data or restrict its processing but this does not mean you can decide or choose how we process your Personal Data.

Where is stated that we process your personal information on the basis of a legitimate interest, you are entitled to object to the processing in question on grounds relating to your particular situation, we will then stop processing the information unless we can demonstrate compelling legitimate grounds.

UPDATING YOUR POLICY DATA

GA Insurance will update your data from time to time as advised by you, you are obligated to ensure that GA insurance is always holding accurate and updated personal data.

UPDATES TO GA INSURANCE PRIVACY STATEMENT

The GA Privacy Statement may be updated from time to time and it is your responsibility to visit our websites and other communication platforms regularly for the most recent version.

ACCESSING, CORRECTING AND ERASURE OF YOUR PERSONAL DATA

You have the right to ask for your personal data to be deleted, for example when there is no longer a valid reason to possess it, to be given details about the personal information concerning you that we hold and why and how we use it.

If you wish to contact the Data Controller for the personal data subject to data processing, you may do so by mail to GA Data Protection Officer (DPO), email; data.privacy@gakenya.com.

If you wish to, correct or request deletion of your Personal Data or have questions regarding this Statement please email: data.privacy@gakenya.com.

You have a right to demand the erasure of your personal data, for example where the personal information we collected is no longer necessary for the original purpose or, where you withdraw your consent and where the legal ground for processing was consent. However, this need to be balanced against other factors, for example, according to the type of personal information we hold about you why we have collected it, there may be some legal and regulatory obligations which mean we cannot comply with your request.

We take reasonable steps to ensure that the personal information we hold about you is accurate and complete. However, if you do not believe this to be the case, contact us and ask us to update or amend it.

Right to Data Portability

In certain circumstances, you have a right to ask that we transfer any personal information that you have provided to us to another third party of your choice. Once transferred, the other party will be responsible for looking after your personal information.

RIGHT TO OBJECT DIRECT MARKETING

You can ask us to stop sending you marketing message at any time. However, it is not our practice to provide direct marketing to insurance policyholders.

You have the right not to be subjected to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

CONSENT

You understand that by using our site services and our products you agree to be bound by this statement of privacy. If you agree to this statement on behalf of an entity, you represent and warrant that you have the authority to bind that entity to our privacy statement, by using our products and/or accessing our site, if you do not accept it in entirety you must inform us immediately indicating what part of our privacy statement you are not agreeable to.

By providing your personal information or personal information of someone included in your policy to GA Insurance, you acknowledge that we may use it only in the ways set out in this Data Protection statement. 

Right to withdraw consent

For certain uses of your personal information, we may ask for your consent. Where we do this, you have the right to withdraw your consent to further use of your personal information. Withdrawal of consent would not invalidate any processing we carried out prior to your withdrawal of consent. Please note in some cases we may not be able to process your insurance if you withdraw your consent.

We do not generally rely on consent for processing personal information in relation to insurance contracts; we generally relay on other legal grounds, such as the basis that processing is necessary for the performance of a contract to which you are party.

Right to complain

If you have concerns in relation to the way GA processes your personal data, you can either contact our Data Protection Officer by writing or email under aforementioned contact data.

Obtaining a copy of the privacy Policy.

From time to time, we may need to make changes to this Data protection Statement, for example as a result of government regulations new technologies or other developments in data protection laws or privacy generally. We encourage you to review periodically to see the most update Data Protection Statement.

A copy of this statement is obtained by contacting our DPO via email data.privacy@gakenya.com. and also annexed to all our policy documents.