Privacy Policy

At AXA Luxembourg, we are fully committed to respecting your privacy and protecting your personal data. This notice explains how AXA Luxembourg, as an entity of the AXA Group, collects, uses and safeguards your personal data when you are a prospective customer, policyholder, insured person or insurance beneficiary. It also informs you of your data protection rights, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (GDPR).

This notice may change over time. The date of its most recent update is indicated at the beginning of the document.

Data Controller

The data controller is the AXA Group entity in Luxembourg with which the prospective customer has taken steps to obtain an insurance proposal or with which the policyholder has taken out an insurance policy.

As data controller, each AXA Group entity determines the purposes and means of processing your personal data and is your main point of contact for any questions relating to the processing of your data.

Depending on the type of policy taken out, the data controller is one of the following companies:

• AXA Assurances Luxembourg S.A., Luxembourg Trade and Companies Register (R.C.S.) number B 84514, registered office at 1 place de l’Étoile, L-1479 Luxembourg (AXA IARD)
• AXA AssurancesVie Luxembourg S.A., Luxembourg Trade and Companies Register (R.C.S.) number B 53467, registered office at 1 place de l’Étoile, L-1479 Luxembourg (AXA VIE)

Categories of Personal Data Processed by AXA Luxembourg

The individuals whose personal data is processed by AXA Luxembourg include:

• Individual customers;
• Any other individuals involved in processing relating to a transaction, whether as representatives, partners, suppliers, directors, employees, third parties involved, legal representatives or any other guarantor or contact person, as well as users of the AXA Luxembourg website.

Personal data means any information relating to an identified or identifiable individual. An identifiable individual is someone who can be identified directly or indirectly. Different pieces of information which, when combined, could lead to the identification of a particular individual also constitute personal data. Anonymised or aggregated information that does not (or no longer) allow a particular individual to be identified is not considered personal data.

This includes, in particular:

• Identification data, such as surname, first name, home address, email address and telephone number…
• Data relating to family and marital status, household composition and legal protection arrangements…
• Data relating to policy administration
• Data relating to economic, asset and financial circumstances
• Data relating to employment circumstances
• Data required to assess risk, such as property characteristics and claims history…
• Health data, medical reports, invoices…
• Data relating to personal characteristics such as age, gender, lifestyle, consumption and leisure habits…
• Judicial data, information from the Public Prosecutor’s Office relating to claims, offences…

The personal data collected and processed by AXA Luxembourg is provided by the policyholder, insured person, insurance beneficiary or any third party, either for the purpose of taking out and/or performing an insurance policy, or in connection with the handling of a claim. It may also be collected via AXA Luxembourg’s websites.

AXA Luxembourg only collects and processes data that is relevant and strictly necessary for entering into a policy, achieving the purpose pursued by that policy or subsequently handling a claim.

Purposes of Processing and Legal Bases

The processing of personal data includes any action involving that data, such as its collection, recording, use, disclosure, modification, archiving or deletion.

The main legal basis and purpose of this processing are related to the implementation and performance of the insurance policy, in accordance with the Law of 27 July 1997 on insurance contracts and the Law of 7 December 2015 on the insurance sector.

The following table sets out the purposes for which your personal data is processed and the corresponding legal basis under the GDPR.

Purposes relating to the conclusion and performance of the insurance policy

For the purposes listed above, AXA Luxembourg does not make decisions that are based solely on automated processing; human intervention is always involved.

Data Retention Periods

Personal data is retained only:

• For as long as necessary to achieve the purposes: that is, throughout the performance of your insurance policy or until the claim has been finally resolved;
• After the policy or claim has ended, for the applicable statutory limitation and retention periods. The retention period generally ranges from 5 to 30 years, depending on the type of product taken out.
• Prospective customers (where no policy is taken out): Your data is retained for a maximum of 3 years from the date it was collected or from your last contact with us.
• Motor insurance: Data relating to the policy and material-damage claims is retained for 5 years from the end of the policy or settlement of the claim. In the event of a claim involving bodily injury, this period is extended to 10 years or more, depending on the applicable limitation periods.
• Health insurance: Data relating to healthcare reimbursements is retained for 5 years after the end of the policy. If you apply for a policy using a medical questionnaire but no policy is ultimately taken out, your health data is retained for 5 years.
• Life insurance: Due to the long-term nature of these products and the time that may be needed to locate beneficiaries, data is retained throughout the life of the policy and for up to 30 years after the insured person’s death or the end of the policy.

Disclosure of Personal Data to Third Parties

AXA Luxembourg may disclose your personal data to its service providers, suppliers and intermediaries in connection with the management of insurance policies.

AXA Luxembourg shares personal data with its agency network and processors in compliance with professional secrecy requirements under Article 300 of the Law of 7 December 2015 on the insurance sector and the requirements for processing personal data on behalf of a controller under Article 28 of the GDPR.

In its capacity as insurer, AXA Luxembourg may, in certain circumstances, disclose some personal data to other insurers, reinsurers, insurance or reinsurance brokers and other intermediaries and agents, lawyers, experts and technical advisers, repairers, medical advisers, auditors, IT service providers, business partners, and government and mediation authorities located in the Grand Duchy of Luxembourg or abroad.

Your data may also be disclosed to administrative, social security, tax and judicial authorities.

Transfers Outside the European Union

Personal data may be transferred to a country outside the European Union in the following permitted cases, and subject to the strict limits and conditions laid down by Luxembourg law governing insurance secrecy:

• the transfer is made to a country that ensures an adequate level of protection, as recognised by the European Commission or assessed as such by a competent authority;
• the transfer is governed by the standard contractual clauses adopted by the European Commission;
• the transfer is made to an AXA Group entity that has signed binding corporate rules (Our commitments | AXA) guaranteeing an adequate level of protection;
• the transfer is permitted under one of the exceptions set out in Article 49 of the European data protection regulation (in particular, where the individual has given explicit consent, where the transfer is necessary for the performance of insurance contracts, to protect human life, or to establish, exercise or defend legal claims).

Only data relevant to the purpose of the transfer may be transferred. To ensure that personal data is processed lawfully, AXA Luxembourg undertakes, before any transfer or upon request by the individuals concerned, to provide complete information about the purpose of the transfer, the nature of the data and the country or countries receiving it.

Use of Data Processors

In order to continually improve the quality of its services, AXA Luxembourg may outsource certain services to third parties, in accordance with the principles described above and subject to the conditions and limits set out in the law on the insurance sector (Article 300 of the Law of 7 December 2015 on the insurance sector).

To ensure a high level of service quality and provide clients with access to the most advanced technologies, AXA Luxembourg may use service providers or processors, including cloud computing services, which comply with Circular LC 21/15 of the Commissariat aux Assurances and provide encrypted data storage within the European Union under AXA Luxembourg’s control (such as Microsoft Azure, Microsoft 365 and Amazon Web Services…). In all cases, the data disclosed is protected in accordance with high security standards.

Some processors are also certified as PSFs (Professionals of the Financial Sector) by the CSSF (Commission de Surveillance du Secteur Financier) or as PSAs (Professionals of the Insurance Sector) by the CAA (Commissariat aux Assurances).

The Company may outsource the following services and processing operations to external or intra-group providers:

^* Please note that, as a rule, AXA Luxembourg does not transfer personal data outside the European Union. However, such a transfer may take place in the event of a claim arising in a third country, even if that country is not covered by an adequacy decision, provided that the transfer is occasional and necessary for the performance of the insurance policy taken out by the policyholder.

Processing of Data for Online Quotes on axa.lu

When you use our online quote simulator, the data you enter is processed in real time only, in order to assess your needs and calculate the premium corresponding to your situation.

As our website is hosted directly on our own secure infrastructure in Luxembourg, we do everything possible to ensure optimal control over the technical security of this process.

No information entered during the simulation (such as your risk characteristics or coverage choices) is stored or retained on our servers after your session ends.

If, after receiving your quote, you explicitly ask to be contacted by one of our insurance agents, you consent to the processing of your information for that purpose only. In this limited context, only the contact details required to put you in touch with the relevant agent (such as your name, telephone number or email address) are recorded and sent to that agent. No other information from your quote simulation is transferred or archived. Your contact details will never be shared with third parties and, in accordance with the GDPR, you have the right to request the permanent deletion of this information by our company.

Rights of Data Subjects

Under the GDPR, you have the following rights:

Right of access

Every data subject has the right to access the data held by AXA Luxembourg concerning them. Before granting access, the data controller will always verify the identity of the person making the access request, regardless of who they are.

The data controller will provide the requested data within one month of receiving the request.

The right of access is generally free of charge for the data subject, unless it represents an excessive burden for the Companies, in which case a fee may be charged.

Right to withdraw consent

Any data subject whose personal data is being processed may withdraw their consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

Right to rectification

Anyone whose personal data has been collected as part of processing may, as soon as possible, request that incomplete data be completed or inaccurate data be corrected.

Right to erasure

Data subjects may also ask the data controller to erase their personal data without undue delay where:

• The data is no longer necessary for the processing purpose;
• The data subject withdraws their consent and there is no other legal basis for the processing;
• The data subject objects to the processing;
• Erasure is necessary to comply with a legal obligation.

Right to object to or restrict processing

Any data subject whose personal data is being processed may ask for the processing of their data to be restricted where:

• The data subject contests the accuracy of the data concerning them and requests that processing be suspended while the data controller verifies its accuracy;
• The data subject does not want their data to be erased but wants its use to be restricted;
• The data is outdated but is required by the data subject to establish, exercise or defend legal claims.

Right to data portability

Data subjects have the right to receive the personal data concerning them that they have provided to AXA Luxembourg in a structured, commonly used and machine-readable format. They also have the right to transmit that data to another data controller without AXA Luxembourg obstructing the transfer. This right may be exercised where processing is automated and based on consent.

Requests should be sent to dpo@axa.lu.

AXA Luxembourg reserves the right to refuse to respond to a request that is manifestly unfounded or excessive (for example, a repetitive request). If it refuses, AXA Luxembourg undertakes to explain the reasons for the refusal and the available options for appealing to the competent authority.

To help us process your request as quickly as possible, please provide the following information:

• Your customer number
• Your surname
• Your first name
• Your email address
• Your telephone number
• The subject of your request
• A description of your request
• A document proving your identity (passport, identity card…)

Remedies and Complaints

AXA Luxembourg is committed to protecting your data on a day-to-day basis. If you disagree with us, we invite you to contact our Data Protection Officer (DPO) using the contact details provided above. If you are not satisfied with our response, you may lodge a complaint with the National Commission for Data Protection (CNPD) at 15, Boulevard du Jazz, L-4370 Belvaux, or directly online using its official complaint form.