Your privacy is important to us.

Data Protection Statement

(formerly ‘Privacy Statement’)
of KBC Insurance NV
This Data Protection Statement comes into effect on 6 November 2023.

Preliminary: the salient changes in this version of the Data Protection Statement of
KBC Insurance NV

KBC would draw your attention to the most important changes in this Data Protection Statement of
KBC Insurance:
• Addition with regard to data processing operations in the context of flooding risks (see Part 1 introduction, 2.4 on the
range of products, 3.4 on data processing needed to offer digital solutions in real time)
• Addition with regard to the companies forming part of the KBC group (see 1.2)
• Addition with regard to how you can exercise your privacy rights at KBC (see 1.3, 2.1, 2.5)
• Clarification with regard to how you can exercise your privacy rights at KBC (see 2.9)
• Clarification with regard to the Kate Coin (see 3.3)
• Addition with regard to personalised advertising (see 3.6.1) and, in particular, with regard to the Kate Deals, the Kate
Coin and our partners (see 3.6.1.3, 3.7)
• Addition with regard to limited personalised commercial messages, based on a legitimate interest (see 3.6.3)
• Addition with regard to identification data (see 4.1)
• Addition with regard to processors (see 5.2.3)
• Addition with regard to processors outside the EEA (see 5.2.4)

 1 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

Table of contents

Part 1: to safeguard your privacy, we must work together....................................................................................... 4

1.1 Data Protection Statement applicable to the processing of personal data collected by
KBC Insurance NV through an agent, a branch, KBC Live or the KBC apps or from other sources.............................. 4
1.2 KBC Insurance and the other members of the KBC group take care in how they handle your
personal data............................................................................................................................................................................................... 4
1.3 Contact KBC Insurance if you have any questions about the processing of your data.................................................. 4

Part 2: your right to privacy............................................................................................................................................... 5

2.1 You can access your data.........................................................................................................................................................................5
2.2 You can have your data corrected........................................................................................................................................................5
2.3 You can have your data erased..............................................................................................................................................................5
2.4 You can object to your data being used for certain purposes...................................................................................................5
2.5 You don’t want KBC to process your personal data to send you direct marketing............................................................6
2.6 You can contest a decision taken by automated means.............................................................................................................6
2.7 You can ask for your data to be transferred to a third party.......................................................................................................6
2.8 You can ask to restrict the processing of your data........................................................................................................................6
2.9 How you can exercise your rights...........................................................................................................................................................6

Part 3: KBC Insurance has many reasons for processing your personal data....................................................7
3.1 KBC Insurance must comply with laws, legal requirements and public order.......................................................................7
3.2 KBC Insurance has to be able to judge whether it is feasible to contract an agreement or service...........................9
3.3 KBC Insurance has to be able to perform contracts correctly....................................................................................................9
3.4 KBC Insurance processes personal data based on a legitimate interest.............................................................................10
3.5 KBC will request your consent to process your personal data in certain cases................................................................. 13
3.6 KBC Insurance uses your personal data for direct marketing...................................................................................................14
3.6.1 Direct Marketing contract for personalised advertising..............................................................................................................14
3.6.1.1 Who is offering the personalised agreement?.....................................................................................................................14
3.6.1.2 What are KBC’s legal grounds for using your personal data?......................................................................................14
3.6.1.3 What type of data processing is needed in order to provide the requested services?...................................15
3.6.2 Personalised commercial messages, with your consent.............................................................................................................17
3.6.2.1 Commercial messages about financial products and services (occasionally referred to as
‘personalised information’)......................................................................................................................................................17
3.6.2.2 Commercial messages about non-financial products and services.......................................................................18
3.6.3 Limited personalised commercial messages, based on a legitimate interest....................................................................18
3.6.4 Marketing for platform users...................................................................................................................................................................18
3.6.5 Marketing based on your click and browsing behaviour.............................................................................................................18
3.6.6 Marketing for prospects...........................................................................................................................................................................19
3.6.7 What if you do not wish to receive personalised advertising (or less of such advertising)?..........................................19
3.7 KBC will not sell your personal data.................................................................................................................................................... 19

Part 4: KBC Insurance processes different types of data....................................................................................... 19

4.1 Identification, details linked to a service and personal particulars........................................................................................ 19
4.2 Data in the public domain and data obtained through third parties...................................................................................20
4.3 Health data..................................................................................................................................................................................................20
4.4 Your current location can be important............................................................................................................................................. 21
4.5 KBC Insurance remembers data from simulations, competition forms, etc......................................................................... 21
4.6 KBC may process what you tell KBC, a KBC Insurance agent or KBC Insurance agent staff...................................... 22
4.7 Monitoring KBC correspondence in written form........................................................................................................................... 22
4.8 Recording telephone, video and chat conversations................................................................................................................. 22
4.9 Temporary storage of security camera images............................................................................................................................. 23
4.10 More than just your own personal data may be involved.......................................................................................................... 23

 2 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

Part 5: on cooperation, confidentiality and security............................................................................................... 24

5.1 Not everyone at KBC can look at your data................................................................................................................................... 24
5.2 Locations where data is processed are limited............................................................................................................................. 24
5.2.1 Processors within the KBC group.........................................................................................................................................................24
5.2.2 Processors characteristic of the insurance sector........................................................................................................................25
5.2.3 Other processors........................................................................................................................................................................................25
5.2.4 Processors outside the EEA.................................................................................................................................................................... 26
5.4 Processing by other data controllers................................................................................................................................................. 26
5.4 KBC Insurance takes specific measures to protect your data..................................................................................................27
5.5 KBC does not keep your data for ever...............................................................................................................................................27
5.6 KBC thinks before it answers queries from outside parties........................................................................................................ 28
5.6.1 Compliance with confidentiality obligations..................................................................................................................................28
5.6.2 Requirement for Insurance Ombudsman to address KBC Complaints Management....................................................28
5.6.3 Third parties must contact the ‘Third-Party Enquiries’ department......................................................................................28
5.7 You can also help in protecting your data....................................................................................................................................... 28

 3 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

Part 1: to safeguard your privacy, we must work together

Your privacy is very important to us. Our aim is to process personal data in a manner that is lawful, fair and transparent.
In this data protection statement, we explain which of your personal data we collect from you as natural person and then
process.
Throughout this document, the data referred to is yours as policyholder, prospective policyholder, insured, payee, pro-
spect or other data subject, such as contact at a business, agent holding power of attorney, aggrieved party, victim,
other party, witness, expert, insurance intermediary, owner of immovable property in Belgium, etc. Regardless of the
capacity you act in, your rights remain unchanged and KBC Insurance will treat your data with equal care.

1.1 Data Protection Statement applicable to the processing of personal data collected by
KBC Insurance NV through an agent, a branch, KBC Live or the KBC apps or from other sources
We recommend that you read this information carefully, so that you know the purposes for which KBC Insurance NV uses
your data. This data protection statement also contains more information about your privacy rights and how you can
exercise them.
KBC Insurance NV (hereinafter referred to as ‘KBC Insurance’) may make amendments to this data protection statement.
The most recent version is always available at www.kbc.be/en/privacy. KBC Insurance will inform you of all substantive
changes to the terms of the Data Protection Statement via its website, KBC Touch, KBC Mobile or other communication
channels.
You will also find more information about Belgian data protection legislation on the Belgian Data Protection Authority’s
website at www.dataprotectionauthority.be.
We also recommend that you read the KBC Cookie Policy when you use one of KBC’s digital solutions, such as the KBC
website or a KBC application. It explains what cookies are, which ones KBC uses, how you change your cookie preferen-
ces and how KBC protects your privacy. The cookie policy can always be found in the digital solution itself, and for the
KBC website you can view the cookie policy at www.kbc.be.

1.2 KBC Insurance and the other members of the KBC group take care in how they handle your
personal data
KBC Insurance NV is an insurance company that operates mainly in Belgium. KBC Insurance NV has its registered office at
Professor Roger Van Overstraetenplein 2, 3000 Leuven. KBC Insurance also trades under the name CBC Assurances.
KBC Insurance is part of the KBC group (also ‘KBC’ in the following), which is an integrated bank-insurance group: a group
of companies that, through close cooperation, create and distribute banking, investment and insurance products and
provide related financial services.
The KBC group principally focuses on retail customers, SMEs and high net worth customers, and mainly operates in
Belgium, the Czech Republic, Slovakia, Hungary, Bulgaria and Ireland. In addition, the KBC group operates via compa-
nies and entities in a selection of EU and non-EU countries. Among others, the following companies belong to the KBC
group in Belgium: KBC Group NV, KBC Global Services NV, KBC Bank NV, CBC Banque SA, KBC Insurance NV, KBC Asset
Management NV, KBC Securities NV, KBC Autolease NV, ADD NV and KBC Lease Belgium NV. A few Belgian companies in
the KBC group, such as Groep VAB NV, 24+ and Omnia NV, do not use the letters KBC in their name.
More information on the activities of KBC Insurance and the KBC group is available at www.kbc.be and www.kbc.com.
KBC Insurance NV is the controller of personal data in the context contemplated in this Data Protection Statement.
In addition, KBC Insurance also processes personal data on behalf of other entities in the KBC group. Examples of this
include independent mutual insurance unions that utilise the KBC ICT infrastructure. In such cases, KBC Insurance proces-
ses your personal data as policyholder, insured person or payee of those firms. KBC Insurance also acts as processor for
another entity of the KBC group when it facilitates referrals to ADD NV where an insurance contract is requested that KBC
Insurance cannot or is unwilling to offer. In so doing, it follows instructions issued by that other KBC group entity.

1.3 Contact KBC Insurance if you have any questions about the processing of your data
If y ou have any questions about privacy or if you would like to change your privacy settings or exercise your rights, you
can contact KBC Insurance in any of the following ways:

 4 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

• You can pay a visit to your KBC insurance intermediary. In some cases, you may be asked to complete and sign certain
documents.
• You can consult, amend or prohibit the use of certain data yourself using KBC Touch and KBC Mobile.
• You can e-mail [email protected].

Part 2: your right to privacy

You have a lot of rights when KBC processes your data. When KBC asks your consent for processing, you can subse-
quently withdraw that consent again yourself whenever you see fit.

2.1 You can access your data

If you want to access the data concerning you that is processed by KBC Insurance, let us know. You can use the contact
details provided in 1.3. You can view some of the data directly yourself, for example using KBC Touch.
If you exercise your right of access, KBC will give you as complete a list as possible of your data. It can happen that some
personal data from the usual back-up files, logs and stored/archived records is not included in that list. Such data is not
within scope of the data processed on an ongoing basis and is therefore not immediately available. For that reason, it will
also not be communicated to you. However, it is removed from those files in accordance with standard data maintenance
procedures.
Health data is also excluded from the scope of the data processed on an ongoing basis and is therefore not imme-
diately available. You can specifically request it from KBC Insurance’s consulting physician at Professor Roger Van
Overstraetenplein 2, 3000 Leuven or by e-mail to [email protected].
In certain cases, anti-money laundering legislation prohibits KBC from giving you access to the personal data about you
that KBC processes. For example, KBC cannot give you access to an anti-money laundering investigation. The law pro-
hibits this because the release of such information could compromise the investigation. In such cases, you may request
further information by e-mailing [email protected].

2.2 You can have your data corrected

It can happen that certain information that KBC Insurance holds concerning you is not or no longer correct. You can ask
for the data to be rectified or completed at any time.

2.3 You can have your data erased

You can ask KBC Insurance to erase your personal data. If KBC no longer has an overriding ground for processing your
personal data, KBC will erase it. A legal requirement may prevent the erasure.

2.4 You can object to your data being used for certain purposes
If you disagree with how KBC Insurance invokes its legitimate interests to process certain data (see 3.4), you can object
to this. KBC will heed objections unless there are compelling reasons not to do so, such as when KBC Insurance processes
data with a view to combating fraud.
Below, you will find the main personal data processing operations based on the legitimate interest to which you can ob-
ject, and to whom they apply:

PERSONAL DATA PROCESSING OPERATIONS DATA SUBJECTS

Developing models for commercial purposes Customers, platform users
Testing for application development Customers, prospects, platform users
Direct marketing (see 2.5) Customers, platform users
Commercial profiling Customers
Range of products Customers, owners

If you do not specify the reasons for your objection, KBC will interpret your query broadly.

 5 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

2.5 You don’t want KBC to process your personal data to send you direct marketing
It is possible that you don’t want KBC to process your personal data at all in order to send you direct marketing. KBC re-
spects that. Upon request, you may exercise your right to object to direct marketing. Simply e-mail mypersonaldata@kbc.
be, drop in at your KBC branch or your KBC agency or contact our staff at KBC Live.
But even if you exercise your right to object to direct marketing, you might still get an advertising message on a digital
solution by KBC or through another channel. This may be a general advertising message, for which KBC does not process
customers’ personal data, or a personalised advertising message for which we only process your cookie data. If you don’t
want the latter, you can withdraw your consent to the collection of this cookie data and it being used for sending perso-
nalised commercial messages. You can find out how to do this in our cookie policy.

2.6 You can contest a decision taken by automated means

More and more data processing operations and processes are fully automated, both in our digital channels and in the
processes that facilitate the services provided by our intermediary. It goes without saying that the intermediary concer-
ned will check the final result wherever possible. This enables KBC Insurance, say, to respond to certain insurance queries
more quickly or to make a decision immediately, for example, whether a claim is covered. To make this possible, KBC
Insurance may process health data too (see also 4.3).
The automatically generated decisions, their underlying logic and their consequences are set out in the ‘Automated de-
cision-making’ Annex in this data protection statement, which is available at www.kbc.be/en/privacy. In the digital pro-
cesses in which the decision may be taken automatically, KBC will inform you about this on the screens, and before KBC
requests your personal data. KBC also provides a link to the ‘Automated decision-making’ Annex for the full explanation.   
If you are dissatisfied with the result of such a fully automated decision, you can contact KBC via KBC Live or a KBC
branch or your agent. You can, for example, ask a KBC expert to intervene or tell them why you disagree with the decision
and request to view the decision taken.
Automatically generated decisions are often based on an underlying customer profile. In certain cases, KBC calculates
these profiles for all customers in advance. You may exercise your right to object to this profiling (see Chapter 3.4 for more
information about customer profiles).  
In other cases, KBC will calculate this profile at the time it decides to enter into a contract or execute it. Because you are
then asking KBC for a decision, you cannot object to this profiling.

2.7 You can ask for your data to be transferred to a third party
You are entitled to ask KBC for personal data that you yourself have provided to KBC with your consent or in the process
of performing a contract to be transferred back to you or to a third party.
Legislation lays down a number of limitations to this right, as a result of which it does not apply to all data.

2.8 You can ask to restrict the processing of your data

In some cases, you may ask KBC to restrict processing of your personal data. Exercise of this right is conditional. You may
exercise your right to restrict processing:
• During the period needed by KBC to verify the accuracy of your personal data if you challenge the accuracy of personal
data concerning you that KBC processes
• Where processing is unlawful but you do not want the personal data erased
• When KBC no longer has a purpose for processing the personal data but you still need it in connection with a legal
claim
• Pending KBC’s reply as to whether KBC’s justifications outweigh yours, if you have exercised your right to object to a
processing for which KBC had invoked legitimate interest as legal ground

2.9 How you can exercise your rights

Always be as specific as possible when you wish to exercise your rights, so that KBC Insurance can handle your request
appropriately.
If you have a question or a comment, you can contact your insurance intermediary or send an e-mail to
[email protected]. This is your first resort for all enquiries regarding data protection.

 6 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

If you have a complaint concerning exercise of your rights, KBC Complaints Management will be happy to look into it. You
can contact KBC Complaints Management in any of the following ways:
• KBC Complaints Management, Brusselsesteenweg 100, 3000 Leuven, or via e-mail ([email protected]).
• Or use one of KBC’s electronic channels (e.g., the KBC website, KBC Mobile, KBC Touch).
You can also always contact the ‘Data Protection Officer’ at KBC Insurance NV by writing a letter to KBC Insurance, Group
Data Protection Unit (Group Compliance), Havenlaan 2, 1080 Brussels, or sending an e-mail to [email protected].

If you would like more information or if you do not agree with the standpoint adopted by KBC Insurance, be sure to visit
the website of the Belgian Data Protection Authority at www.dataprotectionauthority.be. You can also ask a question
and/or lodge a complaint there.
In some cases, you can also exercise your rights directly against third parties. That applies, for instance, to the databases
that the National Bank of Belgium (www.nbb.be) maintains in connection with the Central Point of Contact and the insu-
rance industry’s use of databases to combat insurance fraud (www.datassur.be for the RSR database and www.alfa-bel-
gium.be for the claims database). Always include a copy of your ID card with your request.

Part 3: KBC Insurance has many reasons for processing your personal data
These reasons have been grouped according to the applicable legal basis.

3.1 KBC Insurance must comply with laws, legal requirements and public order
The main legal grounds for KBC Insurance having to process certain information concerning you are summed up here.
• Legislation governing insurance contracts in general or special insurance arrangements in particular oblige insurance
companies to prepare contract documents and to keep them on record throughout certain statutory retention periods.
• The legislation on insurance distribution obliges insurance companies and intermediaries to analyse the desires and
needs of potential policyholders in the course of preparing signature of the contracts. It is sometimes necessary to
categorise customers in the course of doing so. Natural persons are automatically classified as non-business customers
though they may be regarded as being in the business category in certain circumstances. Where insurance companies
or insurance intermediaries give advice on savings-type and investment-type insurance, depending on the customer
category, they have to gather information about the customer’s knowledge and experience, financial capacity, invest-
ment objectives and attitude to risk/return in relation to the products offered.
• In certain cases, insurance companies are legally required to pass on insurance data to third parties for the accrual
of supplementary pensions, such as non-profit organisation asbl Sigedis vzw or the National Institute for Health and
Disability Insurance (NIHDI).
• Insurance companies are legally required to pass on information regarding claims involving flooding in the Flemish
Region to the CIW (Coordination Committee on Integrated Water Policy).
• Insurance companies must deploy all possible means to prevent and uncover instances of money laundering and report
them to the authorities. KBC Insurance and KBC group must therefore take the necessary steps for this, at both central
and local levels. For example, they have to gather data on customers and groups of customers or issue risk alerts.
Specifically, for certain life insurance contracts, KBC Insurance is required to:
• Identify you as a customer, representative or ultimate beneficial owner
• Verify your identity:
- For example, KBC Insurance has to be in possession of a recent copy of your ID card. KBC will therefore scan in your
digital ID card (e-ID) as a matter of course, for example if you register at a KBC self-service terminal with your e-ID
and PIN or if you use your e-ID to confirm changes to your address or contact details as held by KBC Insurance. KBC
Insurance is conscious to only store the information it downloads from your e-ID card that it is required to hold by
law (that is, the money laundering legislation, which includes the Act of 18 September 2017, the fourth Anti-Money
Laundering Directive and EU Directive 2015/849).
• Determine your profile (in relation to the risk of money laundering), which involves collating various personal and business
data, such as whether you’re a politically exposed person
• Check your actions and transactions, and prevent certain transactions and report them to the Belgian Financial
Intelligence Processing Unit.

 7 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

In doing so, KBC Insurance uses data given to it by yourself plus data that can come from other channels (such as
Thomson Reuters’ World-Check, Graydon, Dun & Bradstreet, Swift and Internet search engines).
KBC Insurance may also process your personal data within the scope of the decision to terminate a customer relationship
for anti-money laundering reasons.
• In the context of the part they play in fighting terrorism and their obligations under sanctions rules, insurance companies
are required to screen customer data against sanctions lists. Transactions are also monitored. In some cases, underlying
documents may be requested and payments may be held back. Here, too, KBC Insurance uses outside sources such as
Thomson Reuters’ World-Check.
• Insurance companies are also under duties to report to the authorities such as with transaction reports of investigations
into market forces and possible market abuse.
• Insurance companies are responsible for processing transactions through their accounting.
• KBC can use personal data for the purposes of checks, investigations and opinions in areas subject to Compliance con-
siderations (such as prevention of money laundering and fraud, investor and consumer protection and data protection).
• Insurance companies also have obligations in relation to identifying policyholders or the beneficial owners of life in-
surance products in the context of reviving dormant insurance products (Act of 24 July 2008 – see, for example, www.
slapendetegoeden.be to find out more).
• Insurance companies are responsible for appropriately controlling risks (including at group level). They are required
to detect, prevent, mitigate and address risks. Examples include credit, insurance, counterparty and market risk, risks
concerning information management and statutory compliance, the risk of staff, customer and/or supplier fraud, the
risk of unethical behaviour by staff or breaches by them of their duties of care. This risk management has to be ensured
at both central level (gathering data on customers and groups of customers) and local level (e.g., by disseminating risk
alerts). All manner of other types of risk profile are also determined in this context.
• Insurance companies must also be able to respond correctly when you exercise your rights under the data protection
legislation. KBC is also required to answer questions from the Data Protection Authority, for example, in the event of
complaints.
• Insurance companies must submit reports to and be able to answer questions from the regulators of financial instituti-
ons, such as the Financial Services and Markets Authority (FSMA) (www.fsma.be) and the National Bank of Belgium (www.
nbb.be) in the context of the supervisory legislation.
• Insurance companies are obliged to provide a summary of deceased customers’ assets to the authorities in relation to
the compliance with tax laws.
• Insurance companies have to respond to queries from the tax authorities or may need to voluntarily exchange infor-
mation for the purposes of tax law (the Income Tax Code, the Foreign Account Tax Compliance Act (FATCA) and the
Common Reporting Standard (CRS)).
• KBC Insurance may also process your personal data within the scope of the decision to terminate a customer relation-
ship for tax reasons.
• Insurance companies also have to respond to enquiries put to them by the courts administration (covering law enfor-
cement right from the police, the office of the public prosecutor, investigating judges and trial courts). These concern
questions in the context of police legislation and (criminal) judicial procedure (including the Criminal Procedure Code).
• KBC may, directly or indirectly, provide loans, credit facilities or secondary guarantees and insurance contracts to the
members of the Board of Directors and persons associated with them, to the members of the Executive Committee and
the persons associated with them, and to associated companies. This must be carried out in line with market conditions.
KBC has decided to register the identification details of these parties in the persons database so that these parties are
recognisable in the systems. In this way, KBC manages to comply with the relevant legislation.
• Insurance companies are required by law to share certain information relating to their customers with the Central Point
of Contact of the National Bank of Belgium, de Berlaimontlaan 14, 1000 Brussels (www.nbb.be). Consequently, KBC is
required to share information regarding its customers’ identities and their financial contracts, including information
relating to the conclusion and termination of financial contracts and the applicable dates, and regarding life insurance
contracts (classes 21, 23, 25 and 26).
• If any information registered with the Central Point of Contact is incorrect, you can ask KBC to have it corrected or
removed. The Central Point of Contact registers the information and keeps it for a period of ten years for tax investiga-
tion, verification and collection of certain receipts, investigation of criminal offences, to combat money laundering and
the funding of terrorist activities and major crimes, solvency investigation in the event of the collection of confiscated
amounts, data collection by intelligence and security services, bailiffs in the event of attachment, and notarial searches

 8 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

related to tax returns for estates. Access to the information held by the Central Point of Contact is regulated by law.
The National Bank of Belgium keeps a list of all requests to access information held by the Central Point of Contact for
a period of two calendar years. You will find all of the details regarding the Central Point of Contact for accounts and
financial contracts in the Act of 8 July 2018, and in Section 322, Subsection 3 of the 1992 Income Tax Code and its imple-
menting decrees.
• In order to comply with the European Directive on the protection of whistle-blowers, KBC processes reports in the EQS
Integrity Line (www.eqs.com). The application guarantees whistle-blowers’ confidentiality and anonymity (as an option)
during and after the investigation, and reports the result internally and to the relevant authorities.
• Pursuant to the compulsory third-party liability car insurance, Belgian insurance companies are required to share the
data of the insured vehicle (chassis number, registration number, make, model) and the identity of the policyholder with
the Belgian Motor Insurance Guarantee Fund (BGWF).

3.2 KBC Insurance has to be able to judge whether it is feasible to contract an agreement or service
Before KBC Insurance contracts, it may be necessary for certain information to be processed in order to deal with the
application and assess properly whether the agreement can be contracted and, if so, under what terms and conditions.
Examples in this regard include the collation and processing of data when contracting non-life insurance (such as pass-
enger car or home insurance) and when taking out life insurance (such as loan balance insurance or a class 23 invest-
ment-type insurance scheme). This data processing is frequently done based on a questionnaire.
To make a correct assessment, KBC Insurance may have occasion to pass certain personal data to relevant third parties
(such as co-insurers and re-insurance companies).

3.3 KBC Insurance has to be able to perform contracts correctly

As a customer of KBC Insurance, you use various services for which KBC Insurance has to carry out administrative and
accounting processes. Examples in relation to processing for the performance of insurance contracts include the ad-
ministration of insurance contacts, collecting payment of unpaid premiums, processing claims, assessing cover in relation
to claims based on investigations, whether involving loss adjusters or otherwise, contacts with other relevant parties (such
as other insurers, parties liable for causing damage, insured, beneficiaries, etc.), loss assessment, claims settlement, be-
nefits pay-outs, defending and determining the extent of the parties’ rights by way of court action, etc.
In the course of these actions, KBC Insurance may have occasion to pass certain personal data to third parties. These
include internal or external specialists for an assessment of bodily injuries or losses to which value can be attributed,
co-insurers and re-insurance companies, lawyers, relevant government agencies such as Fedris, repairers who can be
called upon to repair the damage suffered and network managers who are responsible for steering and/or managing
their network. As regards Cyber Insurance, there is also cooperation with third parties whereby those parties transfer
certain personal data to KBC Insurance in order to enable a correct performance of the contract. In the context of the
‘broad weather insurance’, personal data is also shared with data sharing platform ‘DjustConnect’, which is managed by
the Flanders Research Institute for Agriculture, Fisheries and Food (ILVO). This is the only way in which we can pass on your
policy details to watchITgrow, an application managed by the Flemish Institute for Technological Research (VITO) that we
use to submit claims.
KBC Insurance possesses a diversified distribution network, a relatively widespread distribution network of exclusive,
independent, tied KBC Insurance agents. Furthermore, as a customer of KBC Bank, KBC Brussels or CBC Banque, you
can also consult your familiar KBC, KBC Brussels or CBC branch for taking out standard insurance arrangements (such
as home, car and family insurance). KBC Insurance also works together with a number of insurance brokers. To ensure a
proper level of service, it is important to share data within that distribution network.
KBC Insurance has entered into partnerships with third parties, such as estate agents, who refer customers to KBC
Insurance who are interested in a specific insurance product. To allow KBC Insurance to calculate an indicative premium
for an insurance product, the relevant party shares certain information, such as the address details of the property con-
cerned, with KBC Insurance.
You can communicate with KBC Insurance through various channels, such as KBC Touch or KBC Mobile, the VAB assis-
tance helpline (claims involving car or home insurance), etc. In certain situations, KBC Insurance can use the contact and
security data of those communication channels for communication and verification purposes. Examples include login
credentials, passwords and certificates.

 9 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

In order to improve the user-friendliness of KBC Mobile or KBC Touch, KBC Insurance’s sales process redirects users ma-
king payment to the KBC Bank website, where they can select an account from the accounts view. Only those who have
appropriate authorisation may see this view. KBC Insurance has no access to the accounts displayed.

Ask Kate for help

Kate, the personal digital assistant, is a service within the KBC Mobile app.
The KBC Mobile Regulations specify what you can expect from Kate and how the assistant works. If Kate is unable to
assist you further, she can refer you to KBC Live.
• ‘Extra convenience’
If you accept the KBC Mobile Regulations, you opt for ‘Extra convenience’ (you can deactivate this feature at any
time in KBC Mobile), in which case KBC will provide you with the following services:
- Your advanced digital assistant Kate proactively offers personalised assistance and can send you messages about
products, services and applications offered by KBC if you use other KBC applications for which Kate has been activa-
ted. To allow assistance to be provided and hence to be able to anticipate your behaviour, wishes, risks and needs,
Kate analyses the current and past information KBC has on you – personal data or information regarding you in your
capacity as legal representative – and your family, such as transaction data, your use of the products, services and
applications offered by KBC as well as insights gained through market analysis, general customer behaviour analysis
and general analysis of the use of KBC products and services. Kate will apply these analyses to your specific individual
or family situation (profiling) in order then to be able to offer a personalised service.
- If you use ‘Additional services’ in KBC Mobile, KBC may use the data processed in that context to provide you with
‘extra convenience’ relating to those services as well. For example, KBC can proactively consult the data it shows you
when you go to the Sodexo service, so that Kate can let you know when you’re about to run out of Sodexo service
vouchers. An up-to-date list of eligible Additional services can be found here.
- You receive additional information in KBC Mobile or KBC Touch, such as the location where you performed a transac-
tion, the merchant’s brand name and logo, etc. to help you understand the context of the transaction as a holder of a
KBC Basic or Plus Account.
- You are presented with useful insights that may draw your attention to things that we assume you should take a look
at, such as unexpected behaviour on your current account or in your expenses, or an expectation that your account is
insufficiently funded.
- Kate Coins in ‘Extra convenience’: When you purchase certain KBC products or services, or carry out certain actions in
KBC Mobile, you earn Kate Coins. To correctly grant those Kate Coins, KBC must process your specific behaviour, or the
purchase of certain products or services that allow you to earn Kate Coins in this context.
- We also need to register and display Kate Coin transactions and the balance on KBC Mobile. We keep this information
until the expiry date of the Kate Coin concerned. To let you use the Kate Coins, we register the exchange of the Kate
Coins for a specific benefit, e.g., a webinar, or for a cashback on the purchase of a certain product.
You can deactivate ‘Extra convenience’ at any time without affecting the functioning of KBC Mobile. You will still be able
to ask Kate any questions you have.
KBC can also communicate with you separately from the Kate terms and conditions. In that case, personal data will only
be processed if KBC has another valid legal basis for doing so.
• Ask Kate a question
You can still ask Kate any questions, even if you’ve deactivated ‘Extra convenience’. You decide how to use the
service. You can ask Kate simple questions by speaking or typing them in the chat function about banking and
insurance matters and about other products, services and applications offered by KBC. To answer your questions,
Kate uses the necessary, limited personal data. If you don’t ask Kate anything, no personal data will be processed
for the digital assistant. Answering some questions might require a more comprehensive analysis of personal data.
This will only occur if you opt for ‘Extra convenience’.

3.4 KBC Insurance processes personal data based on a legitimate interest

In addition to the purposes set out above, KBC Insurance and the KBC group as commercial undertakings have certain
ulterior legitimate interests on the basis of which they process personal data. In that regard, KBC ensures that the impact
on your privacy is kept to a minimum and that, in all events, KBC’s legitimate interests remain proportionate to the impact
that upholding them has on your privacy. However, if you object to this data being processed, you can exercise your right

 10 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

to object. KBC will respect your objections, unless KBC has compelling reasons for not doing so.
There are various situations in which KBC processes personal data:
RISK MANAGEMENT, SECURITY AND MEASURES TO PREVENT FRAUD
Identification and prevention of major risks, such as the risk of fraud, cyber and credit risks, based on in-depth data
analysis
• KBC Insurance uses your personal data to conduct studies, create models and generate statistics for various purposes:
regulatory reporting, more effective internal control, fraud analysis and combating fraud, risk analysis, security and
other non-commercial purposes.
• KBC develops risk signals. Your behaviour influences the risk signals. If KBC detects from internal or external sources
that you are in arrears with the premium payment for a policy, that you are part of a collective debt repayment scheme,
that you gamble heavily, that you are involved in a fraud case or a money laundering case, that you are providing your
cooperation to terrorism, weapons or human trafficking, etc., this will be identified as a risk signal, which may have con-
siderable consequences. A result may be that KBC won’t grant you insurance or insurance compensation, or that a local
branch cannot decide on insurance or a claim, that a staff member must consult the Compliance department before
dealing with someone, that KBC doesn’t want to do business or decides to terminate the relationship.
• Data processing may be carried out in order to guarantee the safety, security and monitoring of persons and
• goods.
• Personal data, including biometric data, can be used for various purposes, including to detect and put a stop fraud and
cyber risks.
• KBC Insurance NV may also process your personal data within the scope of the decision to terminate a customer
relationship if there is a serious breach of trust, for example, in the case of identified actions that are inconsistent with
fraud-related regulations or ethical principles.

CLAIMS MANAGEMENT, POLICY MANAGEMENT AND PORTFOLIO MONITORING

• For its claims management, policy management and portfolio monitoring, KBC Insurance processes certain personal
data on criminal convictions and criminal offences or their related security measures.
• KBC Insurance does this within the scope of managing its own disputes and to defend the interests of its customers.

USE OF PERSONAL DATA FOR THE KBC ORGANISATION

Use of personal data for internal and regulatory reporting and internal control, and to defend rights and communicate as
a company
• KBC may utilise personal data for the administration, (risk) management and oversight of the KBC group’s organisation,
such as the legal department (including dispute management and legal risks), risk management (such as general
credit risk and insurance risk calculations vis-à-vis customers and groups of customers worldwide), risk functions (e.g.,
Compliance, for all duties not strictly required by law but that are in fact necessary or useful) and inspections, com-
plaints management and internal and external audit. We retain personal data for possible future evidential use. Storage
may be entrusted to outside third parties.
• KBC may utilise personal data to support and simplify the processes of customers beginning to use, using and ceasing
to use products and services, including avoiding resubmitting information you’ve already submitted. To avoid your
having to go through an entire ID verification process if you want to become a customer elsewhere in the KBC group.
Or to improve the quality of the data by adding, for example, marital status or nationality, even if these are not strictly
necessary for the performance of the contract. KBC Insurance can then pass your ID details to other companies in the
KBC group in order to speed up their identification processes.
• KBC may also utilise personal data for determining, exercising, defending and preserving the rights of KBC Insurance or
persons whom it might represent (e.g., in disputes).
• KBC can use your personal data to create synergy, increase efficiency and produce other benefits for its organisation
and processes. For instance, as part of network optimisation where KBC processes aggregate data from customers
together with publicly available data to optimise the integration of independent KBC insurance agencies.
• KBC can collate personal data held by KBC entities and use it in, or in support of, the implementation of worldwide
group-level centralised, coordinated, efficient management of customers and customer groups.
• KBC processes personal data for internal reports and reports required by the authorities, for risk management, for the
organisation of internal controls, but also to defend KBC’s rights and to communicate as a company.

 11 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

• KBC may also collate personal data that KBC entities have at their disposal for creating segments (such as Private
Individuals, Businesses and Private Banking).
• KBC keeps the contact details of journalists obtained directly or indirectly, so that KBC can contact them at the appro-
priate time, for example in case of news updates.
• KBC is an international organisation that works and communicates in Belgium’s national languages, English and various
other languages. Translations are essential in that regard. Many of the source texts and translated texts contain perso-
nal data. KBC Language Service deletes this data at the latest 90 days after the translation.
• KBC wants to offer its customers a personalised customer experience, irrespective of the channel the customer has se-
lected (branch, KBC Live, KBC Mobile, KBC Touch, Kate). Information you share with a staff member may be stored in the
customer relationship management system for retrieval at a later date or in another channel.
• Information regarding your investment profile may be exchanged between KBC group entities, as well as insurance
agents, for the provision of investment or insurance advice, so as to avoid you having to provide the same information
again in the context of an advisory meeting, depending on the delivery channel chosen, and to ensure uniformity and
consistency of the profile.

Linked to the provision of certain services

• While apps are being developed, tests need to be carried out using personal data, including the final acceptance test
before an app can be put into production. Where necessary, this may be done in conjunction with third parties appoin-
ted by KBC.
• If KBC investigates issues in applications, it may process personal data for that purpose.
• Incident management solves issues at customer level. When IT systems’ integrity has been compromised, KBC can re-
solve issues by recreating missing factors, as part of which KBC processes personal data.
• KBC may use personal data in evaluating, simplifying, testing or improving its processes, digital apps and standard-
form documentation and to optimise promotional campaigns, simulation exercises and online sales, such as by using
information from cookies (e.g., preference settings and click and browsing behaviour on our website) to follow up on a
simulation left uncompleted, statistics or a satisfaction survey.
• KBC uses services provided by third parties (infrastructure management) that monitor, investigate and, where necessa-
ry, restore the performance of KBC infrastructure and software. During these processes, personal data may temporarily
be visualised as a technical object. KBC concludes contracts by way of security and provides for technical security both
internally and externally to minimise the processing of personal data and maximise security.
• KBC records telephone conversations for purposes related to training and coaching its staff and improving the quality,
security and oversight of processes, for brief periods of one month.
• The dealings of KBC’s Corporate Mergers & Acquisitions team (M&A) extend over all and any types of KBC products and
services. It is possible that, in the process of acquiring or disposing of some part of its business or another, KBC might
exchange personal data with companies in the KBC group and third parties.
• KBC processes personal data, including transaction data, in order to gauge your knowledge and experience in relation
to investments with a view to protecting investors (MiFID).

Developing models for customer comfort and for marketing purposes

• Insight gained from analytical models allows KBC to build customer profiles. KBC then adjusts the model both to you
as an individual or at the level of your family and may also, exceptionally, apply it to another person for the following
purposes:
- Gathering data from different companies of the KBC group in these analytical models makes it possible to obtain
data-driven insights that support the KBC group in making strategic choices and
- Developing commercial policies, taking into account customers’ behaviour and wishes

Profiling for marketing purposes

• KBC creates profiles to personalise and steer direct marketing. KBC uses them to offer customers KBC products and
services or to determine the commercial policy for a particular customer.

 12 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

Customer comfort and customer journey

• KBC customises product and service offers by both itself and third parties.
• KBC uses personal data to send you messages in connection with a KBC service, for instance to improve its user-friend-
liness. You can disable these messages in KBC Mobile (under Profile/Notifications).
• When you fill in a KBC Insurance form, we naturally process the data needed to administer the relevant matter at hand.
This means that information you enter during a simulation may be stored in the meantime, saving you having to enter it
again if you interrupt the process or want to start again later.
• If you started a simulation or sales process but stopped before completing it, we may contact you to see what went
wrong and whether we can help, i.e. technical and administrative support for that specific process.
• KBC can use your ‘being a customer’ to determine the preferred channel (agent, branch, KBC Live, KBC Mobile, etc.) that
it will use to get in touch with you. You can of course still choose how you want to contact KBC.
• KBC may text you to confirm an appointment or remind you that you’ve missed an insurance policy renewal or a loan
repayment or that your account is insufficiently funded for a payment order to be executed. You can switch these notifi-
cations off in the menu for managing your text message settings.
• Communication via the KBC Mobile newsfeed.
• KBC digitises its services and products to improve their accessibility and user-friendliness with additional personalised
information.
• KBC processes customer profiles to be able to send relevant messages and information.
• KBC Insurance may also pass limited data about you and your insurance to members of your family or other related
parties if this is needed for a due and proper service, such as to avoid over-insurance.

Data processing needed to offer digital solutions in real time

• KBC can use your personal data to make you a better offer than at present or to give you a commercial discount. KBC
calculates the commercial discount for all customers, irrespective of any specific request. To this end, KBC analyses the
behaviour and a few relevant characteristics of the customer based on customer profiles.
• To be able to respond effectively to other customers or prospects (such as when preparing simulations or tenders)
and where KBC Insurance makes unsolicited offers in bespoke form, it can occur that, in the form of carefully shielded
underlying processes, it may look at your customer profiles. There is naturally no question of your personal data being
divulged to anyone in this context.
• KBC creates profiles to tailor its commercial strategy to customers’ behaviour and wishes.
• KBC obtains information from an external partner about the degree in which every building in Belgium is susceptible to
flooding and about the flooding zones laid down by law where this is relevant when underwriting home insurance.

Offer of aggregated insights

• KBC Insurance aggregates data identifiable as yours to the stage where they are no longer personal data in order
that they can be publicised, for instance to publicly share statistical data on insurance via its professional association,
Assuralia. KBC Insurance may at the same time carefully draw anonymised insights from personal data and subse-
quently offer those insights to the market.

Reinsurance
• Personal data may be passed on to reinsurance companies. KBC Insurance does this to reinsure risks it has assumed as
insurer and thus to mitigate its own risk.

3.5 KBC will request your consent to process your personal data in certain cases
If KBC requests consent to process personal data, it will be in the context of the following situations:
• For the processing of your health data
• To geolocate you
• To use contact details left by you such as in a simulation or competition entry form in order to advertise something to
you at a later stage
• To pass on your personal data to another data controller
• To perform identity checks on you using biometric data
• to answer questions from third parties

 13 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

However, the situations described above do not always require consent and KBC therefore sometimes uses another legal
basis for the processing. For example, KBC sometimes is under a statutory duty to answer questions from third parties or
this is contractually required. You can read more about consent for direct marketing in 3.6.2. For consenting to the pro-
cessing of health data, further details are given in 4.3.
If you are no longer able to make your own wishes and needs known, a carefully drafted lasting power of attorney can
guarantee that your personal wishes and needs are translated correctly from a lawful point of view, including with regard
to the protection of personal data. KBC will respect that expression of your will and your appointed proxy holder.

3.6 KBC Insurance uses your personal data for direct marketing
KBC Insurance is keen to be able to suggest a wide range of financial and non-financial products and services to you. It
may do so in response to explicit requests or where it has an idea that you might be interested in or could benefit from a
given product or service.
You can receive this information through various channels: through KBC bank branches and insurance agencies, over the
Internet and in apps, in the KBC Mobile app’s start screen, by sending push messages from KBC Mobile or your browser,
by e-mail, post or telephone, via Kate, and at events. In addition, KBC Insurance likes to keep up with the constantly
evolving range of new technologies. KBC is at pains to ensure that information is provided in a way that’s clear and will
choose the most appropriate channel to ensure the inconvenience of being disturbed is kept to a minimum.
If KBC Insurance knows the age, it does not make commercial offers of its own to young persons aged under 16 unless a
legal representative of theirs has consented.

Only one of the various options listed under 3.6.1 and 3.6.2 applies to you as a customer. From the moment you receive a
proposal to opt for the Direct Marketing contract as set out in 3.6.1, only that situation will apply to you, and your choice
for personalised information (3.6.2) will cease to apply. If you do not opt for the personalised agreement, you may still
receive direct marketing based on a legitimate interest (see 3.6.3). If you don’t want to receive any direct marketing at all,
see 2.5, which describes how to object to direct marketing.
If you are unsure as to which situation applies to you as a customer, feel free to e-mail [email protected] for help.

3.6.1 Direct Marketing contract for personalised advertising

If you choose to enter into a personalised agreement, you will receive personalised communications from KBC. The
processing of personal data is therefore essential to the performance of the personalised agreement. The personalised
agreement contains information about the services offered by KBC when you opt for the personalised agreement and on
how this agreement works.

3.6.1.1 Who is offering the personalised agreement?

KBC Bank, CBC Banque, KBC Asset Management and KBC Insurance (hereinafter: ‘KBC’) have joined forces in order to
make you proposals and contact you for advertising purposes in as personalised a manner as possible. These entities
can share your personal data with each other for this purpose, to the extent that this is necessary and relevant in order
to send you personalised commercial messages. This exchange is also possible if you are not, or no longer, a customer of
one of these entities. This enables KBC to approach you based on the overall profile it has compiled of you. This is import-
ant in order to ensure that KBC makes you relevant commercial proposals based on your specific situation.
For this purpose, these entities act as joint data controllers. In order to exercise your rights, as described in the general
data protection statement, you can contact KBC Bank, CBC Banque, KBC Asset Management or KBC Insurance.

3.6.1.2 What are KBC’s legal grounds for using your personal data?
KBC will only use your personal data for personalised services if you have chosen to enter into this agreement.
KBC invokes contract performance as a basis for delivering Kate Deals and personalised services, as described in the
personalised agreement. This involves:
• analysis and use of personal data in order to create a profile of you and subsequently be able to send you personalised
commercial offers and messages. You can find more information about this under point 3.3
• analysis and use of personal data in order to display Kate Deals to you on a personalised basis and to customise this
data at the participating retailer’s request. You can find more information about this under point 3.3

 14 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

• contacting you through the most appropriate channel. You may receive commercial messages through a variety of
channels (via the KBC bank branches and insurance agencies, the Internet, KBC applications, by post, e-mail, telepho-
ne, etc.).

KBC invokes permission to:

• use electronic communication channels to send commercial messages. The personalised agreement always contains
a provision for the receipt of electronic communications via push notifications from KBC Mobile, or by e-mail, text mes-
sage, or WhatsApp message. You may choose to change your communication preferences at any time and are the-
refore completely free to decide how KBC sends you commercial proposals. For example, you may decide at any time
to have these communications restricted to the channels of your choice, or not to receive any commercial messages
electronically at all. You can make these changes in KBC Mobile (Privacy > Commercial Settings), KBC Touch (Profile >
Privacy > Commercial Settings), KBC Live, or at any KBC branch. Even if you choose not to receive any electronic com-
munications at all, you can still benefit from the personalised services
• Send you personalised offers based on your click and browsing behaviour on KBC websites and in KBC applications.
KBC respects your privacy preferences and will only store this data if you have given the required cookie consent

3.6.1.3 What type of data processing is needed in order to provide the requested services?
In order to be able to deliver the services described in the personalised agreement, KBC must be able to predict your
behaviour, needs and requirements.
KBC uses all personal data (including transaction data, data obtained from third parties, data obtained from public
sources such as the Belgian Official Gazette, data and information gathered during conversations with you at the branch
or other contact moments, etc.) it possesses on you and any insights it obtains based on general market analysis. KBC
combines this data with other data and information relating to your family, business, etc.
KBC may make highly personalised commercial proposals to you, tailored to your needs and interests, by applying this
analysis to your individual or family situation (i.e. profiling).

Data processing in the context of personalised commercial messages

KBC conducts in-depth profiling as part of the personalised agreement in order to be able to tailor the advertising
messages to your needs. This is because KBC’s intention is to send you commercial messages tailored to your situation as
much as possible.
These commercial messages might focus on:
• KBC’s products and services and those of carefully selected partners with whom KBC works in order to provide their
services through KBC (e.g., Payconiq, partners for additional services such as 4411, De Lijn, Kinepolis, etc.). You can find
an up-to-date list of KBC’s partners at this link. This list is regularly updated by KBC
• Both financial products (including loans, credit cards, insurance products, etc.) and non-financial products (including
Kate Deals, purchasing train tickets, ordering service vouchers, etc.)
KBC generally sends these commercial messages to you directly, rather than through its partners. This ensures
that KBC can minimise data processing by its partners. KBC has also made contractual arrangements with its
partners, in which they confirm that they will comply with the privacy rules.

If you use ‘Additional services’ in KBC Mobile, KBC may use the personal data processed in that context and
the personal data it may receive from its partners to tailor advertising even more closely to your personal situ-
ation. You can find a list of partners that make such data available to KBC here.

For example, KBC collaborates with a few partners in the field of energy. These partners provide certain
services, such as compiling comprehensive renovation reports, or they work with contractors who carry out
insulation work or install solar panels. The data they make available to KBC allows us to propose the next step
of your renovation project to you.

Consult the partner’s documentation to learn more about exercising your privacy rights with regard to the
exchange of your data between the partners and KBC.

 15 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

Data processing in the context of personalised Kate Deals and Kate Coins
Calculation and execution of cashbacks
As part of the personalised agreement, you can receive personalised Kate Deals, and earn, obtain and spend personal-
ised Kate Coins at participating retailers.
KBC uses the transaction data to calculate and execute the cashbacks you are entitled to. For instance, based on your
purchases, KBC can see the number of Kate Coins you are entitled to and which deals or how many Kate Coins you actu-
ally used or redeemed.
KBC may also receive the data about your purchase (e.g., purchase price and category of the product or service) from
the participating retailer, for instance when you make a purchase with a participating retailer by clicking on a specific
link in the Kate Coin Store. Based on your click, the participating retailer can infer that you are a KBC customer with a
personalised agreement. The only purpose of this data exchange is to check whether you are entitled to Kate Coins and to
calculate and execute your cashback.

KBC works with a number of participating retailers

• Personalisation of the Kate Deals and Kate Coins based on parameters determined by KBC or jointly by KBC and the
participating retailer

KBC may decide, alone or in consultation with the participating retailer, to show a deal or award a Kate Coin only to
specific customers on the basis of predetermined parameters. This enables KBC and the participating retailer to more
accurately determine the target audience for a deal or Kate Coins. For example, KBC and the participating retailer might
decide to limit their deal to customers who have made purchases from the participating retailer over the past three, six or
nine months (or those who just fall short of this mark) or to customers who live or shop in a particular province. In order to
be able to deliver these parameters, KBC checks your personal data. The transaction details are also reviewed for some
of these parameters.
Personal data that may be processed in this context includes transaction data, place of residence, gender, age, house-
hold composition, as well as profiles derived by KBC (from customer data), for example, hobbies and what customers do
in their spare time. This data is processed either separately or combined. KBC does not pass on this personal data direct-
ly to the participating retailer, but instead uses it to determine the group of customers that get to see the retailer’s deal.
If this personalisation takes place at the participating retailer’s request and in consultation with KBC, KBC and the rele-
vant participating retailer are joint data controllers. Feel free to contact KBC if you have any questions about exercising
your rights, as described in this general data protection statement.
Since KBC automatically selects for which Kate Deals and/or Kate Coins you are eligible based on the parameter(s)
described above, some of these decisions may be made automatically. You can read more about how automatically
generated decisions are made in the Annex to the general data protection statement – automated decision-making.

· Anonymised statistics

KBC sends anonymised statistics to the participating retailers regarding their deal, as it was published on the
Kate Deals Platform.

Personalisation to show Kate Deals in the most relevant order

The Kate Deals displayed in the Kate Coin Store have been personalised. Personalisation is a feature of the Kate Deals
intended to ensure that the deals published in the Kate Coin Store are as closely aligned as possible to your needs and
preferences.
KBC creates a profile of you to help personalise the deals and determine how and in which order they are presented to
you. This allows KBC to present you with the deals that are most relevant to you.
KBC bases this profile on your transaction data, which shows the sectors (e.g., fashion, leisure, etc.) and locations that
may be of interest to you. KBC also looks at other personal data, such as your name and address. If you have given per-
mission for KBC Mobile to use your location, KBC will use it to show deals located near you. If you have consented to the
use of cookies, KBC also keeps track of your click behaviour (e.g., what deals you have viewed) in the Kate Coin Store in
order to improve the deals’ relevance.

 16 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

KBC and the TradeTracker partner platform join forces

To know if you are entitled to a deal via an external partner, and for the calculation and execution of the cashback, KBC
and the partner platform (TradeTracker) need to be able to see if you made a purchase using the unique link in the Kate
Coin Store and for what amount. KBC and the partner platform must also detect any fraud in connection with the deals
via external partners in time.
KBC and TradeTracker are joint controllers for these purposes. Feel free to contact KBC if you have any questions about
exercising your rights, as described in this general data protection statement.
The types of personal data processed by the partner platform in this context are traffic data (including IP addresses),
where appropriate linked to your purchase (amount and time).

3.6.2 Personalised commercial messages, with your consent

If you have previously consented to receiving personalised commercial messages, this consent will remain valid until you
have made a choice regarding the Direct Marketing contract.
If you give explicit consent to receive personalised commercial messages, KBC can make proposals tailored perfectly to
your individual situation. You will no longer receive scores of adverts that are of no interest to you. Your consent applies
specifically to personalised commercial messages and is unrelated to the processing of personal data in the context
of Kate Deals. In this regard, KBC uses all your personal data (including transaction data, data obtained from third
parties (such as financial institutions), data obtained from public sources such as the Belgian Official Gazette, data and
information gathered during conversations with you at the branch or other contact moments, etc.). This data is collated
along with details of your family and business, and so on, so that KBC is really in a position to provide you with commercial
messages tailored to you. You can withdraw your consent at any time, just as easily as you gave it.
Your consent to receiving personalised commercial messages is valid for each of KBC Insurance, KBC Bank, KBC Asset
Management, CBC Banque, KBC Securities and KBC Autolease. As regards KBC Autolease, your consent only applies
to services that it provides directly to private individuals. These KBC entities are then able to share your data with one an-
other. Such exchanges are also possible if you’re not or you are no longer a customer of any KBC company. This enables
KBC companies to look into your situation and proactively suggest alternatives aimed at your specific situation.
KBC sends these messages to you directly, rather than through its partners. These partners are listed in 3.6.1.1 and 3.6.1.2.
This ensures that data processing by these partners is limited and they only receive data about you if you personally
express interest in the information. KBC has made contractual arrangements with the partners, in which the partners
confirm that they will comply with the privacy rules.
Subject to your explicit consent, KBC may send you commercial messages about financial products and services and
about non-financial products and services. KBC offers a separate choice for both.

Platform users and prospects cannot opt for personalised commercial messages.

3.6.2.1 Commercial messages about financial products and services (occasionally referred to as
‘personalised information’)
Your separate consent applies to messages about financial products and services from KBC and from carefully selected
partners that offer products or services in the general fields of banking and insurance. Those partners must at all times
meet the following criteria:
• They must be a provider of financial services or an insurance company. Financial service providers include banks, credit
institutions, wealth managers, funds, stockbrokers and lease companies in as far as their offering to private individuals
is concerned.
• If legally required, the partner has to be licensed for the financial service or insurance that KBC is offering.
• The messages contain information on products and services from the general fields of banking and insurance such as
savings products, investment funds, payments, lending and insurance (both non-life insurance and life insurance).

A list of our current financial partners can be found at www.kbc.be/partners. This list is regularly updated by KBC.

 17 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

3.6.2.2 Commercial messages about non-financial products and services

Your separate consent applies to messages about non-financial products and services from KBC and from carefully
selected partners with whom KBC cooperates in order to offer you their services through KBC. The messages may relate,
for example but not exclusively, to the ‘Additional services’ that KBC offers in the KBC Mobile app, such as selling tickets
or offering new deals in KBC Deals.
The messages concern non-financial products and services outside the general fields of banking and insurance.
More information about partner services offered by KBC is available at www.kbc.be/partners. This list is regularly upda-
ted by KBC.

3.6.3 Limited personalised commercial messages, based on a legitimate interest

If you do not want to receive a highly personalised offer, you should not opt for the Direct Marketing contract or consent
to receiving personalised commercial messages.
Nevertheless, you may occasionally still receive offers and advertising from KBC Insurance (e.g., in KBC Mobile’s start
screen or by e-mail, push notification or text message): based on its legitimate interest, KBC sends offers on the basis of
a limited number of data (such as who you are and where you live, your date of birth, your marital status, your contact
details, family relationships, the apps and products you use, or any lack of interest on your part in certain products).
These limited personalised commercial messages may concern:
• Financial products and services from KBC Insurance NV or KBC Bank and KBC Asset Management
• Non-financial products and services from KBC and from carefully selected partners in, for example, the Additional ser-
vices offered in KBC Mobile, such as selling tickets. Learn more about the partners at www.kbc.be/partners

Subject to your separate consent for the electronic channels (e-mail, push messages and text message/WhatsApp), KBC
may send you advertising on all products through these channels. In the absence of your consent, we will limit ourselves
to advertising on products similar to those you already own. You can manage your consents in KBC Mobile, via KBC Live
or at your KBC branch.

You can object to direct marketing as set out in 2.5, in which case you will no longer receive personalised
advertising.
In order to be able to send you the appropriate message through the correct channel, KBC may also call on other service
providers. For this purpose, KBC may cooperate with communication and marketing agencies, and similar companies
such as social media players (e.g., Google, Facebook, Instagram, WhatsApp). Sometimes KBC only uses information it has
about you or your personal profile information held by them. In other cases, KBC combines this data. Depending on the
type of cooperation, they may be processors or controllers (see points 5.2 and 5.3).
KBC Bank, CBC Banque and KBC Insurance process personal data for direct marketing as joint data controllers. This all-
ows us to inform you of – and promote – the full range of products, services and brands that KBC offers through its physi-
cal channels and digital apps. In order to exercise your rights, as described in the general data protection statement, you
can contact KBC Bank, CBC Banque or KBC Insurance.

3.6.4 Marketing for platform users

KBC uses platform users’ personal data to conduct direct marketing campaigns (e.g., in KBC Mobile’s start screen or
by e-mail, push notification or text message) based on a legitimate interest. This may include services offered through
KBC Mobile, including KBC Deals, and KBC Insurance payment solutions. For this purpose, KBC processes the limited
set of personal data that the user registered when they activated the use of the KBC platform (surname and first name,
address, date of birth, mobile phone number and e-mail address). If the user agrees to the use of cookies, KBC can also
send offers based on click and browsing behaviour. Platform users can exercise their right to object to direct marketing,
in which case they may still see an advertising message but it will be a general advertising message, for which KBC does
not process platform users’ personal data.

3.6.5 Marketing based on your click and browsing behaviour

KBC may send you offers based on your usage patterns on its websites and apps, provided that you consent to the
collection of this cookie data and it being used for sending personalised commercial messages. The cookie consent

 18 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

determines which offer KBC can send you. Your cookie data may be combined with other personal data according to the
conditions set out under 3.6.1, 3.6.2 and 3.6.3.

3.6.6 Marketing for prospects

KBC uses prospects’ contact details to conduct direct marketing activities. Commercial messages by e-mail are sent
only with the recipient’s prior consent. Telephone marketing is always based on a legitimate interest, and KBC respects
anyone who is listed on the Do-Not-Call Registry.

3.6.7 What if you do not wish to receive personalised advertising (or less of such advertising)?
You can always choose not to activate the personalised agreement or not to opt for personalised information if you only
wish to receive general advertising messages. If you no longer want to receive any advertising at all, you can object to
direct marketing. For instructions, see paragraph 2.5.

3.7 KBC will not sell your personal data

KBC Insurance does not sell or hire out your personal data to third parties for their own use unless you opt for this yourself
by giving your consent or approval or in the context of a service. This enables KBC to share your data with third parties in
the context of the partners listed here (see 3.6.1.3).

Part 4: KBC Insurance processes different types of data

The types of data that KBC Insurance processes are explained below.

4.1 Identification, details linked to a service and personal particulars

IDENTIFICATION DATA
Name, gender, date of birth, place of birth, country of birth, nationality, ID card number, customer number, national registration
number, vehicle registration number, driving licence, your fingerprint as used to log in to your smartphone, click data, how you utilise
your device, information identifying the devices you use (Mac address, IPs, information uniquely identifying your device).

CONTACT DETAILS
Telephone number, e-mail address, language, postal address, username in social media apps.

DETAILS LINKED TO A SERVICE

Your products Your financial products (payments, loans, insurance, savings and investments).
Your product usage Your transactions, salary and other income and expenses, changes in your wealth situation, invest-
ments, loans, insurance policies, use of KBC apps, data concerning your claim(s), and so on.

Your preferences and Your potential interest in KBC products.

interests Your financial information, how it has changed over time and the advice we’ve previously given you.

Derivative information Based on movements such as payment transactions (transactions on your accounts, in your invest-
ment portfolio, done using your card, etc.), KBC Insurance is able to observe your behaviour and
assess your needs. We can use the resulting profile for instance to more effectively analyse which
payment solution works best for you, your preferences in terms of communication or which insurance
products you need. KBC can also calculate a commercial discount.

PERSONAL PARTICULARS
Your family situation Your marital status, the make-up of your household and relationships.
Your overall financial situ- KBC Insurance can give you sounder advice if it is apprised of your overall financial situation (your
ation total assets, real estate you own, etc.).

Your job of work Your education, occupation and work experience, representative of companies.
‘Key moments’ in your life The important phases in your life (past, present and future). Like getting married, living together,
building a family, plans for the home or the death of a child, parent or your spouse.

 19 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

Your lifestyle Things like leisure activities and interests, club memberships, your home environment and property
owned by you.

Your feedback Comments, suggestions and past complaints. These can definitely help KBC Insurance
to provide you with a better service in the future.

Your risk profile KBC processes your investor profile in order to assess whether a given investment is appropriate for
you. When other information is added such as age and investment horizon, KBC can also process
your risk profile and determine how you cope with investment losses, so that it can provide even more
targeted investment advice. KBC may also process your fraud profile, credit risk profile or insurance
risk profile, and other profiles for specific applications.
Your health data KBC processes health data, for example, in connection with medical acceptance when policies are
taken out and in the context of processing a claim.
Your biometric data KBC uses biometric data for various purposes, including to detect and combat fraud and cyber risks.

4.2 Data in the public domain and data obtained through third parties
KBC Insurance sometimes processes information that is a matter of public record.
• Information subject to a reporting duty (such as a public notice of your appointment as company director).
• Data you place in the public domain yourself, such as information on your website, your blog or via your publicly acces-
sible social media profile, or information about you that KBC Insurance has obtained from third parties (e.g., members of
your immediate family).
• Or data that is in the public domain, say, because it is common knowledge in your area or because it has appeared in
the press. Information from sources such as the companies register and Graydon also fall into this category.

KBC Insurance may also receive personal data via third parties, for example, but not exclusively, by buying it or obtaining
it from companies such as Blacktiger, IHS Markit Group Limited, GIM, Graydon and business organisations that are re-
sponsible for making sure that they gather the relevant information lawfully and pass it on to KBC.
KBC uses that publicly available data and information from third parties for all processing and purposes set out by KBC
Insurance in this data protection statement. The information can play a role in checking the accuracy of details held in
our records, in developing analytical models and profiles and in supporting (direct) marketing campaigns.

4.3 Health data

If you are insured through KBC Insurance or intend to purchase our products, or if you were involved in an accident and
are seeking to file an insurance claim, KBC Insurance may process your health data. Health data relates to your past,
present or future health condition. KBC Insurance receives this data, for example, via a questionnaire when you take out
insurance or based on medical reports following a claim event.
KBC Insurance will generally ask for your explicit consent for the processing of health data. In some cases, KBC Insurance
may also base the processing of health data on one of the other legally permitted options for processing this data, such
as to produce evidence in a court action.
KBC Insurance processes your health data to:
• Enter into, manage and perform insurance contracts, including any associated ICT support, printed matter and fi-
ling.  This includes, for example, medical acceptance for life insurance policies, calculating your premium, calculating
discounts, or settling claims if you were to be hospitalised
• Establish correct pricing and efficient cost management
• Fine-tune terms of acceptance and terms of cover based on medical trends and developments
• Detect and prevent insurance fraud

To provide you with the highest possible level of service, KBC Insurance is opting for digitalisation and automation of
some processes linked to entering into, managing and performing insurance contracts. As a result, KBC Insurance must
also be able to make automatically generated decisions based on your health data. If you consent to the processing of
your health data, this consent also applies to the making of automatically generated decisions based on this data.
Your consent to the processing of your health data remains valid until you revoke it. You are entitled to do so at any time.
This revocation may have implications for the further performance of your current insurance contracts or claims.

 20 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

KBC Insurance also processes your health data to create models, statistics and analyses to facilitate these purpo-
ses. KBC Insurance serves as data controller in these operations.
In short: KBC Insurance requires all this health data in order to be able to provide you and all other parties involved with
high-quality and sustainable services now and in the future. KBC does not process your health data for advertising or
marketing purposes, nor does it allow third parties to do so.
Your health data will only be available to the individuals who require it for the purposes stated above. These purposes are
interrelated and enable KBC Insurance to provide you with efficient services. Our staff and our KBC Insurance agents who
process this data do so under the supervision of a physician.

What about third-party access?

In some cases, KBC Insurance may share your health data with a third party, which will be strictly limited to cases where
this is required in order for KBC Insurance to handle your file or to perform certain core responsibilities (see above). KBC
Insurance will take every measure to ensure your privacy and your data are protected at all times.
For example:  
• If you are injured as the result of a claim event, KBC Insurance will share your health data that is relevant for the assess-
ment of your bodily injury with a physician.
• KBC Insurance will also share your health data with your health insurance fund to the extent necessary to handle your
claim.
• If you wish to take out an insurance policy, KBC Insurance may ask a physician to assess the medical questionnaire you
completed.
• In cases of severe bodily injury or when requesting compensation under a health insurance policy, KBC Insurance may
forward your health data to its reinsurer which is contractually involved in the financial consequences of your claim.

KBC Insurance will, in any case, only share the data that is absolutely necessary with third parties and KBC Insurance will
make every effort to ensure that these third parties also process any data under the supervision of a physician.

4.4 Your current location can be important

If KBC Insurance wants to identify your location (i.e., geolocate you), it will always ask you for your consent, for instance
when you visit certain pages on its websites or if you use a KBC app or new technology such as beacons.
You’ll then be given further information on what KBC Insurance is using your location for. It might be to tell you the location
of the nearest insurance agency, for instance. Or KBC Insurance may send you a message for which your location is im-
portant. Or, if you’re at a KBC event, the background in KBC Mobile might be modified accordingly, for example.
In order to offer you this service, KBC uses a geolocation service provider (Google). Google has a privacy policy of its
own. You can read it in detail at www.google.com/policies/privacy. We recommend that you take the time to read it. KBC
Insurance could also use the data of your location to build global models and perform analyses.
Moreover, we are aware of what your location is on the basis of things like your IP address and your telephone’s technical
readings. These details can also be of importance for measures like detecting fraud and better protection of your details.

4.5 KBC Insurance remembers data from simulations, competition forms, etc.
When you fill in a KBC Insurance form, we naturally process the data needed to administer the relevant matter at hand.
This means that information you enter during a simulation may be stored in the meantime, saving you having to enter it
again if you interrupt the process or want to start again later.
In order to evaluate the process, KBC Insurance may ask you why you interrupted it, especially if you had already entered
sufficient ID details when the process was interrupted (for example by logging in to KBC Touch).
The scope of the permission you give for KBC Insurance to use your personal data will be heeded by us in assessing whet-
her we can use the information on the form to approach you at a later date and whether we can do so with information,
advertising or proposals specially tailored to you.
Form filling can be time-consuming (especially for complex simulations). Always provide us with all the details we need to
fully identify you as a customer.

 21 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

• If you do, the app won’t ask you for certain information but instead pre-populate the form with data that KBC Insurance
has on record. You will nevertheless sometimes be asked to check that the information is complete and up to date.
• Some data will be pre-populated on the form if they are available. You will still be able to make changes.

4.6 KBC may process what you tell KBC, a KBC Insurance agent or KBC Insurance agent staff
When you contact KBC staff or one of its intermediaries by telephone, chat or some other channel, this is generally
recorded:
• To create an overview of the contact history
• To create a (short) record of the contact
• To enable staff to prepare ‘to do’ lists of tasks identified during the conversation
• To provide you with better service in the future
Even if you are not a customer, KBC Insurance will store such information as you disclose. That information can be used if
you subsequently become a customer.
By adopting this approach, KBC seeks to avoid your having to constantly provide information or answer questions a se-
cond time. It also allows KBC to improve continuity in the services provided to you.

4.7 Monitoring KBC correspondence in written form

If you contact KBC Insurance by e-mail or have digital communication channels that are used by KBC Insurance (e.g., KBC
Touch, KBC Mobile), it can use these channels to send you statutory and official notices.
Correspondence with KBC staff in the name of KBC Insurance or the KBC Insurance agents or KBC Insurance agent staff
(sent to a branch address, a branch fax or a job-linked or personal KBC e-mail address, etc.) is deemed to be business-
related and may therefore be examined in the context of:
• Their duties
• Production of evidence
• Workplace checks
• Security
• Combatting fraud
• Service optimisation and/or continuity, including the use of automated text analysis and editing to help KBC staff to
correspond with you quickly and efficiently

4.8 Recording telephone, video and chat conversations

KBC may listen in to or record conversations with you, such as telephone conversations with commercial staff in the
branch network, with the KBC Insurance agent or at KBC Live, contact centres and helpdesks, Private Banking branches,
and our inheritance experts.
KBC Insurance may listen in to or record these conversations. You will be informed of this at the start of the conversation
(e.g., verbally or in a pop-up message on your screen). By taking part in a telephone or video call, you expressly agree to
it possibly being recorded.
KBC listens in to or records conversations for various purposes:
• For training and coaching of staff or to improve the quality or security and monitoring of processes. These recordings
are kept for a period of one month. Due to technical reasons, they may be stored in our back-up files for slightly longer.
• Production of evidence:
- In the context of legal duties for the protection of investors, KBC Insurance is required to record and retain telephone
conversations and electronic communications that could result in investment product transactions. KBC Insurance
therefore records the conversations and electronic communications of staff whose work duties relate to investments. If
you talk to these experts or relationship managers or communicate with them electronically, we record it. For evidential
purposes and in order to comply with the legal obligations under the legislation, KBC Insurance keeps these recordings
for ten years. If a dispute arises, KBC will keep them for as long as it needs to defend itself. You can request a copy of
this recording.
- KBC attaches a great deal of importance to secure online banking. To that end, KBC set up the Cybersecurity Service
Secure4u, which is available 24/7. You can contact Secure4u to report (alleged) abuse, after which KBC will investigate
the report and, where appropriate, contact you by telephone. KBC may then ask you, for example, to lodge a com-

 22 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

plaint with the police. KBC also records this telephone call for any subsequent juncture.
• Service provision:
- KBC Insurance may use automated analyses of conversations to speed up and improve its services. Telephone, video
and chat conversations, for instance with Kate, together with other communications and the emotions expressed in
them, can then be used in the development and training of artificial intelligence. Artificial intelligence could ultimately
allow written or spoken customer communication to be fully automated. Artificial intelligence can support KBC staff
and increase KBC’s ease of access. The link to personal data is severed as quickly as possible when developing and
training artificial intelligence. To check and improve the quality of verbal chat conversations with Kate, KBC converts
the conversation into text. KBC only keeps the original conversation for one month and the anonymised transcription
for one year.
• Any conversation with KBC security and alarm management can be vital. For this reason, KBC records these conversati-
ons and KBC can listen to them again.

4.9 Temporary storage of security camera images

KBC may use CCTV in and around the offices and premises where it operates. In the case of security cameras, KBC
observes the special rules that apply. If a security camera is present, KBC informs you by means a clearly visible sticker,
for instance. In addition, KBC in all events adheres to the ‘BeSafe’ guidelines (www.besafe.be) issued by the Security &
Prevention General Directorate of the Federal Public Service for the Interior.
KBC generally keeps images recorded by security cameras in and around KBC premises (identified with a sticker) for no
more than one month. They may be kept for longer:
• If the recorded images serve as evidence of certain dealings or may depict a criminal offence or unruly behaviour
• As evidence of damage or in order to identify an offender, trouble-maker, witness or victim
• Where a right of access is exercised, for as long as necessary to respond to the request

At locations that present a heightened security risk. Here the period is three months.
If you have questions about CCTV images, you can contact the CCTV Contact Centre at Egide Walschaertsstraat 3,
2800 Mechelen, or at [email protected].

4.10 More than just your own personal data may be involved
For instance, if you have a company or children, you agree that KBC Insurance can also keep a record of those relation-
ships and process the data of any associated persons. KBC may also process personal data of parties KBC has no direct
relations with but who are involved in a relationship with it, like being the beneficiary under a life insurance policy or as
usual driver under a car insurance policy, or as a witness to an accident. And, if you provide information about your family
members or related persons, we ask you to inform them of that fact (e.g., of a change of address that you’ve forwarded
to us). If necessary in order to properly provide services, we may also pass certain information on you and your insurance
policies to members of your family or related parties, to avoid over-insurance for instance.
This has the following implications for legal entities:
• You agree that you’re amenable to KBC’s processing data relevant to the relationship with associated legal entities or
natural persons as well as the data of those entities (e.g., parent company, subsidiaries, representatives, ultimate bene-
ficial owners).
• In addition to the personal data of contacts, KBC naturally also stores data of your business.
• All KBC entities in Belgium and elsewhere can retrieve and use data of legal entities that are KBC group customers. This
can be done on the grounds set out in part 3.
• The data that we can share on legal entities covers all aspects of the customer relationship: products held, a (historical)
summary of transactions and contacts, where applicable the group of companies to which the customer belongs, as
well as the data of designated contacts.
• Please note that legal entities may only provide us with personal data of natural persons associated with them if those
persons are sufficiently informed of this and, where necessary, have given their consent.
• Legal entities will be liable to indemnify KBC Insurance in respect of any claims against it in this regard (vis-à-vis those
concerned). For example, the company is responsible for complying with the data protection legislation when it submits
lists of users for online apps or of beneficiaries of employee profit-sharing bonus programmes and when taking out
group insurance for a member of staff.

 23 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

• KBC uses the contact details of representatives of legal entities to make appointments via the representative with the
legal entity, issue it with a commercial proposal, and for relationship management purposes.

Part 5: on cooperation, confidentiality and security

5.1 Not everyone at KBC can look at your data

Only those with appropriate authorisation can access personal data, and then only if it is relevant for performing their
duties.
In principle, within KBC Insurance and the KBC group, your personal data will only be processed and consulted by de-
partments that:
• You now have, previously have had or would in future like to have a contractual relationship or contact with
• Require to be involved in the provision or aftercare of services
• Fulfil legal requirements (at group level) or requirements imposed by regulators or stemming from corporate governance
principles
• Are tasked with preventing fraud, including money laundering, by staff and customers. Some examples:
- When we are notified of the death of a customer of KBC Insurance who is also a customer of other KBC entities in
Belgium, we also inform those other entities
- In relation to prevention of terrorism, we notify our compliance operatives
Persons who are authorised to consult your data are moreover bound by a strict professional duty of confidentiality and
must abide by all technical requirements to ensure the confidentiality of your personal data and the security of the sys-
tems in which the data is held.

5.2 Locations where data is processed are limited

KBC Insurance uses the services of several processors to process personal data. These are companies that process data
on the instructions of KBC Insurance.

5.2.1 Processors within the KBC group

For the processing of personal data, KBC Insurance makes use of a processor within the KBC group based in the
European Union, namely KBC Global Services NV. Processing is carried out in Brno or Varna, for instance, by the Shared
Services Centre, branches of KBC Global Services NV in the Czech Republic or Bulgaria.
Some of the data processing performed by KBC Group NV and KBC Global Services NV on behalf of KBC Insurance NV
relates to oversight and support functions (at group level) such as:
• Financial reporting
• The compliance function
• The internal audit function
• The inspection and risk function
• Complaints management
• Marketing support
• The preparation and partial settlement of claims
• The administrative management of policies and operational tasks
• Support for invoicing, payments, credit processing and sanctions screening
• The investigation team which develops models and statistics to improve services and strategy
• ICT management for the KBC group
• The tax authorities
• Anti-money laundering checks
• Etc.

 24 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

For ICT management, KBC uses KBC Global Services NV, sometimes in conjunction with other processors within and out-
side the KBC group.

KBC also uses the services of 24+ NV (www.24plus.be) and VAB (www.vab.be):
• As a contact centre through which you can get in touch with us
• As a contact centre to get in touch with you on behalf of KBC for the purpose of making an appointment or conducting
a satisfaction survey, to inform you about ‘personalised information’ and to invite you to make a choice
• To log data into KBC apps
• For administrative processing on the instructions of KBC
Examples include making appointments for branches, answering telephone enquiries, handling e-mails, and processing
and executing online applications.
KBC Insurance engages the services of KBC Bank to build statistical models and prepare profiles.

5.2.2 Processors characteristic of the insurance sector

KBC Insurance uses specialist third parties in Belgium and abroad to perform some processing operations. Such parties
include:
• Exclusive insurance agencies, which also includes KBC Bank and CBC Banque
• Insurance brokers acting under a mandate/delegation granted to them by KBC Insurance
• Insurance intermediaries operating around the world, for the purpose of insuring international risks
• The e-health platform (www.ehealth.fgov.be) for secure exchanges of health data among doctors, victims and insurers
• AssurCard NV (www.assurcard.be), which supports communication between the insurance sector and service providers
• Association of Pharmacists Belgium (APB) and the Office of Co-operative Pharmacies in Belgium (OPHACO), which sup-
port the processing of BVAC certificates
• Informex (www.informex.be), which supports vehicle coachwork repairs and related payments
• Repairers (e.g., car repairers, glass repairers)
• Network managers who are responsible for steering and managing repairers from their network
• Loss assessors for the assessment of material damage or bodily injuries
• Psychologists providing support in the context of a claim event
• Private detectives engaged to investigate fraud cases
• (International) insurance firms with offices around the world
• Security and surveillance firms
• Services such as RAVIN AI Ltd or EMS Nederland BV for the assessment of damage to vehicles, buildings or their con-
tents, and who can refer you to an appropriate repair service
• Applications like REVIDIA that we use to remotely view and assess the damage to your building via video, and take pic-
tures of it to get an accurate view of the damage
• Etc.

5.2.3 Other processors

KBC Insurance may also directly or indirectly (e.g., through KBC Group NV) engage the services of other processors, such
as:
• Consultants
• Third-party business introducers to fulfil its general duty of vigilance as laid down by law:
- The obligation to identify and verify identities
- The obligation to identify the customer characteristics and the purpose and nature of the business relationship
- The obligation to update information
• Market research agencies such as Ipsos (www.ipsos.co), Profacts (www.profacts.be), GFK (www.gfk.com), Check market
(www.checkmarket.com), iVOX (www.ivox.be) and Intrinsiq (www.intrinsiq.be), for issuing invitations and carrying out
surveys
• ICT and ICT security service providers like Microsoft, Cognizant, IBM, Amazon and HP, and specialist fintech and artificial
intelligence companies such as Onfido for facial recognition during the customer onboarding process
• Specialist cybersecurity companies that can provide you, as an insured, with round-the-clock technical support
• Marketing and communication agencies and similar companies, whereby KBC uses personal profile information on you

 25 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

that is held by them, along with the data it holds on you, to be able to make targeted offers to you via their channels
(e.g., Google, Facebook, etc.)
• Companies that support KBC in identifying and analysing your user behaviour in our apps and on our websites (e.g.,
Adobe, Dynatrace). In preparation for the analysis of Adobe Data Analytics, KBC will rely on the services of Amazon
Web Services – Cloud Computing Services. The transfer and processing of personal data from, to and in Amazon Web
Services is encrypted
• Companies specialising in information archiving and access, such as Doccle (Doccle stores information on all our
customers, including those that haven’t opted for digital record-keeping). Doccle uses Amazon Web Services – Cloud
Computing Services)
• Companies specialised in scanning digital documents in order to digitise files with associated info
• Companies specialising in solvency investigations
• Printers for the printing and addressing of news magazines and badges, among other things, but also for the outsour-
cing of printed matter intended for customers. In this latter case, the information contained in the printed matter may
also include health data or criminal records
• Translators and translation agencies
• Social Media Management tools (CX Social, 19 Public)
• Sworn real estate experts
• Communications agency Motisha BV (www.motisha.com)
• Companies providing Platform as a Service (PaaS) and Software as a Service (SaaS) in the cloud, such as:
- The Microsoft Dynamics CRM app used by KBC to maintain customer overviews
- VEE24’s video chat app for enabling digital communication with KBC
- The storage services of Microsoft Azure or Amazon, on which KBC can place its own platforms or software that process
and store your personal data
- Security services that screen Internet or e-mail traffic with KBC for cyberattacks or phishing scams
- TreasurUp, with whom KBC exchanges the contact details of company representatives to enable forex transaction
analysis
- Nomios Belgium NV to set up a secure network connection between KBC entities worldwide based on SD WAN
technology
- Applications that facilitate and automate call recording, where appropriate, for instance as offered by Luware
• Companies that carry out administrative duties in the context of property management, such as Quares NV
• Etc.

5.2.4 Processors outside the EEA

KBC always opts for the processing of personal data to take place within the European Union. If, however, KBC Insurance
cooperates with a third party, personal data may end up in countries where that third party’s data centres are located.
In the case of KBC Insurance, this may for example mean that some of your data is processed in countries outside the
European Economic Area (‘EEA’), i.e. India, Great Britain, Israel, Australia, Thailand, Indonesia or the United States of
America. Even if the data centre is located within the EEA, access from outside the EEA may still be possible because of
the commitment to manage incidents around the clock, whereby the standard ‘follow-the-sun’ principle is applied to
switch their incident team at night to the US and then Asia. This is the case, for example, when KBC directly or indirectly
cooperates with parties such as Amazon, Google, Microsoft, etc.
Legislation in some countries outside the EEA (like the United States of America or India) doesn’t always afford the same
level of data protection as in EEA member states. Where a non-EEA country is viewed by the European Commission as
not offering an adequate level of protection, KBC Insurance can cover the deficiency by, say, agreeing the required con-
tractual guarantees with those third parties (such as a model approved by the European Commission), providing control
mechanisms and implementing technical and organisational measures.
Even if the transfer is subject to an adequacy mechanism (such as the EU-US data protection framework in the United
States of America), KBC will still ascertain that third parties provide an adequate level of protection.

5.4 Processing by other data controllers

As a data controller, KBC may – in addition to using other processors – also use other service providers or third parties,
such as insurance brokers, lawyers, notaries public or doctors, who themselves are data controllers.

 26 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

KBC can itself act as a third-party business introducer for, for example, Payconiq, Belgian and Mobile ID (itsme). KBC then
processes personal data as data controller. KBC transfers this personal data to the third party. Likewise, a third party may
act as a third-party business introducer for KBC.
If you have Cyber Insurance with KBC Insurance, you yourself will also pass on personal data to third parties acting as
data controllers in certain cases. This mainly concerns experts who assist you in the event of a possible claim event.
KBC Insurance uses the services of reinsurance companies to reinsure risks it has assumed as insurer and thus to mitigate
its own risk. These reinsurance companies act as data controller of your personal data. For more information, please con-
tact the reinsurance company. An up-to-date list of reinsurance companies with which KBC Insurance cooperates can be
found here.
KBC Insurance uses the services of Datassur CV (www.datassur.be), a partnership between insurers for shared IT applica-
tions (Verpais, RDR (direct claims settlement) platform, Crashform and Siabis+), for claim settlement in files involving public
interest entities and for managing databases with specific information (RSR database, car@ttest, find@car, Discover and
contractor accreditations and registrations).
In order to detect and combat insurance fraud and to analyse risks, insurers exchange certain personal data through two
databases established for this purpose within the insurance sector: the RSR database kept by Datassur (www.datassur.
be) and the claims database whose controller is non-profit organisation Alfa Belgium (www.alfa-belgium.be). The purpo-
se of these databases is to facilitate sound risk analysis and combat (organised) insurance fraud. Insurers will occasional-
ly also directly exchange personal data in that context.

5.4 KBC Insurance takes specific measures to protect your data

KBC Insurance ensures that strict rules are followed and that the processors concerned:
• Only have the data they need in order to perform their tasks
• Give KBC Insurance a commitment that they will process the data securely and confidentially, and only use it for carry-
ing out the instructions issued to them
KBC Insurance will not be liable if these processors (according to legislation) disclose customers’ personal data to local
authorities or if incidents occur at those processors despite the measures they have taken.
KBC ensures that the European data protection standards for personal data are applied worldwide within companies
belonging to the KBC group and their branches. KBC also ensures that companies and corporate branches of the KBC
group take appropriate measures to protect the data of legal entities.
KBC Insurance takes internal technical and organisational measures to prevent personal data finding its way into the
hands of, or being processed by, unauthorised parties or being accidentally altered or deleted.
Strict security measures are in place to protect premises, servers, the network, data transfers and the data itself, and
extra checks are also carried out by a specialist department in this regard.
To make online access to insurance as secure as possible, security experts at KBC continuously analyse cyber-criminal
activity so that they can hone the relevant security measures accordingly. Find out more at www.kbc.be/secure4u.
You and we together need to be aware that information shared by e-mail can sometimes be intercepted and, where
possible, we must aim to use a different means of communication or to limit the amount of information sent.
KBC websites and apps may contain links to websites or information of third parties. KBC Insurance does not check such
websites or information. Parties offering these websites or this information may have their own privacy policies in place,
which we advise you to read. KBC is not responsible for the content of those websites, their use or the privacy policies of
those websites/third parties.
KBC Insurance sometimes facilitates the publication of information (including personal data) via social media such
as Twitter and Facebook. Bear in mind that these channels have their own terms of use, with which you must comply.
Publishing data on social media may have (undesirable) consequences, including for your privacy or that of persons
about whom you share data. You may not be able to delete such published data quickly. You should therefore assess
the consequences of this yourself as the decision to disclose data on such media ultimately lies with you. KBC does not
accept any responsibility in that regard.

5.5 KBC does not keep your data for ever

KBC uses your personal data where KBC has a clear aim in mind. Once that aim no longer exists, we delete the data.

 27 / 28
Data Protection Statement (formerly ‘Privacy Statement’) of KBC Insurance NV

The periods for which your personal data is retained are the ones defined by law that have to be respected by KBC under
legal and regulatory requirements. For example, insurance legislation specifies that contractual and pre-contractual
documents relating to insurance contracts be retained for certain periods of time (which is often five years after the end
of the contract). Even if no contract is concluded, KBC is still required to keep a record of all insurance mediation acts for
a period of five years. For accounting data, the law stipulates that data must be retained for a period of seven years.
A longer retention period than the one required by law is in place if it is needed for exercising your and our rights. For
instance, the prescription period in relation to certain loans and advances under a life insurance policy can be up to
35 years after the contract has ended. KBC will obviously not delete your policy-related data as long as there are still
outstanding claims or unpaid premiums to be collected. KBC retains health data for as long as they are required under
current insurance contracts or for the acceptance of any new contracts. It is only by keeping your health data for as long
as medical acceptance is possible that KBC can correctly assess the risk you want to insure under a new contract (by law,
you are not required to provide again any health data you had previously provided).
For some applications, a more extended time horizon may also be necessary, such as for carrying out surveys and risk
and marketing models. Some insights only get clearer once they are viewed over a longer time span. This can result in the
retention period being extended by ten years on top of the standard periods. As has been stated, KBC will in all cases
sever connections to individuals as quickly as possible and work only with aggregated or anonymised data.
Personal data on potential customer prospects is used by KBC for five years unless, in the meantime, there has been
contact with the prospect. In that case, a new five-year period starts. Prospects can always ask for their personal data to
be removed.

5.6 KBC thinks before it answers queries from outside parties

5.6.1 Compliance with confidentiality obligations

As KBC Insurance has to comply with its confidentiality obligations and with the data protection legislation, we will only
answer queries from third parties if they arise pursuant to a legal requirement or a legitimate interest, doing so is a prere-
quisite for performing the contract or the data subject has given their permission.
In the last case, it is actually advisable to request the information directly from the data subject.
KBC declines liability if, as a result of foreign legal obligations, the lawful recipients of data are required to pass personal
data about customers or legal entities on to local authorities. Or if they process personal data without an adequate level
of security.

5.6.2 Requirement for Insurance Ombudsman to address KBC Complaints Management

KBC Complaints Management provides answers to the questions posed by the Insurance Ombudsman.

5.6.3 Third parties must contact the ‘Third-Party Enquiries’ department

If you as a third party have queries about customers, for example because you work for the police or are a notary public
or lawyer, you can contact the KBC Insurance Call Centre, Van Overstraetenplein 2, 3000 Leuven, or by e-mail to telecel.
[email protected] (life insurance) or [email protected] (non-life insurance). This specialist department will answer
your question bearing in mind its confidentiality obligations and the data protection legislation. Our intermediaries and
other departments will therefore refer you to that department.

5.7 You can also help in protecting your data

There are certain aspects of (technical) data processing over which KBC Insurance has no, or at best insufficient, influ-
ence and for which KBC cannot guarantee total security. Examples include the Internet or mobile communications (e.g.,
smartphones).
If hackers are active, KBC Insurance does not always succeed in defeating their cyberattacks in time. KBC sometimes
does not even know that it is happening, for example if a hacker manages to obtain your identification details by instal-
ling illegal software on your computer (spyware) or by creating a fake website (phishing).
KBC Insurance therefore suggests that you regularly take a look at the KBC website for information on safe use of the
web: www.kbc.be/secure4u. This site always contains the most up-to-date tips and recommendations to keep you secu-
re online.

KBC Insurance NV –- Professor Van Overstraetenplein 2 – 3000 Leuven – Belgium VAT BE 0403. 552. 563 – RLP Leuven – IBAN BE43 7300 0420 0601 – BIC KREDBEBB
Member of the KBC group. Version 06-11-2023 28 / 28