Personal details are data that relate to an identified or identifiable natural person. Sensitive personal data are personal details that are specially protected by law due to their sensitivity, for example health data. Processing means any form of handling of your data, in particular collection, storage, use, disclosure, archiving or deletion. We comply with the Federal Data Protection Act (FADP), the implementing ordinance (DPO) and other data protection laws potentially applicable in individual cases (e.g. the European General Data Protection Regulation [GDPR], provisions of the Federal Law on Insurance Contracts relevant to data protection or other sector-specific provisions, including the special provisions regarding occupational pension and accident insurance).
In the following, we will show what data we collect, what we use it for and what your rights are in this regard. Additional information can be found in other documents, for example in the financial and pension planning contract and the corresponding declaration of consent.
We not only process data of our customers, but also data of third parties, in particular of the following persons (each referred to as “they”):
- Prospective customers
- Authorised representatives and agents
- Contact persons of partners (e.g. brokers)
- Relatives (e.g. spouses, children)
- Other third parties involved (e.g. fiduciaries, tax advisers)
Our employees are regularly trained on data protection and are sworn to secrecy. In addition, our data protection unit monitors compliance with data protection regulations.
The following companies are responsible under data protection law for the data processing described here:
- Baloise Insurance Ltd
4051 Basel, Switzerland
- Baloise Life Ltd
4051 Basel, Switzerland
- Baloise Bank Ltd
4502 Solothurn, Switzerland
(together hereinafter referred to as “Baloise” or “we”)
If you have any data protection concerns or wish to exercise your rights under clause 9, you can contact our data protection unit as follows:
- Baloise Insurance Ltd
Data protection unit
Aeschengraben 21, P.O. Box
4002 Basel, Switzerland
- Baloise Bank Ltd
Data protection unit
4502 Solothurn, Switzerland
3.1 General information
In the context of financial and pension planning, we process the categories of data described below, although this list is not exhaustive.
In the event of changes to data over time (e.g. due to a change of address, a change in civil status or another modification), we may continue to store the previous status of such data in addition to the current status within the framework of the statutory storage periods.
3.2 Master data
We refer to the basic data that we require in addition to the contract data (see below) for the processing of our contractual relationships or for marketing and advertising purposes as master data. Master data includes, in particular, contact information (e.g. name, address, telephone number and email address), personal details (e.g. date of birth, age, gender, nationality, data from identification documents), other identification data (e.g. AHV number, customer number, tax identification number) or information about your relationship with us (e.g. partner / customer status, customer history). Account information is also collected, including bank account details (e.g. account numbers).
We receive master data from you or from third parties, for example from public registers. We also receive data in connection with address changes, as we are involved in an address update network which sends us and the other companies involved in the network updated address data (e.g. the new address after a move).
3.3 Contract data
This is data that is collected in connection with the conclusion or processing of a contract in the context of financial and pension planning. Contract data includes data from planning contracts and information from pre-contractual relationships (e.g. information from previous consultation sessions, further information on the contract concerned, term of the contract and invoicing information as well as further contractual relationships in connection with financial and pension planning).
Contract data also includes financial data, that is, information on income (e.g. earned income, pension income and income from investments) and information on companies (e.g. annual financial statements, etc.), current account and deposit account statements, information on pension funds and pension assets, pension fund regulations, information on assets (e.g. real estate, credit balances, securities) and information on liabilities (e.g. current mortgages).
For the purposes of preparing financial and pension plans, we also process data on documents presented, e.g. marital agreements and contracts of succession, wills, divorce agreements, tax returns incl. supplementary sheets, information on advance care directives, extracts from the Land Register and advance healthcare directives.
We generally collect contract data directly from you, from contracting parties and from third parties involved in the processing of the contract, but also from third-party sources and from publicly accessible registers. If necessary, we will obtain separate consent from you.
3.4 Communication data
When you contact us via the contact form, our Customer Service, by email, telephone or chat, by letter or via other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication.
We will specifically point out to you if we record telephone conversations, such as for evidence or training purposes. If you do not wish to be recorded, please let us know or end your call.
When communicating with you, for example when you submit a request for information, we sometimes also collect data to establish your identity (e.g. information from official identification documents, answers to security questions) in order to prevent us releasing information to unauthorised third parties.
3.5 Behavioural and preference data
In order to provide you with the best possible service and advise you on our products and services, we would like to find out your preferences and determine your requirements. To do this, we collect and use data about your behaviour when you interact with us and about the preferences you tell us or that we identify.
Behavioural data are details of certain actions, such as the use of electronic means of communication (e.g. whether and when you opened an email), the use of our websites (for more information, see baloise.ch/en/about-us/information/privacy-policy.html) or customer portals, the way in which you obtain products and services, your interaction with our social media profiles and your participation in prize draws, competitions and events. Preference data tells us about your requirements and which products or services might be of interest to you. We obtain this information from the analysis of existing data, such as behavioural data, so that we can tailor our consultation and our offers more precisely to you. To improve the quality of our analyses, we may combine such data with other data that we obtain from third parties such as address brokers, government agencies and publicly available sources, for example, information on your household size, income bracket and purchasing power, socio-demographic data, shopping behaviour and contact details of relatives.
3.6 Other data
We may also collect data from you in other situations. In connection with official or judicial proceedings, for instance, data accumulates (e.g. files, evidence) that may also relate to you.
We may receive or produce photographs, videos and audio recordings in which you may be identifiable (e.g. at events, by security cameras, etc.). You will always be asked for your consent or informed accordingly in advance. For security purposes, we may also collect data on who enters certain buildings and when, or who has corresponding access rights (e.g. in the case of access controls or based on registration data or visitor lists, etc.), who participates in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems.
We obtain the data mentioned here primarily from you, but also from third parties (e.g. authorities) and in some cases also from our Baloise Group companies.
Your data will only be processed by us for the purposes we have indicated to you when collecting your data, or if we are legally obliged or entitled to process it. For further details on the basis of our processing, please refer to clause 5.
4.1 Pre-contractual measures, conclusion of contract, contract settlement
Prior to the conclusion of a contract in the context of financial or pension planning, we process your data in order to offer you the desired consultation and relevant products as well as to contact you in this regard.
In the course of initiating business, personal details – in particular master data, contract data and communication data – of potential customers and other contracting parties are collected or they result from a communication. We also process data in connection with the conclusion of the contract to initiate the customer relationship. In some cases, this information is checked for compliance with legal requirements. If you apply to us for a financial or pension planning contract, we need your information to prepare the financial and pension plan. We may also carry out automated data processing and create customer profiles (see clause 6 below). This is necessary in order to be able to offer you a suitable financial or pension planning solution.
If the financial or pension planning contract is concluded, we process your data to implement the financial or pension plan, in particular to provide and claim contractual services, for the administration of the contractual relationship, for example to issue invoices, as well as to communicate with you. This also includes consultation and customer support, as well as accounting and termination of contracts. In this context, we process primarily master data, contract data and communication data.
4.2 Statistical evaluations and data analyses
Data that we require for statistical evaluations and data analyses are aggregated and no longer allow any conclusions to be drawn about your person. The aggregated data is required for the creation of statistics (e.g. for the development of new insurance rates) or for topic-specific evaluations and data analyses, as well as for sales reporting. We also use the data of all existing contracts – likewise without the possibility of drawing conclusions about you personally – to analyse the entire customer base.
4.3 Marketing and offers for further products and services
We may use your data to send you advertising about our products and services as well as those of our group companies and business partners (within and outside the insurance sector), for example in the form of newsletters or other regular contacts (by email or post, by telephone or as part of other marketing campaigns such as competitions, events). In particular, we use your communication data for this purpose.
In order to make our offers more relevant to your requirements and interests, we personalise some of our communications to allow for an individual approach. The individual approach can be made in writing or by telephone. To do this, we link data that we process about you – in particular master data, contract data, behavioural data and communication data – and determine preference data as a further basis for personalisation. We can also create interest profiles about you and divide you into advertising groups (without including particularly sensitive personal data such as health data).
In order to provide you with comprehensive advice on insurance, assets, pension and financial matters (e.g. financing, fund and other financial investments) and to make you offers for further products and services or to advertise them to you, we may process your master and contract data as well as the information disclosed on the occasion of the consultation conducted with your customer adviser.
To manage our relationships with customers and third parties, we may also invite you to our customer events and inform you about our products and services before, during or after the event.
You can inform us if you do not wish your data to be processed for the above purposes or if you wish to revoke your consent in this regard (see contact address in clause 9).
4.4 Market research and product optimisation
We are committed to continuously developing our products and services to meet your needs. Therefore, we also sometimes contact you for market research purposes and use the results in anonymised form for addressing various questions within the company. To determine customer satisfaction, we can ask you about your experience with us. We also use your responses to contact you personally, to actively address your concerns and to improve our internal processes. We also collect, store and process your data for the evaluation, improvement and redevelopment of our products and services. In doing so, we analyse which products are used by which groups of people and which adjustments would be necessary in the future. The results of these analyses are – as far as possible – carried out in pseudonymised or anonymised form. For this purpose, we process the previously described master data, behavioural data and preference data as well as communication data.
4.5 Statutory and regulatory obligations
We may be required to report to authorities or disclose records in certain cases. Personal details about you may be processed in the course of internal and external investigations, for example by law enforcement authorities or an appointed private body. The legal obligations may be subject to Swiss law, but also to foreign regulations to which we are subject. For these purposes, we process in particular your master data, contract data and communication data, but also behavioural data under certain circumstances.
4.6 Other purposes
We may also process your data for other purposes, for instance, as part of our internal processes and administration. This includes training, educational and administrative purposes (such as the management of master data, accounting, data archiving and the management and ongoing improvement of the IT infrastructure), the protection of our rights (e.g. to enforce claims in and out of court and before authorities in Switzerland and abroad, or to defend ourselves against claims, such as by preserving evidence, legal clarifications and participation in judicial or official proceedings), security purposes (e.g. access controls, monitoring of buildings), statistical purposes and the evaluation and improvement of internal processes. As part of the development of the company, we may also sell or acquire businesses, parts of businesses or companies to other companies or enter into partnerships, which may also lead to the exchange and processing of data.
Where we ask for your consent for certain forms of processing, we will inform you separately about the relevant purposes of the processing.
Where we ask for your consent for certain forms of processing, we will inform you separately about the relevant purposes of the processing. You can revoke your consent at any time by notifying us with effect for the future. Once we have received notification of the revocation of your consent, we will no longer process your data for the purposes to which you originally consented. If consent is revoked, this will not affect the lawfulness of the processing carried out based on the consent previously given, up until the date of its revocation.
Unless we ask you for your consent to processing, we base the processing of your personal details on the fact that the processing is necessary for the initiation or execution of a contract with you or that we or third parties have a legitimate interest in doing so, for example in order to pursue the purposes described above under clause 4 and the associated objectives as well as to take appropriate measures. Our legitimate interests also include the marketing of our products and services.
In addition, we may also base some of our data processing on a legal basis that entitles us to process personal details.
For the purposes mentioned in clause 4, we may also process and evaluate your data automatically, i.e. electronically, in order to assess certain personal characteristics or behaviour (so-called profiling), as well as to identify different interests and personal requirements for marketing purposes, product and service offers and services.
In the event that we base our decisions when concluding a contract exclusively on automated data processing (so-called automated individual decisions) and if such decisions cause negative legal effects or significant disadvantages for you, or if they affect you significantly in a similar way, we will inform you of this in an appropriate manner and separately inform you that you can have the relevant decision reviewed by us if necessary.
In connection with the purposes set out in clause 4 above, we may also disclose your personal details to third parties, in particular to the recipients categorised below, who are bound by us to treat your details as confidential:
7.1 Baloise Group companies (group companies)
If necessary for the preparation, servicing and provision of financial and pension plan solutions, data may also be shared with other companies belonging to the Baloise Group.
In order to provide you with comprehensive advice on insurance, assets, occupational pensions and financial matters (e.g. financing, fund and other financial investments) and to provide you with offers for our own products and for the services of other group companies or to advertise them to you, we may also pass on your master and contract data as well as the information provided during the consultation conducted with your customer adviser within the Baloise Group (e.g. Baloise Bank Ltd, Baloise Insurance Ltd) for the purposes of contacting you and providing you with individual offers.
All group companies have been obligated by us to treat your data confidentially.
You can inform us if you do not wish your data to be shared for the above purposes or if you wish to revoke your consent in this regard (see contact address in clause 9).
You can request a list of the Baloise Group companies via the postal address or email address stated under clause 9 below.
7.2 Official bodies and authorities
We may also share your data with official bodies, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This includes compliance with statutory notification obligations, the exercise of rights, the defence against claims and compliance with legal requirements, for example within the framework of official, judicial and pre- and extra-judicial proceedings as well as within the framework of statutory duties to inform and cooperate.
Data is also disclosed if we obtain information from public bodies, for example when checking an address.
7.3 Service providers in Switzerland and abroad
Some of our services and business functions (e.g. in connection with the purchase of IT services or for marketing campaigns) are provided on our behalf by legally independent companies in Switzerland and abroad (see clause 8 below) (e.g. in connection with the purchase of IT services or for marketing campaigns), which may process data about you if this is necessary for the performance of the contract. These service providers are contractually obliged to adhere to our standards for data processing, as well as to the applicable data protection legislation. Where contractually or legally provided, such service providers may in turn engage third parties under the same conditions.
When your personal details are processed by recipients in accordance with clause 7 above, your data may also be transmitted abroad, for example when personal details are forwarded to other Baloise Group companies or to service providers. Under certain circumstances, we may also transmit data to third parties abroad who are involved in the processing of the contract (e.g. authorities and courts), as well as to other bodies.
Your data may therefore be processed worldwide, including outside Switzerland or the European Union or the European Economic Area (i.e. also in so-called third countries such as the US). Many third countries currently do not have laws that ensure a level of data protection equivalent to the applicable FADP. Therefore, following a risk assessment, we take contractual precautions to contractually compensate for the weaker legal protection, as well as further measures (e.g. pseudonymisation) to reduce the risk of state/government access abroad authorised by foreign legislation. We rely on the guarantees required by law, insofar as the recipient is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exceptional provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests, if the performance of a contract requires such disclosure, if you have given your consent or if it is a matter of data that you have made generally accessible and you have not objected to its processing.
You have the following rights in accordance with the applicable data protection law and if the conditions are met:
- You can request information about whether we process your personal details and, if so, what these details are.
- You can request us to correct incorrect data or complete incomplete data or correct or complete such data yourself to a limited extent via the customer portal at any time.
- You may request the erasure of your data unless we are required or authorised to retain your data under applicable laws and regulations.
- You may request that the data you have provided be released or transferred to another data controller in a commonly used electronic format, provided that the processing is carried out using automated processing, you have consented to the processing, or your data is processed for the conclusion or settlement of the insurance contract.
- In cases in which the data processing is based on your consent, you have the right to revoke this at any time. If you revoke your consent this does not affect the lawfulness of the data processing undertaken on the basis of your consent up until the revocation.
- Where applicable, you have the right to object to the processing of your data, in particular for direct marketing purposes, profiling for direct marketing purposes and other legitimate interests in processing.
- You have the right to express your point of view in the case of automated individual decisions (see clause 6) and to request that the decision be reviewed by a natural person.
You also have the right to lodge a complaint with our data protection unit or the competent data protection supervisory authority if you do not agree with our handling of your rights. You can contact the Swiss supervisory authority at edoeb.admin.ch.
Please note that these rights are subject to statutory requirements and that exceptions and limitations apply. In particular, we may need to process and store your personal details in order to fulfil a contract with you, to protect our own legitimate interests, such as the assertion, exercise or defence of legal claims, or to comply with statutory obligations. To the extent legally permissible, in particular to protect the rights and freedoms of other data subjects and to safeguard interests worthy of protection, we must therefore also reject a data subject request in whole or in part (e.g. by blacking out certain content that concerns third parties or our trade secrets). In order for us to be able to rule out fraudulent use, we must verify your identity (e.g. with a copy of your identity card, if identification is not possible in any other way). We generally retain information in connection with the processing of data subject requests for three years.
If you wish to exercise your rights, you can contact us in writing or by email at the address below.
Baloise Insurance Ltd
Data protection unit
Aeschengraben 21, P.O. Box
4002 Basel, Switzerland
Baloise Bank Ltd
Data protection unit
4502 Solothurn, Switzerland
Your data will only be stored by us for as long as is required for reaching the aforementioned purposes and for as long as we are legally or contractually obligated to store it.
In individual cases, it is possible to retain personal details for longer, for example if claims are asserted against us (during the statutory limitation period) or if we are otherwise contractually, legally or officially obliged to do so, if you consent to this or if legitimate business interests (e.g. documentation and evidence purposes) require this. As soon as your data is no longer required for the above purposes, it will be deleted or anonymised as part of our standard deletion processes.
11.2 Internet risks
In transferring data via the Internet, you are acting at your own risk. We protect the data you transmit via our web pages during transit by means of appropriate encryption mechanisms. In addition, we take appropriate technical and organisational security measures to reduce the risks on our websites. Your device, however, is outside the security area that we are able to control. You are therefore required to inform yourself about the necessary security precautions and to take suitable measures in this regard.
11.3 Email encryption
We will send you requested information by email if you have provided us with your email address. Confidential information is transmitted in encrypted form. If information cannot be shared in encrypted form via email, we will use other channels for this purpose (e.g. the customer portal or Baloise Secure Transfer). If you use our customer contact form, your data will be sent to us in encrypted form.
11.4 Blocking of access
In the event of security risks being identified, we explicitly reserve the right to temporarily suspend or, in severe cases, to block access to our websites and customer portals. We do not accept any liability for any loss or consequential damage arising from the suspension or blocking of access.
Last updated in May 2023.