Privacy Policy Website
Legal Notice: This document is provided for informational purposes only. In case of any discrepancies or differences in interpretation between this translation and the original German version, the German version shall prevail. The legally binding version of these terms is the German version, which you can access
here.
1. Data Protection at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data refers to any data by which you can be personally identified. For detailed information on data protection, please refer to our privacy policy listed below this text.
Data Collection on This Website
Who is responsible for data collection on this website?
The data processing on this website is carried out by the website operator. Their contact details can be found in the section “Note on the Responsible Entity” in this privacy policy.
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This could be data that you enter into a contact form, for example.
Other data is collected automatically or with your consent by our IT systems when you visit the website. This mainly includes technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.
What do we use your data for?
Part of the data is collected to ensure the website is provided without errors. Other data may be used to analyze your user behavior.
What rights do you have regarding your data?
You have the right at any time to obtain free information about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you may revoke this consent at any time for the future. Additionally, you have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
You can contact us at any time with questions about data protection.
Analysis Tools and Third-Party Tools
When visiting this website, your surfing behavior may be statistically evaluated. This is primarily done using so-called analysis programs.
Detailed information about these analysis programs can be found in the following privacy policy.
2. Hosting
Google Cloud
We host our website on Google Cloud. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (hereinafter “Google Cloud”).
When you visit our website, your personal data is processed on Google Cloud's servers. In the process, personal data may also be transferred to the parent company, Google LLC, in the USA. The data transfer to the USA is based on the EU Standard Contractual Clauses.
Further information can be found in Google's privacy policy:
https://policies.google.com/privacy?hl=deThe use of Google Cloud is based on Article 6(1)(f) of the GDPR.
3. General Information and Mandatory Disclosures
Data Protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the legal data protection regulations as well as this privacy policy.
When you use this website, various personal data is collected. Personal data is any data with which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
We would like to point out that data transmission over the internet (e.g., when communicating via email) may have security gaps. A complete protection of data from access by third parties is not possible.
Note on the Responsible Entity
The responsible entity for data processing on this website is:
SafeHome GmbHAddress: Bergheimer Str. 147, 69115 Heidelberg
Commercial Register: Amtsgericht Mannheim
Registration Number: HRB 742339
Email: Datenschutz@heyenzo.comThe responsible entity is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).
Storage Duration
Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, deletion will take place once these reasons no longer apply.
General Information on the Legal Bases for Data Processing on This Website
If you have consented to data processing, we process your personal data based on Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data are processed according to Art. 9(1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device (e.g., via device fingerprinting), the data processing is additionally based on § 25(1) TTDSG. Consent can be revoked at any time.
If your data is required for the performance of a contract or for pre-contractual measures, we process your data based on Art. 6(1)(b) GDPR. Furthermore, we process your data if it is necessary for compliance with a legal obligation, based on Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The specific legal bases applicable in each individual case are explained in the following sections of this privacy policy.
Note on Data Transfer to the USA and Other Third Countries
We use tools from companies based in the USA or other countries that are not considered secure under data protection law. When these tools are active, your personal data may be transferred to and processed in these third countries.
We would like to point out that these countries may not offer a level of data protection comparable to that of the EU. For example, U.S. companies are required to hand over personal data to security authorities without allowing data subjects to take legal action against this. Therefore, it cannot be ruled out that U.S. authorities (e.g., intelligence agencies) process, analyze, and permanently store your data stored on U.S. servers for surveillance purposes. We have no influence over these processing activities.
Revoking Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You may revoke consent that you have already given at any time. The legality of the data processing carried out up to the time of revocation remains unaffected by the revocation.
Right to Object to Data Collection in Special Cases and to Direct Advertising (Art. 21 GDPR)
If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right, at any time and for reasons arising from your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions.The relevant legal basis on which processing is based can be found in this privacy policy.If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims (objection under Art. 21(1) GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such advertising purposes; this also applies to profiling in connection with such direct marketing.If you object, your personal data will no longer be used for direct marketing purposes (objection under Art. 21(2) GDPR).
Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the member state of their habitual residence, place of work, or the place of the alleged violation.The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.
Right to Data Portability
You have the right to receive data that we process automatically based on your consent or in fulfillment of a contract, either in a commonly used, machine-readable format, or to have it transferred to a third party.If you request the direct transfer of data to another controller, this will only be done where technically feasible.
SSL or TLS Encryption
For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the site operator—this site uses SSL or TLS encryption.You can recognize an encrypted connection by the fact that the browser’s address line switches from “http://” to “https://” and by the lock icon in your browser bar.When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Right to Access, Deletion, and Correction
Within the framework of the applicable legal provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its origin and recipient, and the purpose of the data processing. You also have the right to request the correction or deletion of this data.For this and any other questions regarding personal data, you can contact us at any time.
Right to Restrict Processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time regarding this. The right to restrict processing applies in the following cases:
- If you dispute the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data was or is unlawful, you may request the restriction of data processing instead of deletion.
- If we no longer need your personal data but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
- If you have filed an objection under Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, such data – apart from being stored – may only be processed with your consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
Objection to Promotional Emails
We hereby object to the use of contact data published within the scope of the legal notice obligation for the transmission of advertising and information materials not expressly requested. The operators of these pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example through spam emails.
4. Data Collection on This Website
Use of Cookies
Our websites use so-called "cookies." Cookies are small text files that do not harm your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted after your visit ends. Persistent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.
In some cases, cookies from third-party companies may also be stored on your device when you enter our site (third-party cookies). These allow us or you to use certain services provided by the third-party company (e.g., cookies for handling payment services).
Cookies serve various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g., the shopping cart function or displaying videos). Other cookies are used to analyze user behavior or to display advertising.
Cookies that are required for the electronic communication process, to provide certain functions you request (e.g., for the shopping cart), or to optimize the website (e.g., cookies for measuring web audiences) are stored on the basis of Art. 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimized delivery of its services. If consent to store cookies and similar recognition technologies has been requested, the processing is based solely on this consent (Art. 6(1)(a) GDPR and § 25(1) TTDSG); the consent can be withdrawn at any time.
You can configure your browser to notify you when cookies are set, allow cookies only in individual cases, exclude the acceptance of cookies for specific cases or in general, and enable the automatic deletion of cookies when the browser is closed. Disabling cookies may limit the functionality of this website.
If cookies are used by third-party companies or for analysis purposes, you will be informed about this separately in this privacy policy, and consent may be requested where necessary.
Server Log Files
The provider of the pages automatically collects and stores information in so-called server log files that your browser automatically transmits to us. These include:
- Browser type and browser version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Time of the server request
- IP address
This data is not merged with other data sources.
The collection of this data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website – for this, the server log files must be recorded.
Contact Form
If you send us inquiries via the contact form, your details from the inquiry form, including the contact information you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not share this data without your consent.
The processing of this data is based on Art. 6(1)(b) GDPR, if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries directed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this was requested; consent can be withdrawn at any time.
The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.
Inquiries by Email, Phone, or Fax
If you contact us by email, phone, or fax, your inquiry including all resulting personal data (such as your name and the nature of your inquiry) will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.
The processing of this data is based on Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this was requested; consent may be withdrawn at any time.
The data you send us via contact inquiries will remain with us until you request deletion, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions – especially retention periods – remain unaffected.
Comment Function on This Website
For the comment function on this page, in addition to your comment, information such as the time of the comment’s submission, your email address, and—if you are not posting anonymously—your chosen username will be stored.
Storage of IP Addresses
Our comment function stores the IP addresses of users who post comments. Since we do not review comments before they are published on this website, we need this data in order to take legal action against the author in cases of rights violations such as insults or propaganda.
Storage Duration of Comments
Comments and the related data are stored and remain on this website until the commented content has been completely deleted or the comments must be deleted for legal reasons (e.g., offensive comments).
Legal Basis
The storage of comments is based on your consent (Art. 6(1)(a) GDPR). You may revoke your consent at any time. An informal email to us is sufficient. The legality of the data processing already carried out remains unaffected by the revocation.
5. Social Media
Social Media Elements with Shariff
This website uses elements from social media platforms (e.g., Facebook, Twitter, Instagram, Pinterest, XING, LinkedIn, Tumblr).
You can usually recognize these elements by the respective social media logos. To ensure data protection on this website, we use these elements only in conjunction with the so-called “Shariff” solution. This application prevents the social media elements integrated into this website from transmitting your personal data to the respective provider as soon as you enter the site.
Only when you activate the respective social media element by clicking the corresponding button will a direct connection be established with the provider’s server (consent). Once you activate the social media element, the respective provider receives the information that you have visited this website with your IP address. If you are also logged into your corresponding social media account (e.g., Facebook), the provider can associate your visit to this website with your user account.
Activating the plugin constitutes consent within the meaning of Art. 6(1)(a) GDPR and § 25(1) TTDSG. This consent can be revoked at any time with effect for the future.
The use of this service is to obtain the legally required consents for the use of certain technologies. The legal basis for this is Art. 6(1)(c) GDPR.
Facebook
This website integrates elements of the social network Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the collected data is also transferred to the USA and other third countries.
An overview of Facebook’s social media elements can be found here:
https://developers.facebook.com/docs/plugins/?locale=de_DE.
When the social media element is active, a direct connection is established between your device and the Facebook server. Facebook thereby receives information that you have visited this website with your IP address. If you click the Facebook “Like” button while logged into your Facebook account, you can link the content of this website to your Facebook profile.
This allows Facebook to associate your visit to this website with your user account. Please note that we, as the website operator, have no knowledge of the content of the transmitted data or how Facebook uses it. For more information, please refer to Facebook’s privacy policy:
https://de-de.facebook.com/privacy/explanation.Where consent has been obtained, the use of the above-mentioned service is based on Art. 6(1)(a) GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in achieving the broadest possible visibility on social media.
To the extent that personal data is collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited solely to the collection of data and its transfer to Facebook. Any processing by Facebook after data transmission is not part of the joint responsibility. The jointly applicable obligations have been set out in a joint processing agreement. The wording of the agreement can be found here:
https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing privacy information regarding the use of the Facebook tool and for the data protection-compliant implementation of the tool on our website. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g., access requests) regarding data processed by Facebook directly with Facebook. If you assert such rights with us, we are obligated to forward them to Facebook.
Twitter
This website integrates features of the Twitter service. These features are provided by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
When the social media element is active, a direct connection is established between your device and the Twitter server. Twitter thereby receives information about your visit to this website. By using Twitter and the “Re-Tweet” function, the websites you visit are linked to your Twitter account and made known to other users. We would like to point out that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by Twitter. For more information, please refer to Twitter’s privacy policy:
https://twitter.com/de/privacy.
Where consent has been obtained, the use of the above-mentioned service is based on Art. 6(1)(a) GDPR and § 25 TTDSG. This consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in achieving the broadest possible visibility on social media.
Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Details can be found here:
https://gdpr.twitter.com/en/controller-to-controller-transfers.html.
You can change your privacy settings on Twitter in your account settings at:
https://twitter.com/account/settings6. Newsletter
Newsletter Data
If you would like to receive the newsletter offered on this website, we require an email address from you as well as information that allows us to verify that you are the owner of the provided email address and that you agree to receive the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not share it with third parties.
The processing of the data entered into the newsletter registration form is based solely on your consent (Art. 6(1)(a) GDPR). You can revoke your consent to the storage of the data, the email address, and its use for sending the newsletter at any time, for example via the “Unsubscribe” link in the newsletter. The legality of any data processing already carried out remains unaffected by the revocation.
The data you provide for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose for storing the data no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest under Art. 6(1)(f) GDPR.
After you unsubscribe from the newsletter distribution list, your email address may be stored in a blacklist by us or the newsletter service provider if this is necessary to prevent future mailings. The data in the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with legal requirements for the sending of newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not time-limited. You may object to the storage if your interests outweigh our legitimate interest.
7. Plugins und Tools
YouTube with Enhanced Privacy
This website includes videos from YouTube. The provider of the site is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in enhanced privacy mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they view the video. However, data sharing with YouTube partners is not necessarily excluded by the enhanced privacy mode. YouTube – regardless of whether you watch a video – establishes a connection to the Google DoubleClick network.
As soon as you start a YouTube video on this website, a connection to YouTube's servers is established. This informs the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.
Furthermore, YouTube may store various cookies or use similar recognition technologies (e.g., device fingerprinting) on your device after you start a video. This allows YouTube to receive information about visitors to this website. Among other uses, this information is used to compile video statistics, improve user experience, and prevent fraud.
Additional data processing operations may be triggered after starting a YouTube video, over which we have no control.
The use of YouTube is in the interest of presenting our online offerings attractively. This constitutes a legitimate interest under Art. 6(1)(f) GDPR. Where consent has been obtained, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG, to the extent that the consent includes the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
More information on YouTube’s privacy policy can be found at:
https://policies.google.com/privacyhl=de.
Font Awesome
This site uses Font Awesome for the consistent display of fonts and icons. The provider is Fonticons, Inc., 6 Porter Road Apartment 3R, Cambridge, Massachusetts, USA.
When a page is accessed, your browser loads the required fonts into its browser cache to correctly display texts, fonts, and icons. For this purpose, the browser you use must connect to Font Awesome's servers. This gives Font Awesome knowledge that your IP address has accessed this website.
The use of Font Awesome is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the consistent presentation of the typeface on our website. Where consent has been obtained, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG, to the extent that the consent includes the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
If your browser does not support Font Awesome, a standard font from your computer will be used.
More information about Font Awesome can be found in their privacy policy at:
https://fontawesome.com/privacy.
MyFonts
This website uses MyFonts. These are fonts that are loaded into your browser when you access our website to ensure consistent typography across the site. The provider is Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA.
To verify compliance with licensing terms and track the number of monthly page views, MyFonts transmits your IP address, along with the URL of our website and our contract data, to its servers in the USA. According to Monotype, your IP address is anonymized immediately after transmission, so that no personal reference can be made (anonymization).
Google Maps
This site uses the Google Maps map service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the features of Google Maps, it is necessary to store your IP address. This information is typically transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission. If Google Maps is activated, Google may use Google Web Fonts for the consistent display of fonts.
The use of Google Maps is in the interest of providing an attractive presentation of our online offers and making it easy to locate the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Where consent has been obtained, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG, to the extent that the consent includes the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
More information on handling user data can be found in Google's privacy policy:
https://policies.google.com/privacy?hl=de.
General Data Protection Notice on the Use of Personal Data
Enzo is a product name of SafeHome GmbH.
With this notice, we would like to inform you how your personal data is processed when you use insurance-related services via the Enzo app and website (both hereinafter referred to as the “Frontend”), as well as about the rights you are entitled to under data protection law.
Personal data is processed by SafeHome Gesellschaft mit beschränkter Haftung in Heidelberg (hereinafter: “Enzo”, “we”, “us”) in its capacity as insurance agent/broker and your point of contact for all matters concerning your insurance.
In the following, we would also like to explain how the Frontend works and what it contains.
1. Functionality and Content of the Frontend
The Frontend is intended to make it as easy as possible for you to use insurance-related services. Via the Frontend, you have access in particular to the following functions:
- 1.1 Targeted information on insurance products offered by Enzo
- 1.2 Conclusion of an insurance contract with Enzo; this contract concluded via Enzo may have one or more insurers
- 1.3 Support and advice on your insurance contracts
- 1.4 Reporting of insurance claims
2. Types of Data Processed
In order for you to use the services offered via the Frontend, personal data is processed. Personal data means any information that relates to you personally or can be attributed to you.
Your personal data is processed in compliance with the EU General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”), the provisions of the German Insurance Contract Act (“VVG”) relevant to data protection, and all other applicable laws.
The personal data processed about you in each individual case can be divided into the following five categories:
2.1 Master data
- Master data is information about you that is required to identify you and to contact you.
- This includes in particular the following information: first and last name, age, address, marital status, email address, telephone number, payment information.
2.2 Insurance data
- Insurance data is insurance-specific information required for the conclusion, performance or termination of an insurance contract.
- This includes in particular the following information: previous insurance, start of insurance, type of insurance, selected product group within the insurance, number of insurance claims in the past, status of premium payments.
2.3 Claims data
- Claims data is information required to process and settle a reported insurance claim.
- This includes in particular the following information: information about the loss event, amount of the loss, insured benefits, payment terms, invoice amounts, type of insurance benefit.
2.4 Usage data of the Frontend
- Usage data is information collected automatically about your behaviour when using the Frontend.
- This includes in particular the following information: the Internet Protocol (IP) address that connects your device to the internet; date and time of the request; content of the request (specific page); access status/HTTP status code; amount of data transferred in each case; website from which the request originates; receipt and read confirmations of emails; logins; email addresses; passwords; information about devices and the internet connection, such as browser type, version, number and extensions; time zone settings; operating system and platform; behaviour and preferences when using the Enzo website, the app and emails; changes of location and position. When using the app, this additionally includes: device identifier; unique device number (IMEI = International Mobile Equipment Identity); unique subscriber number (IMSI = International Mobile Subscriber Identity); mobile phone number (MSISDN); MAC address for Wi-Fi use; name of your smartphone, email address.
3. Purposes of Data Processing
3.1 Processing by Enzo
3.1.1 Via the Frontend, Enzo collects the master data, insurance data and claims data you provide. Enzo uses this data to broker insurance and to provide insurance-related services via the Frontend, in particular for advice, support and administration during your insurance relationship. For brokered insurance products, Enzo stores this data in a computer-based policy administration system (Policy Administration System, “PAS”).
The legal basis for processing personal data for pre-contractual and contractual purposes is Art. 6(1)(b) GDPR.
The conclusion, performance and termination of the insurance contract via Enzo are not possible without the processing of your master data, insurance data and claims data.
3.1.2 Enzo processes your master data in order to contact you by post and electronic mail (email, in-app message, SMS) for advertising purposes about Enzo products or services that are similar to the products and services you already use (“direct marketing”). The legal basis for this advertising using your master data is Art. 6(1)(f) GDPR on the basis of legitimate interest. The legitimate interest arises in particular from the legally recognised objective of promoting electronic commerce and from the assumption that advertising for similar products and services is perceived by existing customers as useful information and is therefore also in the interest of the data subject. You have the right to object at any time, with effect for the future, to the use of your personal data for the purpose of such direct marketing (Art. 21 GDPR). If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. The objection can be made to Enzo without any particular form. You can find the contact details under section 4.
3.1.3 Enzo further processes, by automated means, the master data, insurance data and, where applicable, claims data you provide, together with the usage data, in order to
- improve and further develop Enzo products and business processes;
- carry out market segmentation;
- improve and further develop the Enzo website and app and other online-based Enzo offerings;
- address you specifically about product content and products you might like and draw your attention to them (personalised advertising);
- include you in discount, loyalty and referral campaigns;
- contact you for advertising purposes on other communication channels outside the app, the website and email (so-called targeted and behavioural marketing);
- and for fraud, abuse and risk prevention.
The aforementioned automated data processing and combining of user data, including for advertising purposes, only takes place if you have given your prior consent. We obtain such consent pursuant to Art. 6(1)(a), Art. 22(2)(c) in conjunction with Art. 7 GDPR from you separately. This consent is voluntary and is not a condition for using the Frontend and the associated insurance-related services.
Should Enzo wish to process your personal data for a purpose not mentioned above, you will be informed of this in advance within the framework of the statutory provisions.
Further information about Enzo can be found at
https://www.heyenzo.com/en/initial-information. You can also request this information using the contact details given in section 4.
3.1.4 The insurer for your insurance is Gothaer Allgemeine Versicherung AG, Gothaer Allee 1, 50969 Cologne. As the controller responsible for data processing, we transfer personal master data, insurance data and claims data to Gothaer Allgemeine Versicherung AG, which also processes this data for its own purposes under its own responsibility. Information on data protection at Gothaer Allgemeine Versicherung AG can be found in the Gothaer Group’s data protection information sheet included in the consumer information handed to you when you applied, or at
https://gothaer.de/StreamingServlet/app/dvz/DocumentDownload/116991?scope=gothaer_scope.
3.2 Other processing by Enzo
In addition, Enzo processes personal data under its own responsibility for the following purposes:
3.2.1 Enzo processes your personal data to safeguard the legitimate interests of Enzo or a third party. These legitimate interests are:
- Ensuring IT security and IT operations.
- Preventing and investigating criminal offences; in particular, data analyses are used to identify indications that may point to insurance fraud.
- Checking international sanctions lists to detect financial crime.
The legal basis for processing your personal data for these purposes is Art. 6(1)(f) GDPR. You may object to the processing of your data on this legal basis on grounds relating to your particular situation. See section 9.
3.2.2 In addition, Enzo processes your personal data to comply with legal obligations. This includes processing based on regulatory requirements, retention obligations under commercial and tax law, or advisory obligations. The legal basis for processing for these purposes is the respective statutory provisions in conjunction with Art. 6(1)(c) GDPR.
Enzo is responsible for the processing of your personal data for its own purposes under this section 3.2.
4. Controller Responsible for Data Processing
The controller responsible for processing your personal data is:
SafeHome GmbH (Enzo)
Bergheimer Str. 147
69115 Heidelberg
Tel.: +49 (0) 6221-7239080
Email: support@heyenzo.com
You can reach the body responsible for data processing / the data protection officer by post at the address below or by email at:
SafeHome GmbH (Enzo)
Bergheimer Str. 147
69115 Heidelberg
Email:
Datenschutz@heyenzo.com5. Categories of Recipients of Personal Data
5.1 External service providers:
To fulfil its contractual and legal obligations and to provide the services offered, Enzo partly uses external service providers.
A list of the contractors and service providers we use with whom we have more than temporary business relationships can be found in the overview in the consumer information handed to you when you applied, and in the current version at
https://heyenzo.com/datenschutzvereinbarung.
5.2 Public authority recipients:
In addition, your personal data may be transferred to other recipients, such as authorities, to fulfil statutory reporting obligations (e.g. social insurance providers, supervisory, tax or law enforcement authorities).
5.3 Insurers:
Furthermore, your personal data may be transferred to the insurer in order to ensure the provision and maintenance of insurance-related services.
6. Duration of Data Storage
Your personal data will be deleted or its processing restricted as soon as it is no longer required for the purposes stated above, if you withdraw your consent on which the data processing was based and there is no other legal basis for the processing, if you object to processing based on a legitimate interest within the meaning of Art. 6(6)(e) or (f) GDPR and there are no overriding legitimate grounds for the processing, or if deletion is required to comply with a legal obligation. Your data will only not be deleted if and for as long as this is required to comply with a legal obligation (e.g. retention obligations under commercial and tax law of up to ten years) or to establish, exercise or defend legal claims.
7. Rights of Data Subjects
Using the contact details given in section 4, you can request information about the data we have stored about you. In addition, under certain conditions you can request that we correct or delete your data. You may also have a right to restrict the processing of your data and a right to receive the data you have provided in a structured, commonly used and machine-readable format.
8. Right of Withdrawal
If data processing is based on consent you have given, you can withdraw this consent at any time with effect for the future. You will be informed about the effects of such a withdrawal before giving your consent.
9. Right to Object
If data processing is based on the overriding legitimate interests of the controller or a third party, you can object to this data processing if your particular situation justifies it.
10. Right to Lodge a Complaint
The protection of your data is very important to us. Should something nevertheless not be to your satisfaction, please contact one of the data protection officers mentioned above. You can find the contact details for this under section 4. You also have the right to lodge a complaint with a supervisory authority. The contact details of the data protection officers of the German federal states and the federal government can be found at
https://bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
.svg)
