Privacy Policy

This Privacy Policy explains how personal data collected through insuranceforexpat.es is processed in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and other applicable Spanish data protection rules.

1. Who is responsible for your data?

For processing carried out for the Website’s own administrative, technical, contact and commercial purposes, the controller is:

BR PROTECTIA SL
NIF/CIF: B27662188
Registered office: Calle Cristóbal Bordiú 35, Entreplanta B, 28003 Madrid, Spain
Email: carlosblanco@insuranceforexpat.es

BR PROTECTIA SL is registered with the Dirección General de Seguros y Fondos de Pensiones as an exclusive insurance agent under key C0161B27662188, with a principal agency agreement with DKV Seguros y Reaseguros, Sociedad Anónima Española.

For processing that forms part of the insurance mediation and contracting process, BR PROTECTIA SL acts within the framework of its agency relationship with the insurer and may process data on behalf of DKV in accordance with applicable insurance distribution and data protection rules.

2. What data may we process?

Depending on your request, we may process identification and contact data, date of birth, gender, province, intended arrival date in Spain, visa or residence purpose, information about additional applicants, the content of your message, technical information associated with the submission and evidence that the privacy information was made available to you.

We do not ask users to provide medical or other special-category data through the general Website form. If health information is required for underwriting, it must be provided through the insurer’s authorised process or another specifically designated secure channel.

3. Purposes and legal bases

Handling enquiries and quotation requests: to respond to your request, analyse the insurance solution requested and take pre-contractual steps. Legal basis: Article 6(1)(b) GDPR and, where appropriate, Article 6(1)(f) GDPR.
Insurance mediation and administration: to transmit and manage information necessary for the insurance distribution process with DKV and other authorised recipients involved in the requested service. Legal basis: pre-contractual/contractual measures and legal obligations applicable to insurance distribution.
Website security and fraud prevention: to protect the Website, systems and users and maintain technical logs where necessary. Legal basis: legitimate interests and applicable legal obligations.
Commercial communications: only where a separate lawful basis exists, including consent where required. You may withdraw consent at any time.

4. Recipients and service providers

Your data may be disclosed or made accessible, where necessary, to:

DKV Seguros y Reaseguros, S.A.E. and authorised entities involved in the requested insurance process.
Technology, hosting, CRM, email, cybersecurity and website maintenance providers acting as processors.
Professional advisers and service providers where necessary for the requested service.
Public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required.

The Website and related business operations may use technology providers including GoDaddy and WordPress-related infrastructure for hosting and website operation, Cloudflare for security and traffic protection, Zoho for CRM, forms and business workflows, Microsoft 365 for email and productivity, Google services and MonsterInsights for consent-based analytics, Calendly for appointment scheduling where applicable, and ElevenLabs where the Claire AI virtual assistant is made available. Depending on the service and legal role, these providers may act as processors or independent service providers. Where a provider or subprocessor involves an international transfer of personal data, the transfer will be carried out using a mechanism permitted by the GDPR, such as an adequacy decision, Standard Contractual Clauses or another legally valid safeguard, as applicable.

5. Artificial intelligence assistant and retention

Where the Claire AI virtual assistant is available, it is used for initial assistance, enquiry classification and follow-up routing. Claire identifies itself as an AI system and does not replace professional review by an insurance or legal professional. Under the current configuration, voice audio is not retained by the AI agent. Conversation transcripts and associated conversation data may be retained for up to 90 days for enquiry management, quality control and traceability. Information necessary to handle the enquiry may also be transferred to the relevant business systems, including Zoho CRM.

BR PROTECTIA SL does not use Claire to make solely automated decisions that produce legal effects or similarly significantly affect an individual. Relevant insurance or professional decisions remain subject to human review.

6. Retention periods

Enquiries that do not result in a contractual relationship will generally be retained for up to 12 months after the last relevant interaction, unless a longer period is necessary to deal with a complaint, establish or defend legal claims, or comply with a legal obligation.

Data relating to an insurance mediation or contractual relationship will be retained for the periods required by applicable insurance, commercial, tax, anti-fraud and other legal obligations and, where relevant, for the limitation periods applicable to potential claims.

Data processed for commercial communications will be retained until consent is withdrawn or the user objects, without prejudice to the minimum evidence that may be retained to demonstrate the withdrawal or objection.

7. Your rights

You may exercise, where applicable, your rights of access, rectification, erasure, restriction of processing, objection and data portability, and you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent to carlosblanco@insuranceforexpat.es. We may request reasonable information to verify your identity before processing a rights request.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe that the processing of your personal data infringes applicable law.

8. Security

BR PROTECTIA SL applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, disclosure or destruction, taking into account the nature, scope and risks of the processing.

9. Cookies and analytics

The Website may use necessary cookies and, only where permitted by your choices, analytics or other non-essential technologies. You can find detailed information and change your preferences in the Cookie Policy and cookie settings.

10. Changes to this Privacy Policy

This Privacy Policy may be updated when the Website, providers or applicable law change. The version published on this page is the current version.