Information Notice on the Processing of Personal Data

In accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “EU Regulation 2016/679” or “GDPR”), applicable as of 25 May 2018, Colonnade Insurance S.A. Luxembourg – Bucharest Branch, having its registered office at Buzesti Street, No. 82-94, 10 Floor, District 1, Bucharest, Romania, registered with the Trade Registry Office attached to the Bucharest Tribunal under no. J2017017214403, Unique Registration Code 38335135, European Unique Identifier (EUID): ROONRC.J2017017214403, a company authorised by the Financial Supervisory Authority to provide insurance services in Romania under the right of establishment, having registration code in the ASF Register of “Insurers and Intermediaries from the EEA” RX-3676, telephone +4021 300 96 21, fax +4021 300 96 36, e-mail: office@colonnade.ro, hereby informs you about the processing of personal data in connection with the conclusion of an insurance policy or in relation to a claim file.

Through this “Information Notice on the Processing of Personal Data”, we hereby inform you about how your personal data (“Personal Data”) is collected, used and disclosed by Colonnade Insurance S.A. Luxembourg – Bucharest Branch. We also explain how you can access and update your Personal Data and exercise certain choices regarding the manner in which your Personal Data is used by Colonnade Insurance S.A. Luxembourg – Bucharest Branch.

For the purpose of taking steps towards entering into or performing the insurance policy, the personal data collected and processed by Colonnade Insurance S.A. Luxembourg – Bucharest Branch will include, but will not be limited to, your identification data, such as your first and last name, address, personal identification number, telephone number, e-mail address and, where applicable, health-related data.

Consequently, Colonnade Insurance S.A. Luxembourg– Bucharest Branch will not be able to conclude the insurance policy you have requested without processing your personal data, nor will it be able to perform the insurance contract to which you are or will become a party, including, but not limited to, the payment of indemnities in the event of an insured risk occurring.

Any subsequent processing for statistical purposes will be carried out in compliance with the principle of data minimisation and, to the extent possible, will exclude the processing of personal data. Such processing will involve aggregated data that is not used to support any measures or decisions concerning a specific individual.

For clarity, this Notice provides important information regarding the following areas:

the types of personal data we process;
the use of personal data;
the disclosure of personal data;
the retention of personal data;
the storage and/or transfer of personal data;
access to personal data;
information regarding the disclosure and use of personal data;
changes to this Notice;
our contact details.

The personal data we collect from you and how we collect them

For the purpose of entering into and performing the insurance contract with Colonnade Insurance S.A. Luxembourg – Bucharest Branch, or for processing a claim in which you are involved, the following personal data may be processed:

Identification personal data. This includes any information you provide to us, such as your first and last name, postal address, personal identification number, identity card series and number, as well as the date of issue and expiry of the identity card.

This data is generally necessary for the conclusion of insurance policies issued by us or for the performance of the contractual relationship between us and you.

Contact personal data. This includes: postal address, telephone number, and e-mail address.

Personal data falling within the category of sensitive data. In the event of an insured risk occurring, we process personal data relating to your health status prior to the conclusion of the insurance policy, as it is related to the occurrence of the insured risk, namely physiological and/or pathological conditions, medical examinations and tests performed, treatments administered, and therapies prescribed by physicians for the purpose of the medical assessment of a claim.

This data may be collected directly from you, as well as from healthcare service providers or other persons with whom you have a relationship. In such cases, we will request your consent for this processing.

Personal data relating to education and professional experience (education and training history, qualifications, certifications).

Personal data relating to the business activities carried out by an individual (occupation, position, professional history, goods or services provided).

Data relating to assets owned (data concerning the property or insured asset owned by an individual, which is the subject of the insurance).

Personal data arising from your relationship with Colonnade Insurance S.A. Luxembourg – Bucharest Branch. This includes records of your telephone conversations with our call centres or information relating to you (primarily in connection with the occurrence of insured risks) that you choose to provide to us through our websites.

IP addresses and cookies. In addition to the information indicated above, we may also collect the following information, depending on the circumstances:

The way you interact with our website, our applications, or advertisements promoted by us (for example, information about how and when you access our website or which device you use to access the website);
Information provided when you complete forms or questionnaires;
The content of messages sent through messaging systems or by e-mail;
Your interactions with us on social media platforms (for example, likes, shares, and comments);
Information that we collect about you from other companies within the Group or from third parties that have obtained your consent or have another legal right to share such information with us (including publishing or advertising partners/platforms and data aggregators that have obtained such right).
We may collect data through cookies or other similar technologies, such as: IP address; web browser; operating systems; location (city/town); and the web pages you access on our website.

We will process this data primarily in connection with the performance of our insurance contracts and, on a secondary basis, to improve the quality of our services and ensure the functionality of our communication platforms with customers. This data consists of statistical information about the actions and browsing patterns of our users and does not directly identify any individual.

For the same reason, we may obtain information about your use of the internet in general by using a cookie file that is stored on your computer’s hard drive. Cookies contain information that is transferred to your computer’s hard drive. When you revisit the website, our computer server will recognize the cookie, providing us with information about your previous visit. They enable us to:

to estimate the size of our audience and how they use our website;
to store information about your preferences, enabling us to personalize the website according to your individual interests and make your use of the website as engaging as possible; and
to speed up your searches.

You can refuse to accept cookies by activating the setting in your browser that allows you to reject cookies. However, if you select this setting, you may not be able to access certain parts of the website. Unless you have adjusted your browser settings to reject cookies, our system will issue cookies when you access the website.

Profiling: The controller may use automated decision processes based on data provided by the data subject and/or her/his representative (e.g. insured, claimant, legal representative, financial intermediary, …) and using customer profiling. Algorithms of the controller take into account a variety of factors such as data subject demographics (e.g. age), current risk trends related to specific insurance coverages, claim history, cookies and others. These automated processes can be used in the following contexts:

assessment of insurance risk, which may affect the scope of the offered product, the amount of premium or the refusal to conclude an insurance contract;
addressing the data subject through direct marketing or another sales channel and offering her/him an insurance product or service;
payment of compensation in certain types of claims, with regards to their approval and amount of indemnity paid;
compliance with international sanctions that may affect the possibility of concluding an insurance contract or payments of claims.

The data subject and/or her/his representative has the right, among others, to contact the controller and require a justification for an automated decision or to challenge such a decision.

Personal data of other individuals

There are situations in which you provide us with the personal data of other individuals, either for the purpose of entering into an insurance contract or in connection with the performance of the insurance contract. We also understand that the insurance policy you purchase may cover risks to which minor children are exposed. In general, the personal data of these individuals will be limited to the data indicated in Section 1 above. We reserve the right to request additional information from you regarding the personal data you provide in relation to other individuals, particularly where the personal data concerns minor children. We will make such requests only in limited circumstances and solely for the purpose of ensuring that the personal data provided by you has been disclosed in compliance with the applicable legal requirements.

Please ensure that, where, for the purpose of performing the insurance contract, you provide us with the personal data of another individual, you forward this Notice to that person so that they are properly and fully informed about our processing of their personal data, the purposes and legal grounds for such processing, as well as their rights in relation to our processing of their personal data.

Given that we do not have a direct relationship with these individuals and, in order not to interfere with their right to privacy, as well as considering the significant efforts that would be required to provide such notices directly to them, we will not attempt to contact these individuals directly and will not request additional information about them solely for the purpose of providing them with this Notice.

However, if you provide us with the e-mail addresses of these individuals in connection with the issuance of insurance policies for them, we will send this Notice directly to them.

For information regarding the processing of personal data by us, both you and the other individuals whose personal data you provide to us may access our website at https://www.colonnade.ro/ or request a copy of this Notice by writing to us at dpo@colonnade.ro or at our postal address at Buzesti Street, No. 82-94, 10 Floor, District 1, Bucharest, Romania, or by contacting us by telephone at: +40 21 300 96 21 or by fax at: +40 21 300 96 36.

1. Obtaining your personal data from other individuals

We will obtain your personal data directly from you; however, we may also obtain it from third-party sources, including publicly available sources, in the situations described in this section or when carrying out certain checks concerning you, as described in this Notice. We may receive your personal data from other individuals in connection with the issuance of an insurance policy.

We will receive your personal data from your employers or from the insurance intermediaries we work with, where you have taken out a group insurance policy or through insurance brokers or other intermediaries.

In other situations, where you are an injured party and are entitled to compensation under existing insurance policies held by our clients, such as liability, property, or construction/erection insurance policies, we will obtain your personal data from companies with which you have certain relationships that have led to the occurrence of the insured risk.

In the case of insurance policies that include a health component, such as travel insurance, or in the case of liability insurance policies, we may also receive your personal data from healthcare service providers where the insured risks include aspects relating to your health, but only with your explicit consent and in limited circumstances. In the latter case, our preference is to request such data directly from you.

2. The purpose of processing your personal data

Your personal data is processed by Colonnade Insurance S.A. Luxembourg – Bucharest Branch for the following purposes:

Purposes of processing your personal data	Legal basis for processing
Entering into and performing the insurance contract and related operations, which may include, but are not limited to, preparing quotations, calculating insurance premiums, risk management, preparing and submitting offers, issuing insurance policies, administering insurance policies, identifying you as a customer of Colonnade Insurance S.A. Luxembourg – Bucharest Branch, assessing and settling claims, determining the amount of compensation, and exercising rights of recourse (where applicable). For these purposes, we will use personal data comprising all types of data indicated in Section 1 above.	Fulfilment of our legal obligations (ASF Norm No. 22/2021 on insurance distribution; Law No. 190/2018 on measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC; the General Data Protection Regulation, Article 6(1)(a), (b), (c) and (e)); the insurance contract to which you are a party, which you request to enter into, or under which you submit a claim for compensation, or, as applicable, Colonnade Insurance S.A. Luxembourg – Bucharest Branch’s contractual obligation to ensure that any compensation is duly justified or, at least with regard to information concerning your health status, your consent.
Fulfilment of legal obligations and requirements imposed by public authorities, which include, for example, carrying out customer due diligence procedures and screening customers against international sanctions lists. For these purposes, we will primarily use personal data consisting of identification and contact details; however, we cannot exclude the possibility that it may become necessary to provide other types of data as well.	Fulfilment of our legal obligations (Regulation No. 13/2019 on establishing measures to prevent and combat money laundering and terrorist financing through the financial sectors supervised by the Financial Supervisory Authority; Regulation No. 3/2025 on the supervision of the implementation of international sanctions by entities regulated by the Financial Supervisory Authority; Government Emergency Ordinance No. 202/2008 on the implementation of international sanctions; the General Data Protection Regulation, Article 6(1)(c)).
To respond to your requests, complaints, and suggestions. For these purposes, we will primarily use personal data consisting of your identification and contact details.	Fulfilment of our contractual and legal obligations (Norm No. 18/2017 on the procedure for resolving petitions concerning the activities of insurance and reinsurance companies and insurance brokers; the General Data Protection Regulation, Article 6(1)(b), (c) and (f)).
Conducting internal reporting and analyses (at Colonnade Insurance S.A. Luxembourg–Bucharest Branch level and at the level of the group of companies to which we belong), conducting statistical/actuarial analyses, including those necessary for the development of new products, assessing the reliability of existing products, analysing how we interact with our customers, or improving the quality of our services. For these purposes, we will use personal data comprising all types of data indicated in Section 1 above.	Fulfilment of our contractual and legal obligations (Law No. 236/2018 on insurance distribution; the General Data Protection Regulation, Article 6(1)(f)) to conduct our business efficiently and effectively, as well as to develop similar products and services and maintain our relationship with our customers.
Conducting checks and monitoring in relation to you and the contracts concluded with you, as well as detecting and preventing fraud. For these purposes, we will use personal data comprising all types of data indicated in Section 1 above.	Fulfilment of our contractual and legal obligations (Law No. 78/2000 on preventing, detecting and sanctioning acts of corruption), to ensure that any compensation is awarded to you on a justified basis and to prevent fraud and unjustified payments in claims files.
Resolution of potential litigation or disputes generally relating to our contractual relationship, as well as the recovery of amounts owed to us by you. For these purposes, we will use personal data comprising all types of data indicated in Section 1 above.	Fulfilment of our contractual and legal obligations to protect our business interests (Norm No. 18/2017 on the procedure for resolving petitions concerning the activities of insurance and reinsurance companies and insurance brokers).
Improving the speed and quality of preparing commercial offers and insurance policy quotations, as well as administrative and claims management services, through the use of the latest technologies and solutions, including those based on Artificial Intelligence – based on the legal ground set out in Article 6(1)(f) of the GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the controller.	The controller’s legitimate interest consists in exercising its right to conduct its business activities in the most efficient manner, in order to remain competitive and provide customers with fast, high-quality services at attractive prices.

3. Disclosure of your personal data

Our service providers. These are external companies that support us in carrying out our business activities (e.g., selling our insurance products, registering insurance policies, processing payments, fraud detection and identity verification, website operation, support services, promotions, website development, etc.).

We will allow our service providers and selected members of their personnel to access and use your personal data on behalf of and for the account of Colonnade Insurance S.A. Luxembourg – Bucharest Branch only in connection with activities aimed at achieving the purposes specified in this Notice. They will act solely on the basis of written agreements and our instructions, while ensuring the confidentiality and security of your personal data.

Among the external companies to which we may disclose your personal data in the course of our business activities are brokers and, in general, insurance intermediaries involved in the administration of your insurance contracts; companies providing software applications and IT services; providers of premium calculation services; claims adjusters and claims management companies; other insurance companies; reinsurance companies; archiving companies; courier companies; public or private medical institutions and clinics and, in general, companies providing care and support to injured persons; debt collection companies; payment processors; call centre and insurance assistance companies; other support service providers in the insurance sector; as well as other companies in connection with the purposes specified in this Notice (which may include lawyers, auditors and, in general, consultants, translation agencies, valuation experts, and various other service providers).

Companies within the Fairfax Group. As we are part of an international group of companies, on certain occasions, in connection with carrying out our activities for the purposes specified in this Notice, we may also disclose your personal data to various entities within the Fairfax Group that perform specific activities for us or centralize certain information regarding our business activities.

We will do so either to benefit from services meeting the quality standards of our Group, with which you are already familiar, or for various internal purposes related to the analysis of our products and business activities, the development of new products, or the performance of statistical/actuarial analyses.

Public authorities and other entities. Your personal data may be transferred to public institutions and authorities (including tax authorities, consumer protection authorities, insurance regulatory authorities or, more generally, financial regulatory authorities, criminal investigation bodies, courts of law or arbitration tribunals, and bailiffs) or industry associations (i) where this is required by applicable legislation and (ii) in response to specific legal proceedings.

Legal successors. If Colonnade Insurance S.A. Luxembourg – Bucharest Branch, or its assets, are acquired by or merged with another company, we will share your personal data with any of our legal successors.

Sale and purchase procedures or other similar transactions concerning the shares/interests in Colonnade Insurance S.A. Luxembourg – Bucharest Branch. Your personal data may be disclosed to third parties in connection with potential sale and purchase procedures or other similar transactions concerning the shares/interests in Colonnade Insurance S.A. Luxembourg – Bucharest Branch, to the extent necessary for conducting the legal due diligence and other relevant legal analyses concerning the activities of Colonnade Insurance S.A. Luxembourg – Bucharest Branch as part of such procedures.

4. Retention of your personal data

Colonnade Insurance S.A. Luxembourg – Bucharest Branch, take all reasonable measures to ensure that personal data is processed only for the minimum period necessary for the purposes set out in this Notice. We will retain your personal data in an identifiable format only for as long as the personal data is necessary in connection with the purposes set out in this Notice and there is a valid legal basis for its processing (for a maximum period of 10 years from the end of the processing purpose).

With regard to the retention period for personal data, we will retain your data for the duration of the insurance contract and for a certain period of time after the termination of the insurance contract, determined on a case-by-case basis depending on the requirements for the performance of the contract. We will not retain your personal data for longer than the applicable statutory or limitation periods.

In the event of any complaints, disputes, or challenges of any kind, we may continue to process your personal data for the additional period necessary in connection with the relevant complaint, dispute, or challenge.

5. Disclosure, storage and/or transfer of your personal data

Security - We place particular emphasis on the security of our systems and the personal data stored in them. We have a dedicated team that oversees the security and use of personal data, and we continuously monitor the security of our data traffic.

In the event of an unforeseen incident, we take immediate measures to remedy any data breaches, in accordance with the applicable legal requirements. We also report incidents to the Supervisory Authority and, where required, to you.

Confidentiality - All our employees, authorised representatives and partners have signed a confidentiality agreement. We treat the data entrusted to us with due care, and only authorised personnel may access and process your personal data.

We use appropriate measures (described below) to maintain the confidentiality and security of your personal data. However, please be aware that these protective measures do not apply to information that you choose to make publicly available, such as on third-party social media platforms.

Limitation of the personal data processed. In accordance with the principle of data minimisation, we will process only those personal data that are strictly necessary for our purposes. We will also periodically review the personal data we process to ensure compliance with this principle.

Persons who may access your personal data. Your personal data will be processed by our authorised personnel or representatives only to the extent that they need to know such data, depending on the specific purposes for which your personal data was collected (e.g., our customer service personnel will have access to your records). We will periodically review our personnel’s access rights to personal data.

Technical and organisational measures. We will implement appropriate measures to enable us to respond appropriately to requests you submit to exercise your rights.

Measures implemented in our operating environments. We store your personal data in operating environments that use reasonable security measures to prevent unauthorised access. We adhere to reasonable standards for protecting personal data. Unfortunately, the transmission of information via the internet is not always completely secure and, although we will use all reasonable efforts to protect your personal data, we cannot guarantee the security of data while it is being transmitted through our websites/applications.

Transfer of your personal data. The processing of your personal data, as described above, may ultimately require the transfer/transmission of your personal data to and/or the storage of such data at a location (other Colonnade entities) outside your country of residence, particularly in EU Member States (e.g., Luxembourg, Slovakia, Hungary), where requirements for the protection of your personal data apply at the same level as those in Romania.

Transfer of personal data to third countries: The Controller may transfer certain personal data between the European Union (“EU”) and countries outside the EU. Such transfers are subject to the rules set out in the EU Standard Contractual Clauses (“SCCs”) or are carried out on the basis of an adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR, or on the basis of the EU-U.S. Data Privacy Framework.

We may also, in the future, transfer your personal data to countries outside the European Economic Area (“EEA”) (e.g., to other Colonnade entities or entities within the Fairfax Group), including countries that have different data protection standards from those applicable within the EEA.

In this regard, we will take the necessary measures to ensure that the transfer of your personal data is carried out in accordance with applicable laws and that an adequate level of security for your personal data is ensured

Among the measures required by applicable law in relation to international transfers of your personal data, (i) we will implement the standard contractual clauses approved by the European Commission for the protection of your personal data (and you have the right to request a copy of these clauses from us by contacting us in the manner specified below); or (ii) we will transfer your personal data to jurisdictions for which the European Commission has adopted an adequacy decision concerning the personal data protection framework; or (iii) we will implement binding corporate rules approved by a supervisory authority in the European Union, establishing appropriate safeguards and measures regarding the transfer of personal data; or (iv) where applicable, we will request your explicit consent.

6. Your rights as a Data Subject

Pursuant to the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, you have the following rights:

Right to be informed (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Articles 13 and 14):

You have the right to be informed about the processing of your personal data by Colonnade Insurance S.A. Luxembourg – Bucharest Branch;
You have the right to request information regarding the source of your personal data where such data has not been collected directly from you;
In the case of any automated processing of your personal data that produces legal effects or similarly significantly affects you, you have the right to request information about the existence of such processing, an explanation of the logic involved, and, where applicable, the significance and any envisaged consequences of such processing; in such cases, you have the right not to be subject to a decision based solely on automated processing.

Right of access (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Article 15): you have the right to request access to, or copies of, the personal data processed by us or on our behalf, and the right to receive your personal data in a structured, commonly used and machine-readable format, which you may transmit to another controller.
Right to rectification of data (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Article 16): you have the right to obtain the rectification, updating, or erasure of incomplete or inaccurate data.
Right to withdraw your consent (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Article 7): where we process your personal data based on your consent, you may withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to object (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Article 21): you have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f), including profiling based on those provisions.
Right to restriction of processing (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Articles 18 and 19): you have the right to request that the processing of your personal data be restricted to certain limited purposes, in accordance with the law.
Right to data portability (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Article 20): you have the right to data portability, meaning the right to have your personal data transferred to another data controller designated by you.
Right to erasure (“right to be forgotten”) (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, Article 17): you have the right to have your personal data erased in certain circumstances (e.g., where the personal data is no longer necessary for the purposes for which it was collected or processed).
Right to lodge a complaint with the supervisory authorities: you have the right to lodge complaints regarding the processing of your personal data with the National Supervisory Authority for Personal Data Processing, at B-dul G-ral Gheorghe Magheru No. 28-30, Sector 1, postal code 010336, Bucharest, Romania, e-mail anspdcp@dataprotection.ro , tel. +40318059211 sau +40318059212, fax +40318059602) and/or address to the competent courts in the event of a violation of any of your rights.

In case of any questions or provide comments regarding this “Personal Data Processing Notice” and our privacy practices, or to submit a complaint concerning Colonnade Insurance S.A. Luxembourg – Bucharest Branch’s failure to comply with applicable privacy legislation, please contact us:

in writing at the following postal address: Buzesti Street, No.82-94, 10 Floor, District 1, Bucharest, Romania, or
by phone at: +40 21 300 96 21 or by e-mail at: office@colonnade.ro.

You may also contact the Colonnade Insurance S.A. Luxembourg – Bucharest Branch’s Data Protection Officer (DPO), by e-mail to: dpo@colonnade.ro or in written at: Buzesti Street, No. 82-94, 10 Floor, District 1, Bucharest, Romania.

We will acknowledge and investigate any complaint concerning the manner in which Colonnade Insurance S.A. Luxembourg – Bucharest Branch handles personal data (including any complaint regarding Colonnade Insurance S.A. Luxembourg – Bucharest Branch’s violation of your rights under applicable data protection legislation).

The Insurer shall not be deemed to provide cover and The Insurer shall not be liable to pay any claim or provide any benefit hereunder to the extent that the provision of such cover, payment of such claim or provision of such benefit would expose The Insurer to any sanction, prohibition or restriction under United Nations’ resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom, United States of America, Canada, Luxembourg and/or Romania.

This “Information Notice on the processing of personal data” was last updated on 6 April 2026.