Legal notice WhatsApp

Due to the exceptional situation ongoing in Spain as a result of the health crisis and the measures decreed with the state of alarm, aimed at containing the spread of the COVID-19 coronavirus, DKV has approved a set of extraordinary measures to help citizens, whether or not they are customers of DKV.

One of these measures was the implementation of a temporary WhatsApp assistance channel, as a way to carry out basic procedures that cannot be carried out at the moment through our network of branches, which are closed to ensure the health of our employees and customers.

When you use this channel, you will receive a welcome message and some initial information on your privacy rights, in accordance with European and Spanish data protection regulations. At the end of this message, you will find a link to more information that you may want to consult.

Limitations of this channel

Our terms and conditions for using WhatsApp will at no time replace or go against our privacy and cookies policy, indicated in this link, whereby the latter prevails in the event of any apparent contradiction. You can see the links to these on this page https://www.whatsapp.com/legal.

We remind you that in order to carry out these procedures, you must be of legal age for health-related matters, which is 18 years old. You also need to verify your identity using your ID number (DNI or NIE).

Furthermore, this channel is ONLY used to carry out basic procedures, i.e. administrative steps that contain no information that is specially protected, such as state of health, political ideology, religion, etc., given that DKV cannot guarantee that the security of WhatsApp is upheld at all times, as they indicate in their privacy policy, or that it meets the minimum standards that our customers deserve. To manage medical information with a total security guarantee, you can use the usual telephone assistance channels through our call centre, our apps or the private customer area, which you will be redirected to as soon as this is relevant.

We also ask you to refrain from attaching audio notes or videos with or without audio, or making video calls. We will not manage them through this channel and they will be deleted automatically. Image and voice are considered biometric data, and are therefore specially protected by the General Data Protection Regulation of May 2018.

Similarly, avoid attaching images if they contain health information, such as diagnostic tests, authorisations, medical reports, etc., unless we ask for them first, and particularly if the data corresponds to minors or non-customers, as in both cases the images will be deleted.

If you send a text message to telephone numbers published by DKV to speak with you through WhatsApp, this message will automatically arrive at the WhatsApp platform and will be stored there, even if we respond by text message.

We remind you that no one at DKV will ask you use this channel at any time to ask for information such as your username and password to access the customer area, other DKV websites or any apps you have downloaded. Never provide this information through this channel or any other channel. If this happens, please contact our Data Protection Officer at dpogrupodkv@dkvseguros.es

Who is the Controller?

Firstly, we would like to remind you that if you use the WhatsApp messaging service it is because you have accepted its privacy policy, and only you and WhatsApp Inc. are responsible for the current or future way in which WhatsApp uses your information, exonerating the DKV Seguros group at all times.

Here is the link to the policy you have accepted https://www.whatsapp.com/legal.

For this specific service, the data controller for your data shared through WhatsApp is:

• DKV Seguros y Reaseguros SAE (hereinafter, DKV)
  with Tax ID No. A50004209
  and domiciled at: (Torre DKV) avenida de María Zambrano 31, 50018 Zaragoza
  Useful information: https://eng.dkvseguros.com/informacion-corporativa/informe-corporativo
  Data Protection Officer (DPO): at the address indicated or by emailing dpogrupodkv@dkvseguros.es

For what purpose will my data be used?

The main purpose for which we request your identification details is to verify that your are a DKV customer and that you are who you say you are.

If you are not insured with us, we will classify you as a new reference in our system, so that our employees and agents can answer your queries.  

We also need your basic contact details so that we can get in touch with you through other channels outside of WhatsApp. This is because, 24 hours after it is opened, WhatsApp may delete or disassociate the messages from the conversation thread, making it more difficult to handle the query through this channel.

We hereby remind you that this channel is ONLY used to carry out basic procedures, i.e. administrative steps that contain no information that is specially protected, such as state of health, political ideology, religion, etc., given that DKV cannot guarantee that the security of WhatsApp is upheld at all times, as they indicate in their privacy policy, or that it meets the minimum standards that our customers deserve. To manage medical information with a total security guarantee, you can use the usual telephone assistance channels through our call centre, our apps or the private customer area, which you will be redirected to as soon as this is relevant.

These are some of the procedures you can carry out through WhatsApp:

• Modification of personal details (apart from gender, age or province of residence)

• Medical directory consultation based on the location of the person concerned

• Enquire on beneficiaries of life insurance policies

• Enquire on branches and contact information

• Product enquiry

• Change of payment period

• Manage bill collections

• Exercise ARCO data rights (all apart from access and portability)

• Coverage information request

• Enquire on copayments (only amounts or speciality, not medical procedures)

• Request certificates

• Notify the death of an insured person

• Send complaints or claims

• Request to leave the company

Is it lawful for my data to be processed for these purposes?

We are enabling this channel according to article 6.1b of the GDPR, whereby it is necessary to process the basic contact details necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, and who want more information on our products, doctors or branches, whereby your consent to use this service is valid as you are using it proactively and have contacted us, in an exceptional situation in the country due to COVID-19.

Ruling No. E/01824/2019 that you can find at www.agpd.es lays out the approach we use.

In addition to legitimate grounds, whether you are a customer or not, we also need certain contact or transactional data generated from the activity with said customer to ensure that the security process of the information needed for the use of this provision is adhered to, based on the legitimate interest of the person responsible in this case.

To whom will you transfer my data?

The data you provide through the DKV WhatsApp channel will be managed by our network of branches and offices, and employees of the DKV Seguros group. Specifically, everything related to the provision of insurance coverage taken out with DKV will be managed by DKV Seguros; and by DKV Servicios if they refer to digital health services that complement the insurance offer you have taken out, such as Digital Doctor or the DKV Health and Well-being Club.

Our DKV Integralia Foundation call centre can provide certain customer services through this channel, depending on the volume of messages we receive, to provide the quickest response possible.

For certain procedures, you consent to your data, including health information if relevant, to be transferred to the authorised network of medical professionals and other healthcare professionals so that they can provide the cover you need at any time, both in person and virtually, if you use the telemedicine channels managed by DKV Servicios SA.

For certain tasks, it may be necessary to send your data to design, courier and printing companies to provide the information you need in a physical format.

Depending on the type of data management, if we are required to store it due to its legal nature, they will be communicated to our archiving company subcontracted in Zuera (Zaragoza), which will store said data under appropriate security measures.

At the technical level, the operator Twillio and the provider accredited by WhatsApp to manage this service to businesses, to provide support in the event of potential security, integrity and continuity incidents incurred in the platform's API, will have access to this platform.

DKV does not carry out international data transfers to third parties for the management of any of the tasks set up in WhatsApp. However, although the contact numbers to provide the service are Spanish (+34), the Twillio operator must have access to the information in its pre-production environment, acting as a gateway or intermediary.

What security measures are taken?

DKV Seguros takes the security measures due to process your data in the provision of this service, including by encrypting these conversations in transit and at rest. We also remind you that WhatsApp employs point-to-point encryption in all its conversations. Only a very limited team of specialists in your territorial area have access to the platform to attend to your requests and conversations. All these specialists have signed confidentiality and duty of secrecy agreements, which will endure even when you no longer use this channel or are no longer a customer of DKV, and the person who handles and manages your conversation will be monitored at all times.

The technical providers of the platform have been evaluated and approved on the basis of quality, security and privacy standards, having carried out a privacy impact assessment for this kind of basic queries.

Daily snapshots and copies of conversations are made, in case any content generated in previous conversations needs to be recovered or transferred to a party indicated by you.

Other general security measures are indicated in our privacy policy.

For how long?

WhatsApp will process contact information for the time period indicated in its privacy policy. To provide this service, DKV Seguros will store all conversations in full within its own WhatsApp platform, under suitable technical and organisational security measures, on the basis of the management process performed. If you are a DKV customer, our customer relationship management system will provide a link to these conversations associated with your customer file, which will be retained as long as you are a customer and for 10 years from the date of your cancellation.

For security reasons, in the DKV WhatsApp platform, the user will only have the conversation established by our platform active for a 24-hour period, after which this conversation will disappear from the previous thread and a new one will begin. In these cases, the handling process will continue through other channels that the company deems most suitable, such as email or over the phone, but not through other instant messaging platforms.

You can access all the general information on how long DKV stores your information in our generic privacy policy.

Where can I exercise my information rights?

You can access your rights of access, rectification, opposition to certain processing such as advertising, or the limitation of data to processes strictly required by law if you are no longer a DKV Seguros customer, or exercise your right to the portability or definitive erasure of data processed through our DKV WhatsApp platform. These rights are free to exercise, and can be accessed after identifying yourself with your full name and official identification document, by writing to the indicated address for the data controller, or by emailing our data protection officer at arco@dkvseguros.es

If you exercise them more than twice in a year we may be required to ask the reason or charge an administrative fee, which you would be informed of in advance.

We have one month to handle and resolve your query or up to three months if, due to technical reasons, it represents a disproportionate effort to handle it with the guarantees required, in which case we would inform you of this. If you are not satisfied, you can contact our Data Protection Officer at dpogrupodkv@dkvseguros.es or the Control Authority in Spain, the Agencia Español de Protección de Datos (Spanish Data Protection Agency), at www.agpd.es