PRIVACY NOTICE
(V. 4.0)

This Privacy Notice applies to the following categories of individuals under the Company’s sales and distribution functions, regardless of whether their relationship with the Company is active or terminated. This includes insurance agent applicants; agents including agency leaders at all levels; participants in sales-related activities, training, or programs; and other individuals associated with the Company’s agency or distribution channels.

This section provides details on how the Company processes Personal Data relating to such individuals, including the processing and protection of Personal Data throughout the lifecycle of the agency relationship, from recruitment and onboarding to performance management and post-termination.

This Privacy Notice applies to the following categories of individuals within the Company’s personnel and workforce functions, regardless of whether their relationship with the Company is active or terminated. This includes job applicants and candidates; employees (including all employment types); temporary staff, interns, and outsourced personnel; directors and individual shareholders; and dependents, beneficiaries, emergency contacts, referees, guarantors, and other related individuals.

This section provides details on how the Company processes Personal Data relating to such individuals, including the processing and protection of Personal Data throughout the employment lifecycle, from recruitment and engagement to employment management and post-termination.

This Privacy Notice applies to the following categories of individuals and entities interacting with the Company, regardless of whether their relationship with the Company is active or terminated. This includes vendors, suppliers, and service providers; consultants, contractors, and outsourced personnel; business partners and counterparties; directors, employees, representatives, and authorized persons of such entities; and external contacts engaging or interacting with the Company, including through Human Resources, Procurement, Administration, or other business functions.

This section outlines how the Company processes Personal Data relating to such individuals, including the processing and protection of Personal Data throughout the business relationship lifecycle, from initial engagement and contractual arrangements to ongoing service delivery, operational interactions, and post‑relationship management.

This Privacy Notice applies to the following categories of individuals in connection with the Company’s insurance and related services, regardless of whether their relationship with the Company is active or terminated. This includes prospective customers applying for insurance products or services; policy owners, policyholders, insured persons, payors, beneficiaries, and group insurance members; former customers whose policies have lapsed or terminated; and any other individuals who interact with the Company in relation to insurance products or services.

This section describes how the Company processes and safeguards Personal Data relating to customers throughout the lifecycle of the customer relationship, from pre-contractual stage to post-termination.

1. CATEGORIES OF GENERAL PERSONAL DATA
The Company may collect and process the following categories of Personal Data (including but not limited to):

• A. Identification and Contact Data
  • name, surname, identification number or passport details, date of birth, age, gender, marital status, signature.
  • contact details such as telephone number, address, and email.
• B. Agency, Contract, and Licensing Data
  • ­contract and appointment details;
  • licensing and regulatory information (e.g. OIC, SEC);
  • professional licenses and certifications.
• C. Financial and Tax Data
  • ­ income, commissions, and benefits;
  • ­ bank account details and tax information;
  • ­ financial statements and related records.
• D. Compliance and Risk Data
  • ­ AML/CTF screening and regulatory status;
  • ­ bankruptcy and legal records;
  • ­ fraud monitoring, risk assessment, and litigation records.
• E. Education and Training Data
  • ­ educational background and qualifications;
  • ­ training participation, results, and certifications.
• F. Marketing and Recognition Data
  • ­ participation in campaigns and incentive programs;
  • ­ rankings, classifications, and related media (photos, videos).
• G. Operational and Performance Data
  • ­ performance metrics and evaluations;
  • ­ ­disciplinary records, complaints, and audit findings.
• H. Technical and System Data
  • ­ system logs, IP address, device and network data;
  • ­ usage data relating to systems, applications, and platforms.
    
    Such data may be processed using automated systems, analytics tools, or Artificial Intelligence (AI) for purposes such as fraud detection, risk assessment, cybersecurity, and operational efficiency, subject to appropriate safeguards and human oversight.
     
• I. Communication Data
  • ­ emails, calls, messages, and meeting records;
  • ­ interaction logs with Company systems and personnel.
• J. Third-Party Data
  • ­ data from regulators, business partners, other agents, and public sources;
  • ­ data used for risk assessment and fraud monitoring.
• K. Employment-related Data
  • ­ job title, work contact details, and employer information (if applicable).
• L. Juristic Person–Related Data
  • ­ company registration, shareholder, and authorized representative data.
• M. Other Data
  • ­ CCTV recordings;
  • ­ call recordings and system interaction data.

2. SENSITIVE PERSONAL DATA
The Company may collect and process Sensitive Personal Data such as:

• ­ biometric data (e.g. facial recognition);
• ­ criminal records;
• ­ health-related information required for compliance or verification.

1. CATEGORIES OF GENERAL PERSONAL DATA
The Company may collect and process the following categories of Personal Data (including but not limited to):

• A. Identification and Contact Data
  • ­ name, surname, identification details, date of birth, gender, marital status;
  • ­ contact details including address, telephone, email, and social media.
• B. Employment and HR Data
  • ­ job title, contract details, employment history;
  • ­ performance, disciplinary records, and evaluations.
• C. Financial, Tax, and Benefits Data
  • ­ salary, bank details, tax information;
  • ­ social security, provident funds, and benefits-related data.
• D. Education and Professional Data
  • ­ academic qualifications, training, certifications, and licenses.
• E. Operational and Work Activity Data
  • ­ attendance, working hours, leave records;
  • ­ system usage and internal activity logs.
• F. Technical and System Data
  • ­ IP address, device identifiers, login records, and network data.
• G. Recruitment Data
  • ­ CVs, interview assessments, references, and screening results.
• H. Third-Party Data
  • ­ data from recruitment agencies, regulators, and public sources.

2. SENSITIVE PERSONAL DATA
The Company may collect Sensitive Personal Data including:

• ­ health and medical information;
• ­ criminal and legal records;
• ­ biometric data for identification or security;
• ­ AML/CFT information and fraud-related data.

1. CATEGORIES OF GENERAL PERSONAL DATA
The Company may collect and process the following categories of Personal Data (including but not limited to):

• A. Identification and Contact Data
  • ­ name, surname, identification details, contact information, and signature.
• B. Business and Contract Data
  • ­ company affiliation, position, and contract details;
  • ­ scope of work, service history, and performance records.
• C. Financial and Tax Data
  • ­ bank account details, payment data, and tax information.
• D. Technical and System Data
  • ­ IP address, device information, and system logs;
  • ­ usage and access data relating to Company systems.
• E. Compliance and Risk Data
  • ­ AML/CFT status, bankruptcy records, fraud indicators;
  • ­ audit findings and litigation records.
• F. Professional Data
  • ­ qualifications, certifications, and licenses.
• G. Third-Party Data
  • ­ data from regulators, references, and public or commercial sources.

2. SENSITIVE PERSONAL DATA
The Company may process Sensitive Personal Data where necessary, including:

• ­ biometric or identity verification data;
• ­ criminal or legal records;
• ­ data required for regulatory compliance or security purposes.

1. CATEGORIES OF GENERAL PERSONAL DATA
The Company may collect and process the following categories of Personal Data (including but not limited to):

• A. Identification and Contact Data
  • ­ name, surname, identification number, passport details, date of birth, age, gender, marital status, nationality, signature, photograph 
  • ­ contact details such as telephone number, address, email address, and other
• B. Policy, Application, and Contract Data
  • ­ insurance application details, policy number, insured amount, type of insurance, riders, beneficiary details, policy status, policy history, customer profile, underwriting records, proposal forms, declarations, and any records relating to contractual relationships with the Company
• C. Financial and Payment Data
  • ­ bank account details, payment method, premium payment records, billing information, refund information, tax details, and other financial records relevant to insurance transactions or contractual
• D. Claims and Benefit Data
  • ­ claim submission details, claim forms, supporting evidence, claims history, payment records, investigation outcomes, and any information necessary for claim assessment, benefit administration, or dispute
• E. Compliance and Risk Data
  • ­ AML/CFT screening information, sanctions screening results, fraud indicators, suspicious activity records, bankruptcy information, litigation records, regulatory-related information, and any information required for legal or compliance purposes
• F. Technical and System Data
  • ­ IP address, login details, device identifiers, browser type, location information, cookie-related data, system usage logs, digital interaction records, and other data collected through the Company’s websites, applications, platforms, or online services. 
• G. Communication and Service Data
  • ­ all recordings, email correspondence, chat history, complaint records, inquiry history, customer service interaction records, and records of communications with agents, brokers, customer service personnel, or other representatives of the Company. 
• H. Third-Party and Related-Person Data
  • ­ information relating to beneficiaries, payors, dependents, group insurance members, family members, representatives, authorized persons, and any other persons connected with the insurance relationship, as well as data obtained from healthcare providers, agents, brokers, reinsurers, business partners, regulators, and publicly available sources.

2. SENSITIVE PERSONAL DATA
The Company may collect Sensitive Personal Data including:

• ­ health and underwriting data, including health declarations, medical history, medical reports, laboratory results, lifestyle information relevant to underwriting, details relating to physical or mental condition, hospitalization records, and other information necessary for underwriting, policy administration, or claims
• ­ biometric data used for identity verification (such as facial recognition)
• ­ criminal record information where permitted or required by law.

(A) DIRECT INTERACTIONS
When you communicate or interact with the Company through written, electronic, or verbal communications, regardless of who initiates the interaction, including when you access or interact with documents, systems, platforms, or links provided by the Company.

(B) THIRD-PARTY SOURCES
When Personal Data is obtained from third parties, including other sales representatives, business partners, service providers, industry associations, regulators (such as the OIC), publicly available sources, or other lawful commercial sources. Such collection may be carried out for purposes including contractual performance, regulatory compliance, supervision, or the Company’s legitimate interests.

(C) SECURITY AND PREMISES ACCESS
When you enter, exit, or remain within Company premises, where Personal Data may be collected through access control systems (e.g. access cards, passcodes, biometric systems) and CCTV recordings.

(D) RECRUITMENT AND ONBOARDING
When you apply to join or are engaged as part of the sales force, including during application, recruitment, onboarding, and contractual processes.

(E) DURING THE CONTRACTUAL LIFECYCLE
When Personal Data is collected or generated during the course of the contractual relationship to perform contractual obligations, comply with applicable laws, and provide services, benefits, or operational support.

(F) COMPENSATION AND FINANCIAL ADMINISTRATION
When Personal Data is processed to calculate commissions, compensation, benefits, and to comply with tax and legal obligations.

(G) OPERATIONAL AND BUSINESS INTERACTIONS
When you interact with the Company’s personnel or business partners, including through meetings, communications, or the use of systems and platforms.

(H) PERFORMANCE AND EVALUATION
When Personal Data is collected or generated for performance evaluation, including behavioral data, disciplinary records, and performance assessments.

(I) TRAINING AND DEVELOPMENT
When Personal Data is processed in connection with training programs, professional development, and licensing or certification requirements.

(J) BENEFITS AND BUSINESS ACTIVITIES
When Personal Data is processed for benefits administration, participation in campaigns, incentive programs, and other business or sales-related activities.

AUTOMATED PROCESSING

In certain circumstances, Personal Data collected through the above channels may be processed using automated systems, analytics tools, or Artificial Intelligence (AI) throughout the AI lifecycle, including for purposes such as performance analysis, fraud detection, system security, risk assessment, AI model development and training and operational efficiency.

The Company ensures that such processing is conducted in a lawful, fair, and transparent manner, with appropriate safeguards and human oversight, in accordance with applicable laws and regulatory requirements.

(A) DIRECT INTERACTIONS
When Personal Data is provided directly by you during recruitment, onboarding, employment, or other interactions with the Company, including applications, agreements, and communications.

(B) INTERNAL SYSTEMS AND TECHNOLOGIES
When Personal Data is generated through your use of the Company’s information technology systems, applications, networks, devices, and communication tools.

(C) AUTOMATED AND TECHNICAL COLLECTION
When Personal Data is automatically collected through digital platforms and security systems, including:

• ­ system logs and access records;
• ­ device, network, and communication data;
• ­ CCTV recordings and access control systems.

(D) THIRD-PARTY SOURCES
When Personal Data is obtained from third parties, including recruitment agencies, referees, regulators, business partners, and publicly available sources.

(E) DURING THE EMPLOYMENT LIFECYCLE
When Personal Data is collected and generated throughout the employment lifecycle, including:

• ­ recruitment and onboarding processes;
• ­ performance evaluations and disciplinary actions;
• ­ participation in training and development programs;
• ­ payroll processing, benefits administration, and HR management;
• ­ workplace access, attendance, and security monitoring;
• ­ health, safety, and insurance-related processes.

(A) DIRECT INTERACTIONS
When Personal Data is collected during contract negotiation, vendor onboarding, due diligence processes, and business communications or meetings.

(B) AUTOMATED AND TECHNICAL COLLECTION
When Personal Data is collected through the use of Company systems and facilities, including:

• ­ websites, applications, and IT systems;
• ­ device logs and communication systems;
• ­ CCTV recordings and access control systems within Company premises.

(C) THIRD-PARTY SOURCES
When Personal Data is obtained from third parties, including recruitment agencies, references, regulators, business partners, group companies, and publicly available or commercial sources.

(D) DURING THE CONTRACTUAL LIFECYCLE
When Personal Data is collected and generated in connection with contractual relationships and service arrangements, including:

• ­ contract execution and service delivery;
• ­ payment processing and tax compliance;
• ­ performance monitoring, audits, and risk assessments;
• ­ entry to and use of Company premises;
• ­ compliance with legal, regulatory, and health and safety requirements.

(A) DIRECT INTERACTIONS
When you communicate or interact with the Company through written, electronic, verbal, or face-to-face channels, including when you complete application forms, submit declarations, request quotes, purchase insurance, update policy details, submit claims, make payments, or contact customer service. 

(B) THROUGH AGENTS, BROKERS, AND INTERMEDIARIES
When Personal Data is provided to the Company through insurance agents, brokers, bancassurance partners, distribution channels, intermediaries, or other persons acting in connection with the offering or servicing of insurance products. 

(C) THIRD-PARTY SOURCES
When Personal Data is obtained from third parties, including regulators, government authorities, healthcare providers, hospitals, clinics, reinsurers, business partners, service providers, publicly available sources, and other lawful commercial or industry sources, for purposes such as underwriting, claims assessment, fraud detection, regulatory compliance, or contractual performance. 

(D) DIGITAL PLATFORMS AND AUTOMATED TECHNOLOGIES
When you access or use the Company’s websites, applications, online services, social media platforms, or services provided through third-party platforms, where Personal Data may be automatically collected through cookies, tracking technologies, logs, analytics tools, or other automated means. 

(E) DURING THE POLICY AND SERVICE LIFECYCLE
When Personal Data is collected or generated during the customer relationship, including during underwriting, policy issuance, premium collection, policy servicing, renewals, endorsements, claims handling, investigations, complaint handling, and post-termination administration. 

(F) SECURITY AND PREMISES ACCESS
When you enter, exit, or remain within Company premises, where Personal Data may be collected through access control systems and CCTV recordings for security and safety purposes.

AUTOMATED PROCESSING

In certain circumstances, Personal Data collected through the above channels may be processed using automated systems, analytics tools, or Artificial Intelligence (AI) throughout the AI lifecycle, including data preparation, model development, training, testing, and ongoing monitoring for purposes such as insurance operations, underwriting support, fraud detection, risk assessment, system security, service improvement, operational efficiency.

The Company ensures that such processing is conducted in a lawful, fair, and transparent manner, with appropriate safeguards and human oversight, in accordance with applicable laws and regulatory requirements.

(A) CORE BUSINESS AND CONTRACTUAL PURPOSES

• ­ recruitment, selection, and onboarding;
• ­ contract administration and relationship management;
• ­ compensation, commission payments, and benefits administration.

(B) TRAINING AND DEVELOPMENT

• ­ provision and management of training, certification, and licensing;
• ­ monitoring compliance with regulatory and licensing requirements.

(C) MARKETING AND ENGAGEMENT

• ­ marketing campaigns, promotional activities, and incentive programs;
• ­ public relations, branding, and communication activities.

(D) BUSINESS OPERATIONS

• ­ performance evaluation and management;
• ­ data analytics, reporting, and business intelligence;
• ­ organizational planning and internal management.

(E) LEGAL, RISK, AND COMPLIANCE

• ­ compliance with applicable laws and regulatory requirements (e.g. OIC, SEC);
• ­ AML, fraud detection, and risk monitoring;
• ­ audits, investigations, and enforcement activities;
• ­ establishment, exercise, or defense of legal claims.

(F) INFORMATION TECHNOLOGY, SECURITY AND AI

• ­ system access management and authentication controls;
• ­ cybersecurity monitoring and incident prevention;
• ­ operation and improvement of IT systems and infrastructure.
• ­ AI model development, training, testing, and improvement to enhance the Company’s operational capabilities and service delivery, subject to appropriate data minimization and safeguards.

(A) HUMAN RESOURCE MANAGEMENT

• ­ recruitment, hiring, and onboarding;
• ­ employment administration and relationship management;
• ­ payroll, benefits administration, and tax compliance;
• ­ performance evaluation, promotions, and disciplinary actions;
• ­ training, licensing, and workforce development.

(B) WORKPLACE AND OPERATIONAL MANAGEMENT

• ­ communication, collaboration, and document management;
• ­ management of facilities, travel, and Company resources;
• ­ workforce planning and organizational restructuring;
• ­ IT system administration and business continuity;
• ­ internal audits, quality assurance, and operational improvement.

(C) LEGAL, RISK, AND COMPLIANCE 

• ­ compliance with laws, regulations, and supervisory requirements;
• ­ fraud prevention, investigations, and risk monitoring;
• ­ AML/CFT screening and regulatory reporting;
• ­ establishment, exercise, or defense of legal claims;
• ­ cooperation with regulatory and law enforcement authorities.

(D) INFORMATION TECHNOLOGY, SECURITY AND AI

• ­ system access control and monitoring;
• ­ cybersecurity and data protection;
• ­ AI model development, training, testing, and improvement for operational and HR management purposes, subject to appropriate data minimization and safeguards.
• ­ system operations and enhancements.

(A) VENDOR AND CONTRACT MANAGEMENT

• ­ onboarding, due diligence, and identity verification;
• ­ contract execution, administration, and termination;
• ­ performance monitoring and evaluation.

(B) PROCUREMENT AND BUSINESS OPERATIONS

• ­ purchasing, payment processing, and service coordination;
• ­ relationship management and communication;
• ­ business operations and transactions.

(C) ADMINISTRATION AND SUPPORT

• ­ document and communication management;
• ­ facility access and visitor management;
• ­ event participation and coordination.

(D) LEGAL, RISK, AND COMPLIANCE

• ­ compliance with laws and regulatory requirements;
• ­ accounting, tax, and audit obligations;
• ­ fraud prevention and risk management;
• ­ legal claims and dispute resolution;
• ­ cooperation with authorities and regulators.

(E) INFORMATION TECHNOLOGY, SECURITY AND AI

• ­ system access and monitoring;
• ­ cybersecurity and infrastructure management.
• ­ AI model development, training, testing, and improvement in connection with vendor management and operational activities, subject to appropriate data minimization and safeguards.

(A) INSURANCE AND CONTRACTUAL PURPOSES
for customer onboarding, pre-contractual assessment, underwriting, policy issuance, contract administration, premium collection, policy servicing, renewals, endorsements, claims handling, benefit payment, and performance of contractual obligations. 

(B) CUSTOMER SERVICE AND RELATIONSHIP MANAGEMENT
for responding to inquiries, handling complaints, providing support services, managing customer relationships, facilitating communications, and improving service quality and customer experience. 

(C) MEDICAL UNDERWRITING AND CLAIMS ASSESSMENT
for reviewing medical and non-medical underwriting factors, assessing insurability, verifying eligibility, processing claims, investigating claim circumstances, coordinating with healthcare providers, and administering insurance benefits. 

(D) MARKETING AND BUSINESS ENGAGEMENT
for marketing communications, product offers, promotional activities, customer segmentation, customer satisfaction surveys, analytics, and customer engagement activities, subject to applicable legal requirements and consent requirements where relevant. 

(E) BUSINESS OPERATIONS AND ANALYTICS
for internal reporting, product development, business analysis, service improvement, data analytics, operational planning, quality assurance, and internal business management. 

(F) LEGAL, REGULATORY, RISK, AND COMPLIANCE PURPOSES
for complying with applicable laws, regulations, and supervisory requirements, including those prescribed by the Office of Insurance Commission (“OIC”), Anti-Money Laundering laws, fraud prevention requirements, tax obligations, dispute handling, investigations, audits, risk monitoring, and the establishment, exercise, or defense of legal claims. 

(G) INFORMATION TECHNOLOGY, SECURITY AND AI
for system access control, authentication, cybersecurity monitoring, fraud detection, incident prevention, IT administration, business continuity, and the operation and improvement of the Company’s systems and infrastructure, including AI systems used in support of insurance operations. This may encompass the use of Personal Data for AI model development, training, testing, calibration, and ongoing monitoring to enhance the accuracy, reliability, and fairness of AI-supported services, subject to appropriate data minimization and safeguards.

(A) INTERNAL DISCLOSURES
Personal Data may be accessed or disclosed to authorized personnel within the Company on a need-to-know basis, in accordance with the Company’s organizational structure, including:

• ­ Agency and Sales Functions
  including agency leaders at all levels, and relevant personnel involved in distribution and service delivery;
• ­ Actuarial and Product Management Functions
  for product development, pricing, risk assessment, and business analysis;
• ­ Marketing and Customer Engagement Functions
  for campaigns, communications, and promotional activities;
• ­ Human Resources and Agency Management Functions
  including recruitment, onboarding, agency administration, and operational support;
• ­ Support and Control Functions
  including Information Technology, Finance, Legal, Compliance, Risk Management, and Internal Audit.

(B) EXTERNAL DISCLOSURES
The Company may disclose Personal Data to external parties, including:

• ­ Customers and Prospective Customers
  where relevant, in connection with service provision, customer relationship management, or business activities carried out by you as a representative of the Company;
• ­ Regulatory Authorities and Governmental Bodies
  including the OIC, SEC and other competent authorities;
• ­ Financial Institutions, Insurers, and Reinsurers
  for insurance operations, underwriting, and risk management;
• ­ Service Providers (Data Processors)
  including IT providers, cloud service providers, call centers, logistics providers, and other outsourced service providers;
• ­ Professional Advisors
  including legal counsel, auditors, consultants, and other professional service providers;
• ­ Business Partners and Counterparties
  including intermediaries, distributors, and contractual partners.

(A) INTERNAL DISCLOSURES
Personal Data may be disclosed within the Company on a need-to-know basis, including :

• ­ management and relevant departments responsible for human resources, operations, IT, finance, legal, compliance, risk management, and internal audit functions , as well as other relevant departments that need to access Personal Data for the performance of their duties and responsibilities.

(B) EXTERNAL DISCLOSURES
The Company may disclose Personal Data to external parties, including:

• ­ Affiliates and Group Companies
  for legitimate business and operational purposes;
• ­ Service Providers (Data Processors)
  including providers of HR, payroll, IT, cloud, analytics, data storage, recruitment, and call center services;
• ­ Regulatory Authorities and Government Agencies
  where required by applicable laws or regulations;
• ­ Professional Advisors
  including lawyers, auditors, consultants, and medical professionals;
• ­ Insurers, Industry Associations, and Labor Unions
  where applicable;
• ­ Business Partners and Counterparties
  in connection with business operations or transactions;
• ­ Other Parties
  where disclosure is based on your consent or otherwise permitted or required by applicable laws.

(A) INTERNAL DISCLOSURES
Personal Data may be disclosed within the Company on a need-to-know basis, including to relevant departments responsible for procurement, operations, IT, finance, legal, compliance, risk management, and internal audit.

(B) EXTERNAL DISCLOSURES
Personal Data may be disclosed to external parties, including:

• ­ Affiliates and Group Companies
  for business operations and coordination;
• ­ Service Providers (Data Processors)
  including IT providers, payment processors, logistics providers, and cloud service providers;
• ­ Business Partners and Counterparties
  in connection with contractual relationships and service delivery;
• ­ Regulatory Authorities and Government Agencies
  where required by law or regulation;
• ­ Professional Advisors
  including legal counsel, auditors, consultants, and other professional service providers;
• ­ Industry Bodies, Insurers, or Relevant Organizations
  where applicable;
• ­ Other Parties
  where disclosure is based on consent or otherwise permitted by law.

(A) INTERNAL DISCLOSURES
Personal Data may be accessed or disclosed to authorized personnel within the Company on a need-to-know basis, including personnel responsible for underwriting, claims, customer service, operations, finance, actuarial, product management, information technology, legal, compliance, risk management, internal audit, and management functions.

(B) EXTERNAL DISCLOSURES
The Company may disclose Personal Data to external parties, including:

• ­ insurance agents, brokers, intermediaries, and distribution partners, where relevant to the provision or servicing of insurance products
• ­ reinsurers, co-insurers, other insurers, and organizations within the insurance sector, for underwriting, claims, reinsurance, risk assessment, and operational purposes
• ­ service providers (Data Processors), including IT providers, cloud service providers, call centers, payment processors, printing and mailing service providers, document management providers, data analytics providers, and other outsourced service providers
• ­ hospitals, clinics, physicians, medical assessors, laboratories, and other healthcare or wellness service providers, where necessary for underwriting, claims assessment, or insurance benefit administration
• ­ regulatory authorities and government agencies, including the Office of Insurance Commission (“OIC”), courts, law enforcement agencies, tax authorities, and other competent authorities, where disclosure is required or permitted by law
• ­ professional advisors, including lawyers, auditors, consultants, claim investigators, and other professional service providers acting on behalf of the Company
• ­ affiliates and group companies, both within Thailand and overseas, for purposes consistent with this Privacy Notice and subject to appropriate safeguards
• ­ other persons or entities where disclosure is necessary to comply with legal obligations, protect legal rights, facilitate business transactions, or where you have given consent.

The applicable retention periods are as follows:

• ­ Agents with production records
  Personal Data will be retained for up to ten (10) years from the end of the most recent relationship associated with the latest production activity in which the agent was involved.
• ­ Agents without production records
  Personal Data will be retained for up to ten (10) years from the termination of the relationship.
• ­ Unsuccessful applicants
  Personal Data relating to unsuccessful applicants will be retained for up to five (5) years from the date of rejection.
• ­ Operational data (e.g. system logs, CCTV)
  Such data will generally be retained for a period ranging from thirty (30) to ninety (90) days, depending on the nature and purpose of such data.

The applicable retention periods are as follows:

• ­ Employees and related personnel
  Personal Data will be retained for the duration of the employment relationship and for up to ten (10) years following termination.
• ­ Unsuccessful applicants
  Personal Data will be retained for up to five (5) years from the date of rejection.
• ­ Operational data (e.g. CCTV, system logs, monitoring data)
  Such data will generally be retained for a period ranging from thirty (30) to ninety (90) days, depending on operational and security requirements.

The applicable retention periods are as follows:

• ­ Contractual and business relationship data
  Personal Data will be retained for the duration of the contractual relationship and for up to ten (10) years following termination or last contact, unless a longer retention period is required or permitted by law.
• ­ Operational data (e.g. CCTV, system logs)
  Such data will generally be retained for a period ranging from thirty (30) to ninety (90) days, depending on operational and security requirements.

In general, Personal Data relating to policy owners, policyholders, insured persons, beneficiaries, payors, and other persons connected with an insurance relationship will be retained for the duration of the contractual or insurance relationship and for up to ten (10) years following termination, lapse, expiry, closure of claim, or last interaction with the Company, unless a longer retention period is required or permitted by law, including for regulatory compliance or legal claims. 

Operational data such as CCTV footage, access logs, call records, and certain technical logs will generally be retained for a shorter period, typically ranging from thirty (30) to ninety (90) days, depending on the nature and purpose of such data.