Privacy Policy

This Privacy Policy applies whenever you:

• visit My Genny;
• create or use a User Account;
• use Basic;
• subscribe to Managed Services;
• communicate with K2G;
• upload insurance documents or other information to the Platform; or
• otherwise interact with My Genny.

Insurance companies, the appointed Intermediary and other third-party providers may process your personal data under their own privacy policies.

This Privacy Policy applies only to the processing of personal data by K2G unless expressly stated otherwise.

K2G is the controller for personal data processed in connection with My Genny and the services provided through it.

Where you use Managed Services and grant an Insurance Intermediation Mandate, the appointed Intermediary and the relevant Insurers process personal data under their own responsibility in accordance with their respective privacy policies.

Depending on your use of the Platform, you may provide information including:

• your name and contact details;
• date of birth;
• account information;
• communication preferences;
• insurance information;
• policy documents;
• quotations and applications;
• correspondence;
• claims-related information;
• payment and billing information; and
• information contained in your Digital Insurance Portfolio.

When you use My Genny, we may collect information including:

• Platform activity;
• searches and interactions;
• AI conversations;
• uploaded documents;
• customer instructions;
• communications with K2G;
• technical and diagnostic information;
• device and browser information;
• IP address;
• security logs; and
• usage analytics.

Where reasonably necessary to provide our services, we may receive personal data from:

• the appointed Intermediary;
• Insurers;
• payment service providers;
• identity verification providers;
• publicly available sources; and
• other third parties authorised by you or permitted by law.

We process personal data to operate My Genny and provide the Platform Services and Managed Services requested by you.

We process personal data to provide the Managed Services requested by you.

Where you have granted an Insurance Intermediation Mandate, we process personal data where reasonably necessary to support the appointed Intermediary in providing Insurance Intermediation Services.

We process personal data to administer subscriptions and payments.

We process personal data to communicate with you regarding My Genny and the services you use. Where permitted by law, we may also send information about new products, services or features. You may opt out of marketing communications at any time.

We process personal data to improve, maintain and secure My Genny and to prevent fraud and misuse.

We process personal data where reasonably necessary to comply with applicable law and to establish, exercise or defend legal claims.

AI may be used to analyse insurance information, organise the Digital Insurance Portfolio, explain insurance concepts, generate summaries and support the provision of My Genny.

To provide AI functionality, K2G may use carefully selected third-party AI service providers.

Where personal data is processed by such providers, K2G implements appropriate contractual, technical and organisational safeguards in accordance with applicable law.

K2G requires AI service providers, where applicable, to process personal data only on K2G's documented instructions and not to use Customer data or Customer Content for their own model training or other independent purposes unless the Customer has expressly agreed otherwise.

Except where you have expressly agreed otherwise, K2G does not use your personal data or the contents of your Digital Insurance Portfolio to train publicly available AI models.

K2G may use personal data and Customer Content to develop, improve and operate My Genny, including its AI functionality, in accordance with applicable law and this Privacy Policy.

My Genny may assist in analysing information and generating recommendations.

Insurance underwriting decisions, acceptance of applications and claims decisions are made by the relevant Insurer and not solely by My Genny.

Where applicable law grants rights in relation to automated individual decisions, K2G will provide the information and safeguards required by law.

K2G processes personal data where reasonably necessary to provide My Genny, Platform Services, Managed Services, administer subscriptions, and perform the Platform Agreement or other agreements entered into with you.

K2G processes personal data where necessary to comply with applicable legal or regulatory obligations, including obligations relating to accounting, taxation, insurance intermediation and data protection.

Where permitted by applicable law, K2G processes personal data where reasonably necessary to operate, maintain, improve and secure My Genny, prevent fraud, protect its legal rights and administer its business.

Where consent is required by applicable law, K2G will request your consent before processing your personal data. You may withdraw your consent at any time with future effect.

Where you use Managed Services and have granted an Insurance Intermediation Mandate, K2G may share the personal data described in Section 3 with the appointed Intermediary where reasonably necessary to provide the services described in Section 4.

If K2G appoints a different Intermediary, K2G may transfer the relevant personal data described in Section 3 to the newly appointed Intermediary to facilitate an orderly transition and continuity of the Managed Services.

The newly appointed Intermediary may not perform Insurance Intermediation Services on your behalf until you have granted a new Insurance Intermediation Mandate.

Where reasonably necessary to provide the services described in Section 4, K2G or the appointed Intermediary may share the relevant personal data described in Section 3 with the relevant Insurers.

K2G may share the personal data described in Section 3 with carefully selected technology, payment and professional service providers.

Where applicable, such service providers process personal data only on K2G's instructions and under appropriate contractual safeguards.

K2G may disclose personal data where required or permitted by applicable law, including to courts, regulatory authorities, law enforcement agencies, tax authorities and other competent public authorities.

If K2G is involved in a merger, acquisition, financing, restructuring or sale of all or part of its business, personal data may be disclosed or transferred to the relevant parties, subject to appropriate confidentiality obligations and applicable law.

Personal data may be processed in Switzerland, the European Economic Area (EEA) or other countries in which K2G or its service providers maintain operations.

Where personal data is transferred to countries that do not provide an adequate level of data protection under applicable law, K2G implements appropriate safeguards, including recognised contractual safeguards where required.

Certain service providers may process personal data outside Switzerland. K2G selects service providers carefully and requires appropriate contractual and technical safeguards for such processing.

Cookies are small text files stored on your device when you visit My Genny.

You may manage or withdraw your cookie preferences at any time through the available cookie settings or your browser settings.

Disabling certain cookies may affect the functionality of My Genny.

K2G retains the personal data described in Section 3 only for as long as reasonably necessary for the purposes described in Section 4, the duration of our contractual relationship with you, applicable statutory retention periods and any legal or regulatory obligations.

When personal data is no longer required for these purposes, K2G will delete or anonymise it, unless continued retention is required or permitted by applicable law.

K2G maintains appropriate technical and organisational measures, including access controls, authentication, encryption where appropriate and other security measures designed to protect personal data.

Where reasonably practicable and appropriate for the intended purpose, K2G uses aggregated or pseudonymised data for platform analytics and service improvement.

Access to personal data is limited to persons who require such access to perform their duties or provide services on behalf of K2G.

K2G maintains procedures for identifying, investigating and responding to security incidents involving personal data and will provide any notifications required by applicable law.

Subject to applicable law, you may exercise your rights regarding your personal data, including rights of access, correction, deletion, restriction, objection, withdrawal of consent and data portability where applicable.

You may exercise your privacy rights by contacting K2G using the contact details provided in Section 15.

K2G may request reasonable information to verify your identity before responding to a request.

Certain rights may be limited where K2G is required or permitted to continue processing personal data under applicable law or where such processing is necessary to establish, exercise or defend legal claims.

If you believe that your personal data has been processed in violation of applicable law, you may contact K2G or lodge a complaint with the competent data protection authority.

K2G may update this Privacy Policy from time to time. The current version will always be available on My Genny. Material changes will be communicated where required by applicable law. The updated Privacy Policy becomes effective on the date indicated in the revised version.

My Genny is intended for individuals who are at least 18 years of age. K2G does not knowingly collect personal data from children. If you believe that a child has provided personal data to K2G, please contact us using the contact details in Section 15.

K2G Holding AG

Blegistrasse 9, 6340 Baar, Zug

Switzerland

Email: privacy@mygenny.ch

Website: www.mygenny.ch

Requests relating to your personal data, including requests to exercise your privacy rights, may be submitted using the contact details above. K2G will respond within the time limits required by applicable law.

If you are not satisfied with K2G's response, you may contact the competent data protection authority. For Switzerland, the competent authority is generally the:

Federal Data Protection and Information Commissioner (FDPIC)

https://www.edoeb.admin.ch