PRIVACY POLICY NOTICE

(“the/this Notice”)

Last updated: 5 August 2024

This Notice applies to the group of companies which form the Protect Group, and which consist of Protect International SA and its parent company, related entities and/or subsidiaries as listed and more fully described in schedule A hereto (collectively, “Protect”, “we”, “our” and “ours”).

At Protect, we take our Users (collectively “you”, “yours”) personal information very seriously. This Notice explains how we obtain, use, and disclose your personal information when you use our website, dynamic widget, and/or services available at https://www.refundable.me/privacy-notice/ for the purposes of requesting a refund.

This Notice also explains your rights, including your rights to request information about our data processing, and/or deletion of your data.

We do not sell, lease, trade, or otherwise benefit and/or profit from your personal information for any direct and/or indirect marketing.

 

1.  The personal information we collect and process

1.1  Depending on the country where your refund is being issued, your personal information and data may be processed by any of the entities within the Protect Group.

1.2  We may collect personal information including but not limited to:

• Identifying details including name and surname, geographical location, and contact details;
  
  
• Identification details such as an identification number which may be displayed on government-issued documents;
  
  
• Supporting documentation to substantiate your refund request which may include medical documentation and/or information;
  
  
• Information relating to previous refund requests and/or applications;
  
  
• Payment information to allow us to refund you;
  
  
• Anti-fraud information; and
  
  
• Information you provide to us when you communicate with us via phone, chat, email, or any other channels of communication, including customer support service tickets.
  
  

2.  Where we collect personal information from

2.1  Personal information may be collected from:

• You and/or another representative and/or affiliate;
  
  
• Your health professional;
  
  
• Any national database where information is stored;
  
  
• Any anti-fraud database; and
  
  
• Government agencies.

2.2  We shall, as far as possible, collect personal information directly from you except in the following circumstances:

• Where personal information is available in a public record;
  
  
• Where you have given your written consent to collect the information from another source;
  
  
• Where it is more practicable to collect the information from another source;
  
  
• Where the collection of your personal information from another source will not prejudice any of your legitimate interests;
  
  
• Where the collection of personal information from another source is necessary to maintain our legitimate interests or those of any third party we intend to share the information with;
  
  
• Where the collection of personal information directly from you would prejudice the purpose for the collection; and
  
  
• Where the collection of personal information directly from you is not reasonably practicable in the circumstances.
  
  

2.3  We do not knowingly collect personal information from persons under the age of 16 without obtaining parental consent. If we learn that personal information has been collected from persons under 16 years of age and without verifiable consent, then we will take the appropriate steps to delete this information.

3.  Purposes for collecting and processing your personal information

3.1   We shall only collect your personal information for a specific, explicitly defined, and lawful purpose relating to a function or activity of our business.

3.2   Such purposes may include the following:

• To enable us to process your refund. This includes assessing your application, processing, and paying valid applications;
  
  
• To comply with a legal obligation;
  
  
• To protect a legitimate interest of yours (unless you have specifically objected in writing to all or some of the processing activities on reasonable grounds);
  
  
• To customise and display content to you in a way that we feel may interest you or be most beneficial to you;
  
  
• To send content to you via email or other electronic media, where you have consented to be contacted by us with such content;
  
  
• To enable you to voluntarily participate in interactive features; and
  
  
• To notify you about changes to the website, our dynamic widget and/or services available at https://form.refundable.me/forms/refund.
  
  

4.  Payments

4.1   Payments may be made to you via one of our payment processors which include but are not limited to:

• Western Union;
  
  
• HSBC;
  
  
• Wise PLC;
  
  
• Revolut Ltd;
  
  
• Localpayment; and
  
  
• Peach payments.
  
  

4.2   Once we have processed your personal information for the purposes of refunding you, it is stored on Microsoft Azure Cloud for 14 days after a payment has been made to you. This ensures that we have time to address any questions or queries you may have relating to a payment. After the 14-day period, your personal information is hashed and cannot be used again.

5.  Consent to collect, process, and disclose personal information

5.1   By accessing and using our website, dynamic widget, and/or our services available at https://form.refundable.me/forms/refund you provide your express and voluntary consent to the processing of your personal information by us on the basis set out in this Notice.

5.2   If you do not consent, you must immediately stop accessing and/or using this website, our dynamic widget, and/or our services.

5.3   You further consent that you are duly authorised to provide us with any personal information that we may collect as described herein.

6.  Data storage

6.1   Our platform which is used to render the requisite services to you is hosted on the Microsoft Azure Cloud.

6.2   All personal information and data you provide is encrypted at rest. You can read more about it https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest.

6.3   We will store the personal information until we have achieved the purpose for the collection of your personal information, whereafter we will destroy or delete such information unless you have directed otherwise in writing, or unless we are required by law to retain the information for a longer period of time.

6.4   If we no longer need to process personal information to achieve the purpose originally specified, we will refrain from using the personal information.

7. International transfer of your personal information and data

7.1   We will only transfer your personal information to another entity within the Protect Group and/or a third party in another country in any one or more of the following circumstances:

• Where your personal information will be adequately protected under the other country’s laws or an agreement with the third-party recipient;
  
  
• Where the transfer is necessary to enter into, or perform, under a contract with you or a contract with a third party that is in your interest; and
  
  
• Where you have consented to the transfer and/or where it is not reasonably practical to obtain your consent, but the transfer is in your interest.
  
  

7.2   The transfer will happen within the requirements and safeguards of applicable laws or privacy rules that bind the group. Where possible, the party processing a customer’s personal information in another country will agree to apply the same level of protection as available by law in your country, or if the other country’s laws provide better protection, the other country’s laws would be agreed to and applied.

8. Cookies

8.1   “Cookies” are small text files transferred by a web server to a User’s hard drive and thereafter stored on their electronic device.

8.2   The types of information a Cookie collects include a User’s username, the date and time of their visits to the website, their browsing history, and preferences.

8.3   We use “Cookies” to collect and store information that your browser makes available when you visit https://form.refundable.me/forms/refund. Additionally, our servers log the Internet Protocol address (“IP address”) of the device you use to visit https://form.refundable.me/forms/refund.

8.4   You as the User have the right and ability to either accept or decline the use of Cookies. However, declining the use of Cookies may limit your access to certain features on https://form.refundable.me/forms/refund.

9.  General Conditions for Processing Personal Information

9.1   We comply with all laws and/or regulations when we process your personal information.

9.2   We are GDPR compliant and registered with the ICO under the Data Protection Acts of 1998 and 2018. Only authorised personnel have access to your personal information and data.

9.3   We shall not act unreasonably when processing a User’s personal information. This means that it will collect and process a User’s personal information in a way that the User can reasonably expect and in a way that is fair.

9.4   We shall ensure that the personal information that is collected and processed is and remains relevant to the identified purpose/s for such processing, and that such information is and remains adequate, but not excessive, for achieving the identified purpose/s.

9.5   If there are any alternative ways to achieve the identified purpose/s without processing personal information, we shall not process that personal information.

9.6   We shall ensure that the processing activities we choose to apply are proportionate to achieving the identified purpose/s and that no less privacy-invasive measures are available to achieve the same purpose/s.

9.7   We shall ensure that, regardless of the stated purpose/s for processing personal information, the rights and interests of Users will not be unnecessarily prejudiced or infringed, unless it cannot be avoided, and then in such cases, we shall ensure that our own rights and/or interests justify such prejudice or infringement taking place.

10.  Changes to this Notice

10.1   We reserve the right to vary, update, and/or amend any of the provisions of this Notice from time to time. Such variations, updates, and/or amendments will become effective from the date of their publication on https://www.refundable.me/privacy-notice/.

10.2   You must periodically check the provisions of this Notice for any such changes, updates, and/or amendments.

10.3   Your continued use of our service following any such variations, updates, and/or amendments to this Notice will be considered as your acceptance to abide by and be bound by this Notice, as amended.

11.  Contact us

11.1   Please send an email to legal@protectgroup.com if any of the following apply – your request will be reviewed by our privacy team:

• You have any questions or requests regarding this Notice;
  
  
• You would like to remove all personal information from our database;
  
  
• You would like to view personal information you shared with us;
  
  
• You would like to change your account preferences;
  
  
• You no longer wish to receive email updates from us;
  
  
• You believe that we have erroneous or incomplete information about you; or,
  
  
• You believe a child below the age of 16 years may have submitted personal information without the consent of a parent or guardian.

For more information about your rights under the GDPR, please visit https://gdpr-info.eu/.

Schedule A: List of entities within the Protect Group