We, at Ageas Federal Life Insurance Co Ltd (Ageas Federal Life Insurance) are committed to the protection of customer's privacy. Towards that end, Ageas Federal Life Insurance has taken reasonable steps to protect customer's online privacy of personal information provided by them. This privacy policy is applicable to Ageas Federal Life Insurance website (www.ageasfederal.com) and all products & services offered by Ageas Federal Life Insurance through its digital & physical modes. All customers using or availing the same are covered under this privacy policy.

Ageas Federal Life Insurance will be using certain defined terms as provided below: “Customer” shall include individuals & other entities that purchase or intends to purchase goods & services from Ageas Federal Life Insurance as well as any individual & other entity entitled to receive benefits in connection with the insurance contract with Ageas Federal Life Insurance.

"Personal information" means any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.

"Sensitive personal data or information" of a person means such personal information which consists of information relating to

• Password
• Financial information such as Bank account or credit card or debit card or other payment instrument details
• Physical, physiological and mental health condition
• Sexual orientation
• Medical records and history
• Biometric information
• Any detail relating to the above clauses as provided to body corporate for providing service and
• Any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise:

Provided that, any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as sensitive personal data or information for the purposes of this privacy policy.

Personal information that is collected from customers

Ageas Federal Life Insurance collect the following categories of personal information and sensitive personal data or information:

• Information that customer provides via Ageas Federal Life Insurance website or physical forms, in connection with customer's purchase of insurance products & services from Ageas Federal Life Insurance, Ageas Federal Life Insurance collects customer's name, photograph, date of birth (“DOB”), address, email address, occupation country, and telephone number.
• Information about customer's computer and about customer visits to and use of this Site, such as customer's Internet Protocol (IP) address, demographics, customer computers' operating system, and browser type and information collected via cookies.
• Cookies (also known as HTTP cookie) is a small piece of data stored on the user's computer by the web browser while browsing a website and can use to remember pieces of information that the user previously entered.

Sensitive Data collected & processed

Ageas Federal Life Insurance collects the sensitive personal data or information as mentioned above for the purpose of issuing the insurance policy to its customers, undertaking business transactions and making monetary payments.

The biometrics is required only in case the Aadhaar e-KYC authentication is to be undertaken. As per the security architecture of the eKYC the biometric is captured on Registered Device approved by UIDAI (Unique Identification Authority of India) and the biometric is captured in a PID (Personal Identity Data) block and the PID Block, once transmitted by Ageas Federal Life Insurance is not stored in any of the systems of Ageas Federal Life Insurance.

Use of Personal Information

The personal information provided will be used for the purpose of underwriting and arriving at the Premium amount to be paid. This information will be used for the purpose of issuing insurance policy to the customer. In case the customer is an online customer the information will be used to create a user id and password for customer to track his insurance policy. The mobile number and email provided will be used to send periodic updates specific to the insurance policy purchased and if opted for News and other updates then that also will be sent to the customer. The calls made to the customer by Ageas Federal Life Insurance shall be in compliance with the do not disturb norms prescribed by TRAI (Telecom Regulatory Authority of India), including the Telecom Commercial Communications Customer Preference Regulations, 2010. The customer will have the right to unsubscribe to generic information, if any, provided.

Legal Basis of Processing

Ageas Federal Life Insurance processes the Personal Information when it is necessary for the performance of a contract to which customers are the party or in order to take steps at customer's request prior to entering into a contract.

Consequences of not providing Personal Information: If customer chooses not to provide the Personal Information that is mandatory to process customer's request for issuance of insurance policy, Ageas Federal Life Insurance may not be able to provide the corresponding product and/or service.

Data recipients, transfer, and disclosure of Personal Information

To provide customer with the best experience of Ageas Federal Life Insurance products & services, it is necessary of Ageas Federal Life Insurance to engage third party vendors who provide specific products & services to support Ageas Federal Life Insurance's business requirements. In this connection, Ageas Federal Life Insurance would make disclosure of sensitive personal data or information for the purposes of or in connection with activities such as - data entry, tele-calling, medical examination, printing, reinsurance, expert view, audit, legal proceeding, monetary payment, digital & physical communication, verification & collation of information, digital & physical storage.

The last 4 digits and the related demographic information including name, DOB and address shall be shared with Central Know Your Customer Registry (CKYC) maintained by CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest of India) as per PML Act 2002 (Prevention of Money-Laundering Act, 2002) & related Rules. The same will be shared electronically as well as the image of the Aadhaar card (in case of image shared) else the output pdf/jpeg generated from the UIDAI site. This is a mandatory requirement under the legal provisions.

Ageas Federal Life Insurance will not share this information with any other entity, other than those mentioned above, whatsoever without customer's explicit permission, except where the disclosure is mandated by law.

Presently, Ageas Federal Life Insurance does not transfer sensitive personal data or information to any other body corporate or person, whether in India or any other country. If in future, such transfer is made, the same would be

• With the consent of the provider of sensitive personal data or information
• Effected only if it is necessary for the performance of the contract with such provider; and
• Upon such transferee agreeing to be bound by the level of data protection prescribed under law.

Data Provider Rights

Subject to the laws of India, the data provider has the right to access, correct, delete or transfer the Personal Information that Ageas Federal Life Insurance holds, including the profile and preferences. The customer has the right to object to certain processing and, where the consent has been asked for processing the Personal Information, the customer has the right withdraw the consent. Where Ageas Federal Life Insurance processes customer's Personal Information because Ageas Federal Life Insurance has a legitimate interest in doing so, customer also has a right to object to this. These rights may be limited in some situations - for example, where it can be demonstrated that there is a legal requirement to process the Personal Information or that it may restrict the usage of the products & services availed from Ageas Federal Life Insurance.

Collection of Data from Guardians on behalf of minors

The insurance policies offered by Ageas Federal Life Insurance also covers minors. In the event customer chooses to avail such policies, the parent or guardian of such minors would be required to provide personal information and sensitive personal data or information of such minors.

Reasonable Security Practices

Ageas Federal Life Insurance has a full-fledged Information Security Department in place which addresses the vital aspects of the Information security which includes the Personal data.

The Information Security related matters of Ageas Federal Life Insurance are audited annually by external auditor. The audit is conducted in accordance with checklist mandated by IRDAI (Insurance Regulatory and Development Authority of India).

Ageas Federal Life Insurance is certified for ISO 27001:2013 and the information security policy and practices are in line with the ISO 27001:2013 and is audited by the certification body.

Aadhaar Related services

"Information to the customer" The PML Act 2002 is applicable to Ageas Federal Life Insurance, it being a financial institution engaged in life insurance business. Pursuant to same and recommendations made by the Financial Action Task Force (FATF), IRDAI issued Guidelines on Anti Money Laundering program for insurers. The same also mandates insurers to 'Know Your Customer'. In other words, Ageas Federal Life Insurance is required to make reasonable efforts to determine the true identity of all customers requesting for its services. Due to the same, it is mandatory that every person purchasing the insurance policy or receiving monetary payment under the insurance policy has to comply with the KYC norms and as a result provide his/her proof of identity as well as proof of address.

Aadhar number is a legally recognized mode to comply with KYC norms. Instead of using physical copy of Aadhar number, the customer has the option for authentication of Aadhar number through CIDR (Central Identities Data Repository). The customer also has the option for offline verification of Aadhaar number, in accordance with Sec 8A of Aadhaar Act 2016 (Aadhaar (Targeted Delivery of Financial and other subsidies, benefits and services) Act 2016).

Ageas Federal Life Insurance will provide a notice to the customer (in a language understandable to customer) on the nature of information that may be shared upon authentication/offline verification and uses to which the information received may be put by Ageas Federal Life Insurance. This notice also will contain the alternatives to the submission of the Aadhaar number for authentication/offline verification.

The customer can voluntarily agree to undertake eKYC or alternatively provide any other officially valid document to meet the KYC requirement.

In case of prospective customer, such customer should not be eligible for any subsidy from Government of India /or not applied for the Ayushman Bharat Scheme. In such cases, the Aadhaar details can be submitted voluntarily for submission and authenticating by such customer and as Ageas Federal Life Insurance is authorized by UIDAI to undertake the eKYC as a KUA (KYC User Agency).

Consent

The prospective customer has to give a specific consent for fetching the data from UIDAI after reading through the information given above. In case the eKYC is done of the child then the consent will have to be given by the parent or guardian. This is per Sec 8 of the Aadhaar Act 2016 and the related regulation as mentioned in para 8.7 above.

Information collected for fetching eKYC

In order to perform the eKYC the prospective customer will enter the Aadhaar number or virtual ID and can opt for OTP (one-time password) based or Biometric based authentication. In both the cases i.e. OTP and Biometric the same is captured in a PID Block and the PID block is not stored by Ageas Federal Life Insurance and is used for transmission only. The PID block in case of Biometrics is part of the registered device and cannot be extracted separately.

Information received from CIDR on authentication

On successful authentication/offline verification the demographic details including the photograph will be fetched from the CIDR and can also be used to pre-populate the application/proposal form for insurance.

Disclosure

The identity information collected from the CIDR will not be disclosed to any third party without the explicit permission of the Aadhaar holder unless the same is stipulated by Law. The information shall be shared, without obtaining prior consent from provider of information, with Government agencies mandated under the law to obtain information including sensitive personal data or information for the purpose of verification of identity, or for prevention, detection, investigation including cyber incidents, prosecution, and punishment of offences.

Transfer /Sharing of Information

The Aadhaar is treated as the proof of Identity and Proof of Address, the last 4 digits and the related demographic information including name, DOB and address shall be shared with Central Know Your Customer Registry (CKYC) maintained by CERSAI as per PML Act 2002 & related Rules. The same will be shared electronically along with the image of the Aadhaar card.

Data Retention

Ageas Federal Life Insurance retains data in accordance with the laws of India and has a data retention policy approved by the Board of Ageas Federal Life Insurance. Generally, Ageas Federal Life Insurance retains data for a period upto 10 (ten) years from the date of cessation of the transactions between you and Ageas Federal Life Insurance. In the event you are keen in understand the exact duration of any specific data or information that Ageas Federal Life Insurance may store, you may write to the Grievance Redressal Officer at the contact details provided below.

Reasonable Security Practices

The reasonable security practices of the protection of the Identity information of Aadhaar is stipulated in the Aadhaar Act and the related regulations.

Ageas Federal Life Insurance shall abide by the same at all times. As on the date of this version of the privacy policy the following practices shall be adopted:

• The full 12-digit Aadhaar number or the 16-digit VID (Virtual ID) will be entered in the application of Ageas Federal Life Insurance will not be stored.
• In case of eKYC no hard copy of Aadhaar Card obtained from the prospect.
• In case the physical copies/ electronic copies of the same are provided by the customer it shall be ensured that the same is redacted before receiving the same from the customer. Even if the same is received without redaction, Ageas Federal Life Insurance will ensure that the same is redacted before storage.
• The servers used for authentication services shall be within the territorial boundaries within India only.
• In case of Authentication devices used for biometrics the same shall be as stipulated by UIDAI only.
• Hardware Security Module is implemented in line with the UIDAI requirements.

Grievance redressal

All interested parties can submit the grievances related to this privacy policy through the below channel:

• Grievance Redressal Officer: Ageas Federal Life Insurance Co Ltd, 22nd Floor, “A” Wing, Marathon Futurex, N. M. Joshi Marg, Lower Parel (East), Mumbai 400013, India
• Email:   grievance@ageasfederal.com
• Telephone:   022 - 2302 9200