INTRODUCTION
The relationship with the user is regulated according to what is provided by the Swiss Federal Law on Data Protection (LPD) of September 25, 2020. More favorable rights provided by the user’s national law are preserved. In particular, for users who are in a country belonging to the European Union, the rights provided by the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) apply. Users residing outside Switzerland are informed that this country has received an Adequacy Decision from the European Commission on January 15, 2024. Therefore, the transfer of personal data to Switzerland can be carried out without the need to obtain authorizations from the competent Privacy Authority.
Data Controller: BIG Insurance Brokers Suisse SA – P. IVA / VAT No. SZIDICHE115282954IVA – Corso Elvezia, 10 Lugano 6901 Swiss – E-mail: info@big-brokers-health.com
Site to which this privacy policy refers:https://big-brokers-health.com/ (Sito).
The Data Controller has not appointed a DPO. Therefore, you may send any inquiries directly to the Data Controller.
GENERAL INFORMATION
This document describes how the Data Controller processes your personal data.
The following describes the main processing of your personal data. In particular, we explain the legal basis of the processing, whether the provision of personal data is compulsory and the consequences of not providing personal data. To better describe your rights, if necessary, we have specified if and when a certain processing of personal data is not carried out.
Site registration
The Site does not offer the possibility of registration. Therefore, the Data Controller does not process your personal data for this purpose.
Purchases on the Site
It is not possible to make purchases on the Site. Therefore, your personal data will not be processed for this purpose.The Data Controller does not process the user’s data to send “reminder” emails to purchase products and/or services from the Data Controller.
Answering your requests
Your data will be processed to respond to your requests for information. The conferment is optional, but your refusal will make it impossible for the Data Controller to answer your questions. The legal basis for the processing is the legitimate interest of the Data Controller in fulfilling your requests. This legitimate interest is equivalent to the user’s interest in receiving a response to communications sent to the Data Controller.
Marketing
Subject to your consent, the Data Controller may process the personal data provided by you in order to send you advertising material and/or newsletters relating to its own products or those of third parties. The legal basis of this treatment is your consent. The provision of personal data for this purpose is purely optional. Failure to consent to the processing of data for marketing purposes will make it impossible for you to receive advertising material relating to products/services of the Data Controller and/or third parties, as well as making it impossible for the Data Controller to carry out market surveys, also aimed at assessing the degree of user satisfaction, and to send you newsletters. These communications will be sent to your e-mail.
Profiling
Subject to your consent, the Data Controller may process your personal data for profiling purposes, i.e. for the analysis of your consumption choices by revealing the type and frequency of purchases made by you, in order to send you advertising material and/or newsletters relating to its own products or third parties, of your specific interest. The legal basis of this treatment is your consent. The provision of data for this purpose is purely optional. Failure to consent to the processing of your personal data for profiling purposes will make it impossible for the Data Controller to elaborate your commercial profile, through the detection of your choices and buying habits and to send you advertising material about products of the Data Controller and/or third parties, of your specific interest. These communications will be sent to your e-mail.
Data transfer
The Data Controller does not sell your personal data. Personal data may, however, be communicated to service providers acting on behalf of the Data Controller where this is necessary to operate the Site and provide the services requested by you, including the ElevenLabs/ElevenAgents AI assistant described below. International transfers are governed by Article 4.
Geolocalization
The Site does not implement tools to geolocate the user’s IP address.
Curriculum Vitae
It is not possible to send CVs via the Website. Your data will therefore not be processed for these purposes.
Booking Service
The Site may allow you to request a consultation, callback or appointment through forms or the AI assistant. The information you provide for this purpose is processed to take steps at your request before entering into a contract and/or on the basis of the Data Controller’s legitimate interest in responding to your request. Providing the requested information is optional, but without it the Data Controller may be unable to arrange or respond to the request. You can always contact the Data Controller using the contact details in the Introduction.
ELEVENLABS / ELEVENAGENTS AI ASSISTANT
Scope of this section
This section applies specifically to the ElevenLabs/ElevenAgents assistant made available through the floating website widget and through any inline assistant embedded within a dedicated page. Processing of conversation content applies only to visitors who choose to interact with one of these assistants. It does not mean that the Data Controller uses AI to analyse the ordinary communications or browsing activity of every Site visitor. However, as explained below, limited technical connection data may be transmitted when a page containing the widget loads, even if the visitor does not start a conversation.
Nature and purpose of the service
The Site offers an AI-powered voice and text assistant supplied by ElevenLabs (also branded as ElevenAgents). The assistant is an automated system and not a human representative. It is used to answer general questions, understand the user’s request, provide general information, and help the user request a consultation, callback or appointment. The assistant does not provide medical, legal or insurance advice and does not make decisions concerning eligibility, insurance coverage, claims, premiums or the conclusion of a contract.
Data processed
When a page containing the floating or inline assistant loads, the visitor’s browser may connect to ElevenLabs in order to retrieve and display the widget. As part of that technical connection, ElevenLabs and its infrastructure providers may receive limited information such as the IP address, browser/device information, requested resource, date and time, and security or diagnostic logs. This can occur before a conversation is started and is limited to what is necessary to deliver, secure and troubleshoot the widget.
Only when you actively start or use the assistant may the following conversation data be processed: your voice and audio recording; voice data that may be treated as biometric data in some jurisdictions, although the assistant is not intended to identify you from your voice; a transcription of what you say; messages entered in the chat; the assistant’s responses; the language selected or detected; conversation identifiers, date, time, duration and interaction logs; feedback you submit; and any name, email address, telephone number, preferred contact method or other information you voluntarily provide. If a document-upload function is made available, the content and metadata of documents that you choose to attach will also be processed.
Please do not disclose or upload medical records, diagnoses, health information, insurance-policy or claims documents, payment-card information, identity documents, passwords, or other sensitive or unnecessary personal data through the assistant. The assistant is intended only for general enquiries and arranging contact. If you need to discuss confidential or health-related circumstances, contact the Data Controller directly using the details in the Introduction so that an appropriate channel can be agreed.
Recording and transparency
Use of the assistant is voluntary. Before starting an interaction, you will be informed that you are communicating with an AI system and that the conversation may be recorded, transcribed, stored and shared with ElevenLabs and service providers involved in operating the assistant, including third-party large language model providers. Where consent is requested, you may refuse or withdraw it; in that case, do not start or continue the assistant and use the alternative contact details in the Introduction. Withdrawal does not affect processing already lawfully carried out.
Purposes and legal bases
The data are processed to provide and operate the assistant, answer your enquiry, arrange requested contact, maintain security, prevent misuse, troubleshoot technical issues and, where applicable, assess and improve service quality. Depending on the context, the legal basis is your consent, the taking of pre-contractual steps at your request, compliance with legal obligations, and/or the legitimate interests of the Data Controller in responding to enquiries and maintaining a secure and effective customer-contact service. The Data Controller does not use assistant conversations for direct marketing or profiling unless separate, specific consent has been obtained.
Provider and recipients
ElevenLabs and its affiliates process assistant data as a technology provider on behalf of the Data Controller, together with subprocessors used to provide hosting, speech recognition, speech generation, large language model and security services. Communications may therefore be viewed, stored or otherwise processed by ElevenLabs and relevant third-party providers solely as permitted by the applicable contracts, settings and law.
As of the effective date of this policy, the Data Controller has disabled the ElevenLabs account setting identified as “Improve the models for everyone”. Consequently, new content submitted through the Data Controller’s ElevenLabs assistant is not authorised for use by ElevenLabs to train or improve its general AI models. This does not prevent processing that is necessary to provide the requested assistant service, generate responses, maintain security, prevent abuse, comply with law, or perform other processing that cannot legally or technically be excluded. If this setting or the applicable contractual arrangement changes materially, this policy will be updated before the change is applied where required by law. Further information is available in the ElevenLabs Privacy Policy at https://elevenlabs.io/privacy-policy and the ElevenLabs Data Processing Addendum at https://elevenlabs.io/dpa.
Storage technologies
The assistant may use strictly necessary browser storage, session identifiers or similar technologies to maintain the conversation, remember a terms-acceptance choice where configured, protect the service and ensure its technical operation. These technologies are not used by the Data Controller for advertising through the assistant.
Automated processing
The assistant automatically analyses user input and generates responses. It is not used by the Data Controller to make solely automated decisions that produce legal effects or similarly significant effects concerning you. Any insurance recommendation, quotation, eligibility assessment or contractual decision requiring professional judgment is handled separately by an authorised person or the relevant insurer.
Photographs and videos
The Data Controller does not request the publication of photographs and/or videos depicting you. Therefore, your data will not be processed for these purposes.
Communication of personal data
As part of its ordinary business, the Data Controller may communicate your personal data to certain categories of subjects. In article 2 you can find the list of subjects to which the Data Controller communicates your personal data. In order to facilitate the protection of your rights, Article 2 may specify in certain cases when your data is not communicated to third parties.
The “communication” of personal data to third parties is different from the “transfer” (governed by the preceding point). In fact, in the communication the third party to whom the data is transmitted can use it only for the specific purposes described in the relationship with the Data Controller. In the transfer, instead, the third party becomes the autonomous Data Controller. Moreover, to transfer your personal data to third parties is always required your consent. Without prejudice to the foregoing, it is understood that the Data Controller may still use your personal data in order to correctly fulfill the obligations provided for by the laws in force.
PRIVACY POLICY
Art. 1 Method of processing
1.1 The processing of your personal data will be mainly carried out with the help of electronic or automated means, according to the methods and with the tools suitable to ensure their security and confidentiality.
1.2 The information acquired and the methods of treatment will be relevant and not excessive in relation to the type of services rendered. Your data will also be managed and protected in secure computer environments appropriate to the circumstances.
1.3 The Site and its AI assistant are not intended for the collection of “special categories” of personal data, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data used for identification, health data, or data concerning a person’s sex life or sexual orientation. Users are expressly requested not to provide such information through general Site forms or the AI assistant. If such information is nevertheless provided, the Data Controller will limit its processing to what is necessary and permitted by applicable law and will delete or redirect it to an appropriate channel where reasonably possible.
1.4 No judicial data is processed through the Site.
Art. 2 Communication of personal data
The Data Controller may communicate your personal data to certain categories of subjects. The Data Controller wishes to inform users that, in the context of using the YouTube service (managed and owned by Google LLC), some personal data may be collected and shared. This data collection is essential to provide and enhance the user experience on our Site and to enable viewing of video content integrated through the YouTube API. In detail, when a user views a video content through the YouTube API on our Site, the following information may be collected: IP Address: Used to connect the user’s device to YouTube for video transmission. Behavioral Data: Includes information on how the user interacts with videos, such as which videos are viewed and for how long. Location Information: Used to provide relevant content based on the user’s geographical location. These data are automatically collected by the system and, in some cases, may be stored to improve user experience and for internal analytical purposes at YouTube. It is specified that our Site uses YouTube’s API services and, by viewing content through these APIs, the user accepts YouTube’s Terms of Service available at https://www.youtube.com/t/terms. For further details on data management by Google LLC, users are invited to consult Google LLC’s privacy policy at http://www.google.com/policies/privacy and YouTube’s at https://www.youtube.com/intl/ALL_it/howyoutubeworks/our-commitments/protecting-user-data/. Details on the use of User API Data User API Data: When a user interacts with YouTube videos embedded in our Site, data such as viewing preferences, video viewing history, and interactions with video content (likes, comments, shares) may be collected. These data are made available through the YouTube API and help to understand how users interact with video content. Access to data via the Client API: Our Site may use specific API calls to request and receive data from YouTube. This may occur when a user views a video, with the system automatically recording relevant information. Data Collection: Data are automatically collected by the YouTube system when users interact with YouTube videos on our Site. This process is essential to provide a smooth and personalized user experience. Data Storage: The collected data are securely stored in YouTube’s systems for a period that does not exceed the necessity of use. YouTube adopts all necessary security measures to protect these data from unauthorized access or illicit uses. Use of Data: YouTube uses these data for various purposes, including: Internal Analysis: To better understand user interactions with video content and improve the quality of YouTube services. Content Personalization: To offer users a more personalized experience, based on their preferences and interaction history. User Experience Improvement: To identify and resolve any technical issues and optimize the usability of video content. The subjects to whom the Data Controller reserves the right to communicate your data are indicated below:
The Data Controller may communicate your personal data to all those subjects (including Public Authorities) who have access to personal data by virtue of regulatory or administrative measures.
Your personal data may also be disclosed to all those public and / or private individuals and / or legal entities (legal, administrative and tax, judicial offices, Chambers of Commerce, Chambers and Offices of Labor, etc..), if the communication is necessary or functional to the proper fulfillment of obligations under the law.
The Data Controller uses employees and/or collaborators in any capacity. For the proper functioning of the Site, the Data Controller may communicate your personal data to these employees and/or collaborators.
In its ordinary activity of managing the Site, the Data Controller makes use of companies, consultants or professionals in charge of the installation, maintenance, updating and, in general, the management of the hardware and software of the Data Controller or which the latter uses for the provision of its services. Therefore, only with reference to these purposes, your data may also be processed by these subjects.
In order to send its communications, the Data Controller uses external companies in charge of sending this type of communication (CRM platforms). Your personal data (in particular your email) may therefore be communicated to these companies.
For the AI assistant, the Data Controller uses ElevenLabs/ElevenAgents and the subprocessors involved in providing speech recognition, speech generation, large language model, cloud-hosting, moderation, security and support functions. These providers may process voice recordings, transcripts, chat messages, interaction metadata, contact information and other content voluntarily submitted through the assistant, only to the extent necessary for the purposes described in this policy and subject to the relevant contractual and legal safeguards.
The Data Controller may use external technology providers to support customer enquiries and requested callbacks or appointments. Those providers process personal data only for the relevant service and according to the Data Controller’s instructions, except where a provider is independently required by law to process the data.
Buyers’ personal data are not communicated to couriers or forwarding agents.
The Data Controller reserves the right to modify the above list in accordance with its ordinary operations. Therefore, you are invited to regularly access this information to check to which subjects the Data Controller communicates your personal data.
Art. 3 Personal data retention
3.1 This article describes how long the Data Controller reserves the right to retain your personal data.
User data will be kept only for the time necessary to ensure the proper provision of the services offered through the Site.
For marketing purposes, personal data will be kept until consent is revoked. For inactive users, personal data will be deleted after one year from the sending of the last email eventually viewed.
For customer care purposes, data will be deleted once the service is completed and, in any case, within a maximum period of 3 months after the last exchange of e-mails with the person concerned.
Conversations with the AI assistant, including transcripts, audio recordings where audio storage is enabled, interaction metadata and attachments where available, will be retained for no longer than 24 months from the interaction, unless a shorter retention period is configured, earlier deletion is requested and legally applicable, or longer retention is necessary to establish, exercise or defend legal claims or comply with a legal obligation. The Data Controller may delete data earlier when it is no longer required for the purposes described above. Following deletion, database items may remain in provider backups for up to 30 additional days before expiring and becoming unrecoverable.
Contact details and information extracted from an AI-assistant conversation for a requested consultation, callback or appointment will be retained according to the customer-care or pre-contractual retention period applicable to that request and will not be used for marketing without separate consent.
For marketing purposes, unless consent is revoked before, data will be stored for 24 months from the time of submission. After consent revocation or the end of the 24-month period, personal data will be deleted and no longer used for marketing purposes.
For marketing purposes, “profiling,” unless consent is revoked before, data will be stored for 12 months from the time of submission. After consent revocation or the end of the 12-month period, personal data will be deleted and no longer used for this purpose.
3.2 Without prejudice to the provisions of Article 3.1, the Data Controller may retain your personal data for the time required by specific regulations, as amended from time to time.
Art. 4 Transfer of personal data
4.1 The Data Controller is established in Switzerland, which is recognised by the European Commission as providing an adequate level of protection. Where personal data are transferred to another country recognised as adequate by the European Commission or another competent authority, the transfer may rely on the relevant adequacy decision.
Personal data processed through ElevenLabs/ElevenAgents may be transferred to or accessed from the United States and other countries in which ElevenLabs or its authorised subprocessors operate. A transfer to a US recipient may rely on the EU-US Data Privacy Framework, including the UK Extension or Swiss-US Data Privacy Framework where applicable, only where the recipient is validly certified and the relevant framework applies.
4.2 Where no applicable adequacy decision exists, the Data Controller and/or its providers will rely on appropriate safeguards recognised by applicable data-protection law, such as the European Commission’s Standard Contractual Clauses, the relevant UK addendum, Swiss adaptations, contractual and technical safeguards, or another valid transfer mechanism. A copy or description of the applicable safeguards may be requested from the Data Controller, subject to protection of confidential information.
4.3 In this article, the Data Controller indicates the countries in which it may specifically direct its activities. This circumstance may imply the application of the legislation of the reference country, together with that which governs the relationship with the user as indicated in the Preamble.
At the request of the user, the Data Controller will apply to the processing of personal data any more favourable legislation provided for by the user’s national legislation.
Art. 5. Your rights
The Data Controller informs you that you have the right:
to request from the Data Controller access to your personal data and the rectification or erasure of the same or the restriction of the processing thereof or to object to the processing thereof, in addition to the right to data portability
revoke consent at any time without affecting the lawfulness of the processing based on the consent given before revocation
to lodge a complaint with a competent supervisory authority, including the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, the supervisory authority in your EU/EEA Member State.
The rights referred to above may be exercised by making a request without formalities to the contacts indicated in the Introduction.
Art. 6. Amendments
The Data Controller reserves the right to make changes to this policy at any time, giving appropriate publicity to users of the Site and ensuring in any case an adequate and similar protection of personal data. In order to view any changes, you are invited to regularly consult this policy. In case of substantial changes to this privacy policy, the Data Controller may give notice of such changes also by email.
