Protection Of Privacy In BTA

Your privacy matters to us. We realize that personal data is your value, thus, we process them upon observance of confidentiality requirements and taking care of their safety. As the General Data Protection Regulation came into effect, we have reviewed the processes on processing personal data and we hereby publish the main principles of BTA Privacy Policy, as well as the complete BTA Privacy Policy, which you can review below or open as a PDF file.

Come into force on 17 December 2025

Privacy Policy

AAS "BTA Baltic Insurance Company" – Latvia.

1. Information about the controller

The controller of personal data processing is AAS "BTA Baltic Insurance Company", registration number 40103840140, legal address: Sporta iela 11, Riga, LV-1013, Latvia, hereinafter – us.

2. Document purpose

This privacy policy describes the basic principles and protection of the processing of personal data carried out by us. More detailed information on the processing of personal data may be additionally described in contracts and other documents related to insurance services.

3. Terms and abbreviations

Processor – a natural or legal person, public authority, agency or other body that processes personal data on our behalf.

Processing – means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, registration, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

You – a person who has the intention to conclude an insurance contract or who, according to the insurance contract, is a policyholder, an insured person, a beneficiary or a third party.

Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as the name, surname, identification number, location data, online identifier or one or more physical, physiological, genetic, religious, economic characteristics of that natural person, cultural or social identity factors, incl. any data on the insurance or indemnities of individuals, our employees and cooperation partners.

System – A system for the processing of personal data, a structured set of personal data fixed in any form, which is available in accordance with relevant criteria for identifying a person, for example, insurance risk information system, personnel and accounting system.

GDPR – General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

4. General information

4.1. We ensure the confidentiality of personal data and implement appropriate technical and organizational measures to protect personal data from unauthorized access, unlawful processing or disclosure, accidental loss, alteration or destruction. We process personal data in accordance with the GDPR and other regulatory enactments, taking into account the purposes of data processing.

4.2. We may use processors with whom data processing agreements have been concluded. Such processors process personal data in accordance with the security measures specified in regulatory enactments and our instructions.

4.3. We collect personal data in order to provide you with insurance services and fulfil binding legal obligations, as well as to pursue legitimate interests. In these cases, the collection of personal data is necessary for us to be able to provide you with insurance services. If you refuse to provide the necessary data, then failure to provide such data may jeopardize the commencement of insurance services or further performance of the contract.

4.4. For marketing purposes, the processing of Personal Data is carried out on the basis of your consent or our legitimate interests:

Personal data may be collected with your consent for the purpose of offering you advantageous transaction conditions and personalized offers.
Based on legitimate interests, we prepare the following information for you:
- About our services and news to improve your awareness of our company news;
- About the promotions, campaigns and lotteries organized to increase our visibility;
- Satisfaction surveys to find out your feedback about our services you use and can help us improve them.

You can object to the preparation of this information at any time and further manage your permissions on the "My BTA" portal, in our mobile app, at any of our customers’ business centres or by calling our information phone.

4.5. Profiling is the automatic processing of personal data that we use for automated decision-making to calculate insurance premiums for requested types of insurance, for the calculation of insurance claims, for risk assessment and for direct marketing purposes.

5. Categories of personal data to be processed

5.1. Categories of personal data processed by us:

5.1.1. identification data, such as name, surname, personal identification number, date of birth;
5.1.2. contact information, such as residential address, phone number, email address;
5.1.3. information about insured objects, such as real estate address, vehicle data, etc. related data;
5.1.4. transaction data, such as bank account number, amount of premium paid, etc. related data;
5.1.5. trust data, such as payment discipline data for us or others;
5.1.6. information on the damage caused – applications for insurance claims, such as information on the amount of losses, insured objects, event circumstances, estimates, etc.;
5.1.7. research data, such as data that allows us to carry out your research activities in relation to the prevention of terrorist financing and to verify compliance with international sanctions, including the purpose of cooperation;
5.1.8. data collected and/or generated in the performance of regulatory obligations, such as data that we are obliged to provide to authorities such as tax authorities, courts, law enforcement authorities;
5.1.9. communication and device data, such as data contained in messages, emails, video and audio recordings, as well as other types of communication and interaction data collected when you visit our website and use the mobile app;
5.1.10. data on the satisfaction of the services provided, for example, answers to survey questions, your satisfaction with the services provided;
5.1.11. data on relationships with legal entities, such as medical institutions or car service information about the fact that you have been provided with a service that must be paid for by us;
5.1.12. Assessment of your insured risks;
5.1.13. special categories of personal data – data of health and medical examinations, for example, data providing information on a person’s health for the purposes of settling insurance indemnity and costs within the framework of the provision of insurance services (health, accident, travel and MTPL insurance services).

6. Purposes and legal bases for personal data processing

6.1. We process personal data in accordance with the following legal bases of the GDPR:

6.1.1. conclusion and performance of the contract – in order to conclude the contract upon receipt of your application and ensure its execution;
6.1.2. compliance with regulatory enactments – in order to fulfill the obligations specified in external regulatory enactments binding on us;
6.1.3. Your consent – to the processing of your personal data;
6.1.4. legitimate interests – to fulfil our legal (legitimate) obligations arising from a law or contract concluded between us and you. We process personal data in accordance with the following processing purposes, based on legal bases arising from regulatory enactments:

Purposes of personal data processing	Legal bases for the processing of personal data	Processed datasets
1. Provision of insurance services, for example, identification of you, obtaining information about the insurable object in order to prepare an insurance offer, concluding an insurance contract, making recordings of telephone conversations for the purpose of proving the transaction, administration of policy renewals, administration of an insured event.	GDPR 6 (1) (b), (c), (f). GDPR Article 9 (2) (g). Insurance Contract Act Chapter II, Sections 28 and 31. Law on Compulsory Civil Liability Insurance of Owners of Motor Vehicles Section 17, Clause 4. Law on the Rights of Patients Section 10, Paragraph five, Clause 16.	Identification data, contact information, information about insured objects, information about transactions, information about damage caused, personal data of a special category.
2. Provision of online medical consultation, remote medication ordering.	GDPR Article 6 (1) (a). GDPR (2) (a).	Identification data, contact details, special categories of personal data.
3. Risk management, for example, prevention and detection of fraud cases, examination of complaints and suggestions, incident management, fulfilment of the obligations laid down in the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, and the Law on International and National Sanctions of the Republic of Latvia.	GDPR Article 6 (1) (c), (f). Insurance Contract Law Chapters II and III, Article 28. Law on Credit Information Bureaus Section 4, Paragraph two and Section 18 Clause 3. Insurance and Reinsurance Act Section 84, paragraph 2. Insurance and Reinsurance Act Sections 46 and 71. Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing Section 51, Paragraph two, Section 41, Paragraph two, Clause 7. Law on International and National Sanctions of the Republic of Latvia, Section 2, Paragraph two.	Identification data, contact information, special category personal data, information about the damage caused, investigation data, information about insured objects, information about transactions.
4. Personnel administration, work organisation and accounting, for example, selection of personnel, entering into and performance of an employment contract, organisation of labour protection measures, keeping of record-keeping and accounting, prevention of conflict of interest.	GDPR Article 6 (1) (a), (b), (c), (f). GDPR (2) (b). Labour law, Sections 33, 35, 36, Section 37, Paragraph six, Chapter 19, Section 82, Paragraph one, Section 109, Paragraph two, Section 137. Labour Protection Law, Section 3, Section 15, Paragraph one, Section 155, Paragraph one. Cabinet Regulation No 950 Procedures for the Investigation and Accounting of Accidents at Work, Paragraph 56. Insurance and Reinsurance Distribution Law, Section 14, Paragraph one, Section 17, Paragraph one, Section 20, Clause 1, Section 42. Insurance and Reinsurance law – Section 15, Clause 3. Accounting Law, Section 11. Law On Personal Income Tax, Section 38, Paragraph two. Law On State Social Insurance, Section 13, Section 23. Cabinet Regulation No. 827 – Regulations regarding the registration of Persons making mandatory State social insurance contributions and reports regarding mandatory State social insurance contributions and personal income tax.	Jobseekers’ identification and contact details, employee identification data, contact details, data related to the conclusion and performance of employment contracts, including payroll data.
5. Organisation of work, including ensuring of security in premises, prevention or detection of criminal offences in relation to the protection of property and protection of vital interests of persons, provision of security for information systems and computer network, maintenance of information technology systems, organisation of received and outgoing record-keeping.	GDPR Article 6 (1) (c), (f). REGULATION (EU) 2022/2554 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (DORA).	Identification data, including visual identification data, contact details, etc. data.
6. Keeping an accounting.	GDPR Article 6 (1) (c). Law On Accounting.	Identification data, transaction information, personnel data.
7. Preparation and sending of special offers by us and our cooperation partners, for example, organizing lotteries, sending commercial communications, analysing online page visits, sending satisfaction surveys, congratulations, as well as sending informative information about us, our news and promotions.	GDPR Article 6 (1) (a), (f).	Identification data, contact information.
8. Making recordings of telephone conversations and video calls for the provision of services and quality assurance, as well as for the purpose of proving transactions. The recordings may be automatically converted into text (transcribed) and analyzed to ensure the quality, efficiency, and accuracy of customer service, as well as to generate automatic summaries of conversations or quality assessments. Such processing is carried out solely for the purposes of quality assurance and service improvement and does not have any legal consequences for the client.	GDPR Article 6 (1) (b), (c), (f).	Audio and visual data such as: identification data, contact information, information about insured objects, information about transactions, information about damage caused, special category personal data, etc.
9. Conducting surveys, for example, to find out the quality of the services we provide.	GDPR Article 6 (1) (f).	Identification data, contact details, your satisfaction data.
10. Acceptance and provision of insurance distribution services, for example, provision of insurance services using the services of insurance agents or brokers.	Article 6 (1) (c) GDPR. Insurance Reinsurance Distribution Law.	Identification data, contact information, information about insured objects, information about transactions, information about damage caused, personal data of a special category.
11. Realization and protection of rights and legitimate interests.	GDPR Article 6 (1) (c), (f). GDPR Article 9 (2) (f). Insurance and Reinsurance Law. Civil law. Criminal law.	Identification data, information about insured objects, information about transactions, information about damage caused, special category personal data, etc.
12. Implementation of cooperation with other legal entities, for example, provision of insurance services, in a medical treatment institution of your choice, car service, or other institution.	GDPR Article 6 (1) (b), (f).	Identification data, contact information.
13. Compilation of statistical data, for example, on used insurance services and insurance claims.	GDPR Article 6 (1) (b), (c).	Statistics.

7. Means of obtaining personal data

7.1. We collect or may obtain Personal data in the following ways:

7.1.1. from you in the process of entering into an insurance contract, including the personal data of the insured person, beneficiary or contact person;
7.1.2. from submissions, communication emails, video calls, telephone conversations or otherwise documenting your interaction and communication with us;
7.1.3. from you, if insurance compensation is claimed;
7.1.4. from your authentication on our website or mobile app;
7.1.5. from external sources, such as public and private registers or databases, including from the Motor Insurers’ Bureau of Latvia, when calculating the insurance premium in vehicle insurance types;
7.1.6. from any medical treatment institution or from any medical practitioner, receiving any information about your state of health and the medical assistance received, if such information from the medical treatment institution or medical practitioner is necessary in order to:
- find out the circumstances of the alleged insured event declared;
- take a decision on the payment of insurance benefit or refusal to pay insurance benefit;
- determine the amount of insurance compensation, but only in the amount necessary for the settlement of health, accident, travel and MTPL insurance claims.
7.1.7. from counterparties, insurance intermediaries, insurance premium payers, holders of the insurance object, applicants for insurance claims, as well as natural persons related to our clients – legal entities, such as: shareholders (members), members of the board, representatives of companies, authorized signatories, beneficial owners;
7.1.8. from law enforcement authorities;
7.1.9. from job seekers when applying for a vacancy announced by us;
7.1.10. on our website using cookies;
7.1.11. in another way, observing the legal bases for the processing of personal data for the purpose and to the extent specified in regulatory enactments.

8. Protection of personal data

8.1. We provide, constantly review and improve safeguards to protect your personal data from unauthorized access, accidental loss, disclosure or destruction. We apply modern technology, technical and organizational requirements, incl. using firewalls, intrusion detection attempts, analysis software and data encryption.

8.2. Before concluding cooperation agreements and during its duration, we carefully check all service providers who process your personal data on our behalf. We evaluate whether cooperation partners (personal data processors) apply appropriate security measures, the processing of your personal data would take place in accordance with the requirements of the regulatory enactments regulating the security and insurance industry established by us. Within the framework of the cooperation agreement, personal data processors are not allowed to process your personal data for purposes other than those specified in the cooperation agreements, except if they are determined by regulatory enactments.

8.3. We are not responsible for any unauthorised access to and/or loss of personal data beyond our control, nor are we liable for improper processing due to your fault and/or negligence, such as:

you provide us with or record inaccurate data on our website for further communication, or;
by applying for insurance compensation from us and transferring data carriers in case of damage to electrical appliances, you do not delete your personal information.

9. Categories of personal data recipients

9.1. We have the right to transfer your personal data:

9.1.1. Vienna Insurance Group AG Wiener Versicherung Group companies for the processing of personal data in accordance with the purposes specified by us and in accordance with mutual agreements;
9.1.2. persons with whom we cooperate in the performance of the concluded insurance contract or in order to ensure the performance of their activities or functions, incl. insurance intermediaries, reinsurance undertakings, but only to the extent necessary to achieve the objectives;
9.1.3. persons who provide us with services of monitoring and collecting insurance premiums or other payments arising from the insurance contract overdue by the policyholder, but only to the extent necessary to achieve the purpose;
9.1.4. financial service providers for whom an insurance contract has been concluded in order to inform them of the terms of the insurance contract, the validity of the insurance contract and the settlement of insurance claims, but only to the extent necessary to achieve the purpose;
9.1.5. For the information system of the Compulsory Civil Liability Insurance of Owners of Motor Vehicles, the maintainer of which is the Motor Insurers’ Bureau of Latvia, but the Road Traffic Safety Directorate, the State Technical Supervision Agency and we, who have sent the data to the Latvian Motor Insurers’ Bureau, are responsible for the field of compulsory civil liability insurance for owners of motor vehicles for the purpose and to the extent specified in the regulatory enactments;
9.1.6. other partners related to the provision of our services, such as archiving and postal service providers, couriers, as well as those who provide services to our customers – remuneration experts, car services, medical institutions, sports clubs, pharmacies, optics salons (shops), but only to the extent necessary to achieve the purpose;
9.1.7. law enforcement authorities, such as the police, the court or other state and local authorities, if it arises from laws and regulations or a justified request for information from the relevant authority;
9.1.8. technical and system maintainers of our information technology infrastructure, such as developers of information technology solutions as processors of personal data;
9.1.9. other insurance companies in order to reduce the risk of the insurer’s activities and prevent fraud, as well as to exchange information with each other on policyholders, insured persons and insurance contracts in force, for the purpose and to the extent specified in regulatory enactments.

10. Geographic territory of personal data processing

10.1. The processing of personal data may take place both in Latvia and in other Member States of the European Union and the European Economic Area (EU/EEA) or in countries that are not EU/EEA countries in cases of administration of remuneration or the choice of information technology solutions.

10.2. The transfer and processing of personal data outside the EU/EEA may take place if there is a legal basis for it and appropriate security measures have been taken to ensure the protection of personal data in accordance with the level of protection of personal data in Latvia and the EU/EEA.

10.3. Personal data may be transferred for processing outside the EU/EEA if an insured event has occurred, you are located in a country outside the EU/EEA. For example, an accident has occurred and it is necessary to provide assistance, including services related to your health.

11. Processing and storage of personal data

11.1. Personal data will only be processed for as long as is necessary to achieve a specific purpose of data processing. The storage period shall be justified as long as at least one of the following conditions exists:

11.1.1. Offers of an insurance contract are stored for 30 days. Personal data necessary for the performance of contractual obligations will be stored until the contract is performed and until other storage periods are fulfilled;
11.1.2. personal data that must be stored in order to comply with the requirements of regulatory enactments will be stored for the time periods specified in the relevant regulatory enactments, for example, supporting accounting documents must be stored for not less than five years;
11.1.3. data in order to prove the fulfilment of obligations shall be stored, taking into account the limitation period of the claim in accordance with the limitation periods for claims specified in regulatory enactments – 3 years specified in the Insurance Contract Law, 10 years specified in the Civil Law and observing other time periods specified in regulatory enactments.

11.2. We delete or anonymise unnecessary or irrelevant personal data. You can refuse the processing of your personal data by notifying us in the form of a written application, insofar as the processing of personal data is not related to our obligations and rights in accordance with regulatory enactments.

12. Your rights and obligations

12.1. We ensure the following rights for you:

12.1.1. Right of access to your data:

If you want to access your personal data that is being processed, please contact us with a written application.

12.1.2. Right to rectification of your data:

If you wish to correct inaccurately provided personal data or to supplement incompletely provided personal data, taking into account the purposes of processing, please contact us with a written reasoned application.

12.1.3. The right to object to the processing of your data on the basis of your consent:

If you want to withdraw your consent to the processing of your personal data on our portal, submit a written application to us. In case of a justified request, we will stop processing your personal data.

12.1.4. Right to erasure or right to be forgotten:

If you wish to delete your personal data, submit a written application to us. We will evaluate each case separately and provide you with a reasoned answer.

12.1.5. Right to object to automated data processing:

We carry out automated processing of personal data in the form of health insurance for the calculation of insurance claims without the involvement of employees. You have the right to request that we manually recalculate the paid insurance benefit if you have reasonable suspicions that the automatically calculated payment of the insurance compensation is incorrect.

12.1.6. Right to data portability:

If you want to receive all your data or transfer your data to another insurance provider, submit a written request to us.

12.1.7. Right to lodge complaints about data processing:

You have the right to submit complaints about the use of personal data to the Data State Inspectorate if you believe that we violate your rights and interests in the processing of personal data in accordance with the applicable laws and regulations.

12.2. Your responsibilities so that we can provide you with a proper and thorough service:

12.2.1. provide us with accurate personal data about yourself as a policyholder or insured person, or about insured persons or beneficiaries.
12.2.2. update your personal data at least once a year or contact us within a reasonable period if there have been changes in your personal data.
12.2.3. provide us with your exact contact information so that we can contact you. You can update your contact details yourself by doing so on our website or in our mobile app.
12.2.4. Already before starting cooperation, get acquainted with this Privacy Policy, as well as introduce it to any person related to the receipt of our services and whose interests may thus be affected in the processes of processing his personal data.

13. Contacts

13.1. You have the opportunity to contact us regarding questions about withdrawal of consent, requests, exercise of data subjects’ rights and complaints about the use, processing, including profiling of personal data.

13.2. You can write an e-mail to bta@bta.lv or write to the address Sporta iela 11, Riga, LV-1013, Latvia.

13.3. Contact details of the Data Protection Officer: bta@bta.lv or dpo@bta.lv or by writing to the address Sporta iela 11, Riga, LV-1013, indicating – to the Data Protection Officer.

14. Validity and amendments to the policy

14.1. We have the right to unilaterally amend this policy at any time by posting it on our website.

14.2. This policy is available to you on our website www.bta.lv