Privacy and Personal Data Protection Policy
At COINS we respect your personal data. This policy explains in plain terms what data we collect, why, who we share it with, how long we keep it and what rights you have, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019 and the insurance distribution legislation (Law 4583/2018).
1. Who we are and how to contact us
The controller of your personal data is Cooperative Insurance Agents Ltd (ΚΟΟΠΕΡΕΙΤΙΒ ΑΣΦΑΛΙΣΤΙΚΗ ΠΡΑΚΤΟΡΕΥΣΗ ΕΠΕ), trading as COINS, an insurance intermediary.
| Address | 43 Ilektras Street, 151 22 Marousi, Greece |
| VAT No. / Tax office | 997865400 / Marousi |
| General Commercial Registry (GEMI) | 069866503000 |
| Register of insurance intermediaries | Athens Professional Chamber, Reg. No. 310482, Special Register of Insurance Agents No. 550 |
| Telephone | +30 210 28 50 500 |
| Email for data protection matters | coinsltd@coinsltd.gr |
For any question about your data, email us at the address above with the subject “Personal data”. The company has not appointed a Data Protection Officer (DPO), as the law does not require one given its size and volume of processing. Your requests are handled directly by management.
2. What data we collect
We collect only what we need to advise you and to manage your insurance:
- Identity and contact details: full name, date of birth, ID card number, tax number (AFM), social security number (AMKA), address, telephone, email.
- Data for assessing the risk: occupation, family status, vehicle or property details, insurance history.
- Financial data: IBAN and payment details for premiums or claims. For investment and life insurance products, also the information required to assess suitability and appropriateness and by anti-money laundering legislation.
- Health data: only when the insurer requires it for life or health insurance (health questionnaire, medical documents, claim documents). This is a special category of data and we handle it with enhanced protection.
- Website data: what you write in the contact form, IP address and cookies (see section 7).
Where we get it from: mainly from you, at our office, by phone, by email or through the website. Also from the insurers we work with, from your employer if you are a member of a group scheme, and from public sources where the law permits.
Other people’s data: if you give us details of family members or beneficiaries, please inform them and show them this policy. For minor children, the parent or guardian provides their data and gives consent on their behalf.
If you give us wrong or incomplete information, the insurer may refuse or cancel the cover or decline to pay a claim.
3. Why we use it and on what legal basis
Every use of your data rests on a legal basis under the GDPR:
| Purpose | Legal basis |
|---|---|
| Quotations, conclusion, renewal and management of policies, support with claims | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) |
| Health data for life or health insurance and for claims | Your explicit consent (Art. 9(2)(a) GDPR) and, where needed, the establishment or exercise of legal claims (Art. 9(2)(f)) |
| Insurance intermediary obligations (demands-and-needs assessment, pre-contractual information), anti-money laundering checks, tax and accounting obligations, replies to supervisory authorities | Legal obligation (Art. 6(1)(c) GDPR, Law 4583/2018, Law 4557/2018) |
| Handling of requests and complaints | Legal obligation and performance of a contract |
| Reminders about expiries, renewals and gaps in cover for our existing clients | Legitimate interest (Art. 6(1)(f) GDPR), with the right to object at any time |
| Security of our systems and website | Legitimate interest |
| Newsletters and offers to people who are not our clients, satisfaction surveys | Consent (Art. 6(1)(a) GDPR) |
You can withdraw any consent at any time, without affecting what was done before. If you withdraw consent for health data, the insurer may be unable to provide cover or assess a claim. Health data is never used for marketing.
COINS does not make decisions about you by automated means. Decisions on accepting a risk, the premium and claims are made by the insurer, under its own privacy policy.
4. Who we share it with
We do not sell or rent your data. We share it only as needed with:
- The insurance companies you choose, for quotations, policy issue and claims. Each insurer is an independent controller and applies its own privacy policy.
- The insurers’ network partners in claims handling, such as doctors, hospitals, loss adjusters and roadside assistance companies.
- Partners who support us technically, such as email and cloud services, client management software, website hosting, our accountant and courier services. They process data only on our instructions and are bound by a confidentiality agreement.
- Public and supervisory authorities, such as the Bank of Greece, the Chamber, the Independent Authority for Public Revenue (AADE) and judicial authorities, only when required by law.
Transfers outside the European Union: as a rule your data stays within the European Economic Area. If a technical partner processes it outside the EEA, this happens only with the safeguards of the GDPR: a European Commission adequacy decision or standard contractual clauses.
5. How long we keep it
We keep your data for as long as our relationship lasts and afterwards for as long as the law requires, or as needed to protect you and us in a possible dispute. After that we delete or anonymise it securely.
| Data | Retention period |
|---|---|
| Client file and policies | For the duration of the relationship and up to 20 years after the last contract ends (general limitation period, Art. 249 Greek Civil Code) |
| Anti-money laundering records (life and investment products) | 5 years after the end of the relationship (Law 4557/2018) |
| Accounting and tax records | As long as tax and accounting legislation requires |
| Quotations that did not lead to a policy | 1 year from the quotation |
| Requests and complaints | 5 years from their resolution |
| Website contact form enquiries with no follow-up | 1 year |
| Data for newsletters | Until you withdraw your consent |
If a dispute or an authority investigation is pending, we keep the relevant data until it is finally concluded.
6. Your rights
You can ask us at any time for:
- Access: to find out what data we hold and receive a copy.
- Rectification: to correct or complete your data.
- Erasure: to delete data, unless the law requires us to keep it.
- Restriction: to pause its use temporarily, for example while we check a correction.
- Portability: to receive the data you gave us in electronic form, or have it sent to someone else.
- Objection: to object to a use based on our legitimate interest. For newsletters we stop immediately.
- Withdrawal of consent: at any time, free of charge.
How: email coinsltd@coinsltd.gr or write to our address. We reply within one month. For complex requests this may be extended by up to two further months, and we will let you know. The service is free of charge. To protect you, we may ask you to confirm your identity.
Complaints: if you believe we have not respected your rights, you can lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, 115 23 Athens, www.dpa.gr). We recommend you contact us first so we can resolve it quickly.
7. Security, cookies and changes
Security: we protect your data with passwords and access rights limited to the staff who need it, encryption, backups and a confidentiality obligation for our staff. If a breach occurs that puts you at risk, we notify the Authority within 72 hours and, where the risk is high, we also notify you.
Cookies: the website uses, without consent, only the cookies that are necessary for it to work. For statistics or marketing cookies we ask for your consent first (Law 3471/2006, Art. 4(5)). You can change your choices at any time through the “Cookie Settings” link at the bottom of every page.
Minors: the website is not addressed to persons under 18. We receive the data of children insured under family policies only from their parent or guardian.
Changes: we review this policy when the law or the way we work changes. The current version is always published here. For significant changes we will also notify our clients by email.
If there is any discrepancy between this English version and the Greek version, the Greek version prevails.
Last updated: October 2026