Privacy Policy
1. Who We Are
Cosmos Insurance Public Company Ltd (“the Company”, “we”, “us”) is an insurance company that has carried out insurance business across Cyprus for decades. It offers motor, accident and health, property, liability and other general insurance products through its Head Office in Nicosia, its customer service branches in Larnaca, Limassol and Paphos, and its network of intermediaries.
The Company is the controller of the personal data described in this Policy. Its contact details are:
Item | Details |
Registered office | 46 Griva Digeni Avenue, 1080 Nicosia, Cyprus |
Telephone | 22796000 |
Website | |
Data Protection Officer (DPO) | dpo@cosmosinsurance.com.cy, or by post to the registered office, marked “For the attention of the Data Protection Officer” |
This Policy explains, in a clear and transparent way, which personal data we collect, why and on what legal basis, how we use and protect it, who we share it with, how long we keep it, and what rights you have.
2. Who This Policy Applies To
This Policy applies to natural persons whose personal data we process, including:
- current and prospective policyholders and insured persons;
- beneficiaries, named drivers and dependants;
- claimants and third parties involved in claims, as well as witnesses;
- intermediaries and their staff, suppliers and associates;
- visitors to our premises and website;
- job applicants.
Our employees are informed through a separate employee privacy notice. If you provide us with the personal data of another person, for example a named driver, a beneficiary or a dependant, please make them aware of this Policy.
3. The Personal Data We Process
Depending on the insurance product or service and your relationship with us, we process the following categories of personal data:
Category | Examples |
Identification and contact data | Full name, date of birth, identity card or passport number, nationality, address, telephone, email, occupation |
Policy and underwriting data | Proposal details, cover, insured amounts, property and vehicle details, title deeds, previous insurance record and claims history, guarantors’ details |
Driver data (motor insurance) | Driving licence, date of birth and occupation of drivers, previous claims, previous convictions for traffic offences |
Claims data | Accident and incident details, damages, photographs, expert and assessor reports, witness details, correspondence |
Health data (special category) | Medical history and records, diagnoses, test results, medical certificates and costs, for you and your dependants, where needed for accident & health insurance or for claims involving injury |
Financial data | IBAN and bank details, payment card or standing order details, premiums, payments and claim settlements |
Criminal offence data | Convictions for traffic offences and, where permitted by law, information relevant to fraud prevention |
Communications and online data | Correspondence, complaints, call notes, website and online portal usage, technical data such as IP address |
Marketing preferences | Consents and preferences for marketing communications |
Job applicant data | CV, qualifications, certificates, employment history, interview notes |
Intermediary and supplier data | Contact details, contract details, bank details, tax identification number |
Images | CCTV images at our Head Office |
4. How We Collect Your Personal Data
We collect personal data:
- directly from you: through proposal, application, claim and complaint forms, by telephone, email, in person, through our online services and payment channels (e.g. JCC), and when you apply for a job;
- from third parties: through our intermediaries (agents and brokers), other insurance companies and insurance bodies, policyholders who name you (for example as a driver or beneficiary), doctors and other health professionals, assessors and experts, lawyers, banks, the Police, the Financial Ombudsman, and publicly available sources.
5. Why We Use Your Personal Data and Our Legal Basis
Purpose | Legal basis (GDPR) |
Assessing proposals, underwriting, issuing and administering policies, collecting premiums | Performance of a contract, or steps at your request before entering into a contract (Article 6(1)(b)) |
Handling and settling claims, providing assistance services, managing disputes | Performance of a contract (Article 6(1)(b)); our legitimate interests in handling claims by third parties (Article 6(1)(f)) |
Processing health data for accident & health insurance and for injury claims | Your explicit consent, or the establishment, exercise or defence of legal claims, or another condition of Article 9(2) GDPR and Law 125(I)/2018, as applicable |
Compliance with legal and regulatory obligations (insurance supervision, tax, accounting and, where applicable, anti-money laundering) | Legal obligation (Article 6(1)(c)) |
Prevention, detection and investigation of fraud and other crime | Legitimate interests (Article 6(1)(f)); legal obligation where applicable |
Reinsurance, risk management, statistics and improving our products and services | Legitimate interests (Article 6(1)(f)) |
Communicating with you, handling complaints and enquiries | Performance of a contract; legitimate interests; legal obligation |
Marketing communications | Your consent (Article 6(1)(a)), which you may withdraw at any time |
Recruitment | Steps before entering into a contract (Article 6(1)(b)); legitimate interests |
Security of our premises and systems, including CCTV | Legitimate interests (Article 6(1)(f)) |
Establishing, exercising or defending legal claims | Legitimate interests (Article 6(1)(f)); Article 9(2)(f) for special categories |
Most of the personal data we request is necessary to enter into and perform the insurance contract, or to handle a claim, and some is required by law. If you do not provide it, we may be unable to provide insurance cover or settle a claim.
6. Automated Decisions and Profiling
In underwriting and pricing, we may use automated assessment of the information you provide, for example rating factors such as age, vehicle, driving record and claims history, to determine eligibility and premiums. Where a decision based solely on automated processing produces legal or similarly significant effects for you, it is made only where permitted by GDPR Article 22. You have the right to obtain human intervention, to express your point of view and to contest the decision, by contacting the DPO.
7. Who We Share Your Personal Data With
We share personal data only where necessary, and only the minimum data required:
- other controllers, such as:
- reinsurers, other insurance companies and insurance bodies;
- intermediaries;
- doctors, hospitals and laboratories;
- assessors and experts;
- lawyers and courts;
- banks;
- the Financial Ombudsman;
- auditors;
- competent public authorities and supervisory bodies, such as the Insurance Companies Control Service, the Tax Department, the Social Insurance Services and the Police, where required by law;
- processors acting on our behalf, under written agreements that comply with GDPR Article 28. Examples are IT, cloud, hosting and backup providers, records storage, claims management and assistance service providers, and debt collection agencies.
We do not sell personal data, and we do not use it for purposes incompatible with this Policy.
7.1 Transfers Outside the European Economic Area
Where personal data is transferred outside the European Economic Area, for example to reinsurers or service providers, we do so only where the European Commission has recognised the country as providing adequate protection, or where appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses. You may request information about these safeguards from the DPO.
8. How Long We Keep Your Personal Data
We keep personal data only for as long as necessary for the purposes described, and for the periods required by law or needed for the establishment or defence of legal claims. The main retention periods are:
Data | Retention period |
Quotations not taken up | 1 year from the quotation |
Policy and underwriting records | 10 years from the end of the policy |
Claims records | 10 years from the closure of the claim (longer for injury claims involving minors) |
Accounting and payment records | 7 years from the end of the financial year |
Complaints | 6 years from closure |
Marketing data | Until you withdraw your consent |
Job applicants (unsuccessful) | 6 months from the end of the recruitment process |
CCTV images | Up to 21 days, unless needed for an investigation |
Where a longer period is required by law, or the data is needed for pending legal proceedings or an investigation, it is kept until these are concluded.
At the end of the retention period, the data is securely destroyed or anonymised. Electronic data is permanently deleted using secure deletion methods, and storage media is wiped or physically destroyed. Paper records are shredded or destroyed by a confidential destruction service.
9. How We Protect Your Personal Data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include access controls and multi-factor authentication, encryption, monitoring, backups, staff training and physical security. Health data is subject to additional restrictions. Our information security measures are regularly reviewed and tested.
10. Your Rights
Under the GDPR, you have the right:
- of access: to obtain confirmation of whether we process your personal data and a copy of it;
- to rectification: to have inaccurate or incomplete data corrected;
- to erasure: to have your data deleted where there is no longer a lawful reason for us to keep it (for example, data that we must keep by law cannot be erased);
- to restriction: to have processing restricted, for example while the accuracy of the data is checked;
- to object: to processing based on our legitimate interests, and at any time to direct marketing;
- to data portability: to receive the data you provided to us, in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
- to withdraw consent: at any time, without affecting the lawfulness of processing before withdrawal;
- not to be subject to a decision based solely on automated processing that significantly affects you, subject to the exceptions of Article 22 (see Section 6).
To exercise your rights, contact the DPO at dpo@cosmosinsurance.com.cy or at our registered office. We may ask you to verify your identity. We respond without undue delay, and in any case within one month, which may be extended by two further months for complex requests, in which case we will inform you. Exercising your rights is free of charge.
11. Complaints
If you have a concern about how we process your personal data, please contact our DPO first, so that we can address it. You also have the right to lodge a complaint with the supervisory authority:
Item | Details |
Supervisory authority | Office of the Commissioner for Personal Data Protection |
Address | Iasonos 1, Nicosia |
Telephone / email | 22818456/ commissioner@dataprotection.gov.cy |
Website |
12. Changes to This Policy
This Policy is reviewed at least annually, and whenever our processing or the law changes. The current version is always available on our website, and a printed copy is available on request.
Last updated: [23/07/2026].