Data protection.

The controller under the GDPR is HEIMA Versicherung GmbH [company name to be confirmed], based in Hamburg, Germany. The full address will be added upon authorization.

You can reach our Data Protection Officer at datenschutz@heima.de.

Depending on how you interact with us, we process the following categories of personal data:

• Master data (name, address, date of birth, contact details)
• Contract and risk data (property, building and policy details, claims history)
• Communication data (email, phone, correspondence, meeting and advisory notes)
• Usage data (log files, IP address, browser, access time) when visiting our website

We process your data exclusively on the basis of the GDPR:

• Art. 6 (1)(b) GDPR – contract initiation, contract execution, and claims handling
• Art. 6 (1)(c) GDPR – compliance with legal obligations (incl. German VAG, VVG, GwG, HGB, AO)
• Art. 6 (1)(f) GDPR – legitimate interests (fraud prevention, IT security, direct marketing to existing customers)
• Art. 6 (1)(a) GDPR – consent (e.g. newsletter, optional cookies)

Recipients of your data are limited to those needed to deliver and service your contract: risk carriers and reinsurers, IT and hosting providers, loss adjusters and claims specialists, banks and payment providers, and supervisory, tax and law-enforcement authorities where legally required. Processors are bound by data-processing agreements under Art. 28 GDPR.

We use cookies and similar technologies only where technically required or where you have consented (§ 25 TTDSG):

• Strictly necessary cookies: enable site operation, language settings, and security features. The site cannot work without them.
• Statistics / analytics: anonymous reach measurement so we can improve our content (consent only).
• Marketing: cookies for personalized content and advertising (consent only).

You can withdraw your consent at any time via the cookie settings in the page footer.

We retain personal data only for as long as needed for the stated purposes. Contract and claims data are subject to German commercial and tax retention periods (generally 6 or 10 years after the policy ends).

• Right of access to your stored data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR), and to withdraw consent at any time with effect for the future

Right to lodge a complaint: you may contact a data protection supervisory authority at any time — for us, this is the Hamburg Commissioner for Data Protection and Freedom of Information.

For questions, requests, or to exercise your rights, contact us at datenschutz@heima.de.