Privacy Policy

OrbitProtect is committed to the safe and careful use of your personal information. We take reasonable steps to protect any personal information you provide to us from misuse, interference, loss, unauthorised access, modification or disclosure. We will always be open and transparent with you about how we handle information.

1.  OrbitProtect covered by this Privacy Policy

OrbitProtect Limited is a travel insurance supplier. In this Privacy Policy, when we refer to "OrbitProtect", "we", "our" or "us", we mean OrbitProtect Limited.

For more information about OrbitProtect Limited, please see our about us page. 

2.  The Purpose of the Privacy Policy

This Privacy Policy ("this Policy") outlines how we manage your personal information. It also describes generally the type of personal information held and for what purposes, and how, that information is collected, stored, used, disclosed and destroyed or de-identified.

This Policy will be reviewed at least annually to ensure it remains up to date. It was first prepared in March 2020 and may be amended from time to time by posting the amended version on our website.

Further Information

For further information on privacy in New Zealand, please visit the website of the Office of the Privacy Commissioner at http://privacy.org.nz

Your personal information

3. What is personal and health information?

Personal information is information that can identify or reasonably identify you.

The provision of your personal information is voluntary. However, if you choose not to provide us with the information we have requested, we may not be able to provide you with our services or products or properly manage and administer services and products provided to you or others.

We will only collect personal information to assist or enable us to perform one or more of our functions or activities. We collect the personal information we need to provide travel insurance and travel-related products and services, including assistance when you are travelling.

The type of information OrbitProtect collects and holds varies depending on the type of product or service we provide to you. For example, OrbitProtect will hold different information about you if you have a travel insurance policy than if you make a claim on a policy or require assistance when travelling. This information may include information about a permanent or temporary medical condition that you have or health information in general.

OrbitProtect regularly collects, holds, uses and discloses health information and is committed to protecting the privacy of this type of information to a higher degree than that of other personal information.

OrbitProtect may collect and hold personal information (including health information) regarding:

• Your travel plans;
• Information about your medical history and the medical history of any other person you wish to insure;
• Health information about anyone who requires assistance under their travel insurance policy;
• Information about the medical history of any person that results in a claim that we have to assess;
• Information about claims you make or wish to make under your Policy;
• Your bank account details so that we may process the payment of your claim;
• The last eight digits of your credit card so that we may recover any monies payable under the travel insurance provided by the credit card company;
• Other information required to administer the product or services you have requested including determining a claim;
• Any details contained within identity documents provided to us including government identifiers such as a passport number;
• The type of medical and non-medical assistance you have been provided with either by us, our service providers or your own medical practitioner;
• Employment and income information for cancellation and loss of income claims;
• Background and credit checks (for authorised representatives and suppliers only); and
• Any information contained within the OrbitProtect corporate mobile application where you have authorised us to do so.

 4.  How we collect your personal information

OrbitProtect collects personal information from and on behalf of customers, business partners, suppliers, employers (relating to corporate policies), other insurers and third-party service providers.

We will if it is reasonable or practicable to do so, collect your personal information directly from you. This may happen when you fill out an application form for travel insurance, become one of our representatives, make a claim or request assistance. This may occur over the phone, via email, a website or through one of our agents or partners.

In some instances, we collect your personal information from third parties. For example, we may need to collect personal information from your representative (such as a legal guardian), the primary policyholder, OrbitProtect's authorised affiliate, your travel consultant or any of the other organisations.

In addition, we collect information when you visit our website, Facebook page and other pages that we own and manage.

We may also collect information by other means and will take reasonable steps to inform you if and when we do if not already explained in this Policy.

5.  How we collect your personal and health information

Your health information, such as pre-existing medical conditions, is generally required to arrange travel insurance and travel-related products and services, to decide on a claim or to provide you with medical assistance.

Suppose you provide health information to your OrbitProtect authorised affiliate to provide to us as part of the policy application or claims process. In that case, we rely on you having provided them with your consent to disclose this information to us. In addition, when you provide information about other individuals on your travel insurance policy, we rely on you to inform them of the information you are providing, how we will use, hold, collect and disclose this information and on you obtaining their consent.

We may collect your personal information from OrbitProtect's mobile application. We will only do this if you have given your consent.

If we do not have your consent, we will not collect your personal information. This is subject to some exceptions including where the collection, use and disclosure of the information:

• is necessary for the provision of emergency assistance;
• is required by law; and
• is necessary for the establishment, exercise or defence of a legal claim.

6.  Use, transfer, handling and sharing of your personal information

A.   To provide you with products and services

We use your personal information to provide you with the products or services you have requested, including:

• Assessing your travel insurance application;
• Identifying you, to manage and administer the product or service;
• Assessing and paying a claim; or
• To provide you with emergency assistance when travelling.

When handling claims, OrbitProtect only uses personal information which is relevant to making a decision about the claim.

We may also use the information to send you material about OrbitProtect's other products or services or products and our business partners' services as described in Section 10 (Marketing our products and services). We will only use your personal information for this purpose if you have consented to that use.

We may also use or disclose your personal information for another purpose for which you may reasonably expect it to be used or disclosed by us and that secondary purpose is related or directly related to the purpose for which it was collected.

Otherwise, we will only use your information for a secondary purpose if you have consented to this use or disclosure, the use or disclosure is required by law or an enforcement body or to provide assistance in a medical emergency.

We use and in some instances, disclose your personal information when we, or third parties appointed by us, provide the following services:

• Identify you and other policyholders;
• Arrange and manage your travel insurance with us;
• Assess an application for a product, including determining any existing medical conditions;
• Evaluate, manage, process and pay an insurance claim;
• Recover monies due from other insurers;
• Assess the emergency care and assistance you require;
• Provide medical and non-medical assistance, including settling costs on your behalf;
• Deal with enquiries or complaints;
• Monitor and improve the services provided by us, our agents or service providers, the products we offer or our operations;
• For planning, product development and research purposes and to seek feedback on products and services (including those products and services provided by others on our behalf);
• Carry out market analysis and research and product and pricing analysis and development;
• Enhance our services for our website visitors;
• Conduct internal investigations in relation to crime and fraud prevention, detection or prosecution;
• Train our staff;
• Identify and develop products or services that may interest you and market them to you (unless you ask us not to do so);
• Carry out accreditation or certification activities;
• Process orders or applications to become a customer for our additional  products and services,
• Carry out credit checks, credit reporting and compliance checks;
• Carry out debt-recovery functions; and
• Manage and authenticate customer data.

9.  Protecting your personal information

We take reasonable steps to securely store your personal information so that it is protected from unauthorised use, access, modification or disclosure. We store personal information in different ways, including in paper and electronic form, on both OrbitProtect premises and its data centres and our service providers premises and data centres, which include IT service providers and document storage and management providers.

We maintain administrative, technical, and physical safeguards for the protection of personal information. Our security measures include, but are not limited to:

Administrative safeguards:

•  Access to your personal data is limited to authorised personnel who have a legitimate need to know based on their job. In the case of third-party contractors who process personal information on our behalf, similar requirements are imposed. Where an individual employee no longer requires access, that individual's access is revoked.
• Only allowing access where the individual seeking access has satisfied our identification requirements, such as a security check on the commencement of a call.
• Confidentiality requirements for our employees and suppliers.
• Secure Document storage.
• Training and education are provided to all group employees in the handling of personal information.

Technical safeguards:

• Security measures for systems access.
• Antivirus and anti-malware software, and regularly updated virus definitions.
• Third parties who we hire to provide services and have access to personal information agree to implement privacy and security practices that we deem adequate.
• Personal information provided on computer servers is secured in a restricted and controlled network environment.
• When transferring credit card numbers, via payment gateways, the data is encrypted.
• Employing firewalls and intrusion detection systems.

 Physical safeguards:

• Third-party contractors who process personal data on our behalf agree to provide reasonable physical safeguards.
• Employing physical and electronic means such as alarms and cameras to protect against unauthorised access to buildings.
• Effectively and securely destroying data no longer needed, for example, by shredding or pulping in the case of paper records.
• Our security procedures and policies are audited on a regular basis to ensure they are updated in accordance with current legal requirements and current levels of security technology.

While OrbitProtect has security measures in place to protect your data, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, OrbitProtect cannot warrant or ensure the security of any information you transmit to us, or we transmit on your behalf, or to you, in the course of providing services over the internet.

10.  Marketing our products and services

We may from time to time, provide you with information about other products, services and offers.

If you do not wish to receive this information, or wish to know the source of information, please contact the OrbitProtect customer service team on 0800 478 833 (within New Zealand). You can change your mind about receiving information about our products and services at any time, by contacting us or using the opt-out process on our offers or promotional communication.

Please note we will still need to send you essential information about your insurance, travel alerts, policy and claim documentation.

11.  When we share your information with other parties

Other than as stated in this Privacy Policy, we will only share (disclose) your personal information with third parties if it is required to fulfil service or product obligations to you, or if it is required under law or in an emergency.

Before discussing the progress of a claim or the medical and non-medical assistance that we provide with third parties (other than the parties involved in providing such a service), for example, a relative or companion, we will obtain appropriate consent from you, your parent or guardian, power of attorney or executor (as relevant).

Below are the types of entities OrbitProtect may collect your personal information from and may disclose your personal information to (This is not an exhaustive list.):

• Our Insurer, Zurich Australian Insurance Limited trading as Zurich New Zealand;
• Other insurers, including your insurer if not OrbitProtect and Re-insurers;
• Co-insured/s on any insurance policy so that we may confirm details of the insurance;
• Your OrbitProtect authorised affiliate who sold you the travel insurance;
• Claims administrators;
• Investigators, in relation to claims;
• Translators, for claims and assistance;
• Goods replacement suppliers to settle your claim;
• Banks and foreign currency providers to settle your claim;
• Transportation and accommodation providers;
• Travel consultants and wholesale travel agencies;
• Any company who we may claim against;
• Medical practitioners and specialists;
• Medical providers such as hospitals;
• Emergency assistance providers;
• Security providers and consultants;
• Family members in the event of a medical emergency;
• Witnesses, when making a claim;
• Record management and storage businesses;
• Companies who perform statistical analysis on our behalf;
• Our professional advisors including lawyers, accountants, tax advisors and auditors;
• Debt collection agencies and other parties that assist with debt-recovery functions;
• Police and law enforcement bodies to assist in their operations;
• Courts of Law or as otherwise required or authorised by law;
• Regulatory or government bodies to resolve customer complaints or disputes both internally and externally or to comply with any investigation by one of those bodies;
• Insurance reference bureaus;
• Data retrieval agencies;
• Credit providers or credit reporting agencies (if you are our authorised representative or supplier); and
• Printing, mail and distribution companies.

 12.  Collection of other information

OrbitProtect may also collect non-personally identifiable information such as the type of browser, or operating system you use, your domain name, IP address, access times, referring website addresses and page views. Our Internet Service Provider ("ISP") automatically identifies your computer by its IP address. When you visit pages on our website, our ISP may log your IP address. We do not link IP addresses to any personally identifiable information. Your IP address is used to gather broad demographic information only. A User Transaction ID is created each time you enter our website. This ID is used to keep track of your dealings with us and other requests.

Cookies

OrbitProtect uses cookies in several different ways, and some of our cookies collect information which can personally identify you.

A cookie is a small, text-based file used frequently on some websites and portals. They are designed to assist and streamline the exchange of information between your computer's browser and our computer systems. Some cookies used by OrbitProtect collect information about the use of our websites. The data collected includes where visitors connect from, what version of the browser they use and their path through the site. It helps us to provide personalised features and keep our content fresh and relevant.

If you are a current or former customer of OrbitProtect, we may use a unique cookie that identifies you. We may use the cookie to collect the website and browser information referred to above and may combine that information with your customer history and other personal information we hold about you. We may use and disclose the combined information for performing the analysis services and sending you marketing communications and targeted advertising as described in this Policy, as well as using and disclosing it for the other purposes described in this policy.

If you do not want information collected through the use of cookies, you can configure your cookie preferences and options through your browser.

Web beacons

Our web pages may contain electronic images, known as web beacons or spotlight tags. These enable us to count users who have visited certain pages of our website. Web beacons and spotlight tags are not used by us to access your Personal Information. They are simply a tool we use to analyse which web pages customers view, in an aggregate number.

Links to other websites

Our web sites may contain links to other websites. Whilst such links are provided for your convenience; you should be aware that the information handling practices of the linked websites might not be the same as ours.

Dealing with OrbitProtect

13.  Resolving your privacy issues

Please contact us if you have concerns about how we have handled your personal information or would like to discuss any issues about our Privacy Policy. You are always welcome to speak directly to our staff, and they will do their best to resolve your issue. We also have a complaints process, including external dispute resolution and a nominated Privacy Officer who can be contacted as detailed in the Contact Us section.

14.  Gaining access to and correcting your personal information

You can request access to your personal information in most cases without restriction or charge. If charges are applicable for providing access, we will disclose these charges to you prior to providing you with the information. In limited circumstances, an access request may be denied, or restricted access is given. We will provide reasons in writing for the denial of or limitation on access.

To arrange access, please contact us (see the Contact Us section). In some cases, we may be able to deal with your request over the telephone. Access to the requested information may include providing you with copies of the original documentation, providing you with the opportunity for inspection of the documentation at our premises or providing you with a summary.

We will correct personal information if we discover, or you can show that the data is incorrect. If you seek correction and OrbitProtect disagrees that the information is incorrect, we will provide you with our reasons for taking that view and advise you on the further steps you may take.

15.  Dealing with us anonymously or under a pseudonym

You can deal with us anonymously, or you may use a pseudonym where it is lawful and practicable to do so. For example, you may inquire about our products or request a quote. However, we regret that we will not be able to offer you travel insurance, assess and pay your claim, appoint you as our authorised representative or provide you with medical and non-medical assistance if we cannot identify you.

16.  OrbitProtect authorised affiliates and your personal information

We require our authorised affiliates, agents and partners to handle your personal information in a manner consistent with this Policy. OrbitProtect trusted affiliates are authorised to arrange your travel insurance.

We rely on you having provided your OrbitProtect authorised affiliate with your consent if you would like us to share information about your claim or existing medical condition assessment with them. You may choose to deal directly with OrbitProtect if you prefer not to provide them with information about existing medical conditions and health-related matters included in your claim.