CULTURAL INSURANCE SERVICES INTERNATIONAL
Cultural Insurance Services International (CISI) Privacy Policy
Cultural Insurance Services Internal, Inc. (CISI) (“we”/ “our”/ “us”) provides insurance for study abroad and international students. We take your privacy very seriously and are committed to protecting and respecting your privacy.
This Policy, together with a) our Website Terms of Use, and b) our Cookie Policy (each as described in OTHER TERMS WHICH MAY APPLY TO YOU below), applies to personal information that we collect about you.
Where we refer to the “CISI Website” in this Policy, we mean the websites which can be accessed at https://www.culturalinsurance.com/ (including any updates or supplements to them any subsequent URL which may replace this website, and all associated websites, URLs and micro sites), and where we refer to the “CISI Policy”, we mean CISI World Class Coverage (Group and Voluntary), CISI Bolduc and/or CareMed USA.
Please read this Policy carefully to understand our views and practices regarding your personal information and how we will treat it.
TOPICS COVERED:
- WHO THIS POLICY APPLIES TO
- OTHER TERMS WHICH MAY APPLY TO YOU
- INFORMATION WE COLLECT (INCLUDING WHEN AND HOW WE COLLECT IT)
- HOW WE USE YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO
- SHARING YOUR INFORMATION
- RETAINING YOUR INFORMATION
- KEEPING YOUR INFORMATION SECURE
- UPDATING AND ACCESSING YOUR INFORMATION
- YOUR RIGHTS
- MARKETING
- OTHER WEBSITES
- CHANGES TO THIS POLICY
- HOW TO CONTACT CISI
WHO THIS POLICY APPLIES TO
This Policy applies to:
- “Participant”, i.e. someone whom has enrolled or plans to enroll in a CISI policy voluntarily for international travel as related to an educational or cultural exchange organization or someone whom has been enrolled by a Sponsor in a CISI Policy to travel internationally with their educational or cultural exchange program.
- “Sponsor Contact” i.e. someone whom represents an educational or cultural exchange organization whose international travellers are insured through a CISI policy or someone whom represents an educational or cultural exchange organization that has completed a form on our website requesting a quote for their international travellers.
- “Web Site Visitors” to the CISI Website, i.e. someone who visits and/or uses the CISI Website but who does not enroll or request a quote for a policy.
Unless we say otherwise, the terms of this Policy apply to all Participants, Sponsor Contacts and Website Visitors.
OTHER TERMS WHICH MAY APPLY TO YOU
This Policy refers to the following additional terms, which also apply to your use of the CISI Website and, if applicable, your CISI Policy:
WEBSITE TERMS AND CONDITIONS
Our “Website Terms of Use” govern your use of the CISI Website.
COOKIE POLICY
Our “Cookie Policy” sets out information about the cookies we use on the CISI Website.
INFORMATION WE COLLECT (INCLUDING WHEN AND HOW WE COLLECT IT)
We collect the following personal information from and about you:
Information you give us
Information we collect when you visit the CISI Website
Information provided by third parties
Information you give us.
You may give us information about you:
- When requesting a quote for a policy (whether you are a Participant or Sponsor Contact).
- When a Participant enrolls in voluntary or group policy online.
- When a Sponsor Contact enrolls Participants in a group policy through our portal.
- If you contact or correspond with us (for example, by phone, e-mail or otherwise) for any other reason.
If you are a Participant, we will ask you for certain kinds of personal information to provide insurance coverage as well as services you may request. This information is collected;
- To enroll in a Voluntary Insurance Product
- you will be asked for your first and last name, your date of birth, your gender, your email address, your street address, your city, state and country, your zip code.
- We will ask for your dates of travel and the destination you plan to travel to.
- If you are not a United States Citizen and are enrolling for insurance coverage in the United States, you will be asked for the type of Visa you have and the Visa expiration date.
- To enroll in your Sponsor’s CISI plan on our Self Enrollment Web page,
- you will be asked for your first and last name, your date of birth, your gender, your email address, your street address, your city, state and country, your zip code.
- We will ask for your dates of travel and the destination you plan to travel to.
- If you access your myCISI Participant Portal:
- You will be asked for your first and last name, date of birth and email address in order to gain access to your account. Once the account is accessed you have the ability to edit or add your street address, city, state and zip, country, telephone number, email address, itinerary including dates and location of travel, emergency contact information.
- If you file a claim:
- You will be asked to complete a claim form which requires your first and last name, your date of birth, your address in your home country, your address in your host country, your email address, date and description of illness or injury. Depending on the nature of your claim, we can also ask for your insurance claim history and medical information (both historical and from your current treatment), information on your travel itinerary including airfare costs, travel dates and booking information, invoices from your sponsoring organization regarding your tuition or program fees, any applicable police reports or official documents addressing the theft or loss of personal property.
- If you require a reimbursement be made via wire transfer:
- You will be asked for your first and last name, full address associated with your banking institution and depending on the location of your bank, you will be asked for your banking institution’s name and address, the full name of the beneficiary on the account, the full address of the beneficiary, your account number, your account SWIFT code, your account IBAN number and your account SORT code.
If you are a Sponsor Contact:
- When you are enrolling your participants, you:
- must provide your participant’s first and last name, your participant’s date of birth, your participant’s gender, your participant’s email address, your participant’s street address, your participant’s city, your participant’s state and country, your participant’s zip code, your participants dates of travel and your participant’s destination(s).
- If your participant is not a United States Citizen and you are enrolling the participant for insurance coverage in the United States, you will be asked for the type of Visa you participant has and the Visa expiration date.
- When requesting a quote from the CISI Website, you:
- must provide us with your first and last name, the educational or cultural exchange school/university or program you represent, your professional title, your program’s street address, your program’s city, your program’s state, your program’s zip code, your email address and your phone number. You must also tell us the number of Participants you would like to quote a policy for, their age range, duration of the coverage you are looking for, the approximate start date of the policy and the destinations your Participants will be traveling to.
- When you are accessing the myCISI Sponsor Portal, you:
- Will be asked to provide your first name, last name, your professional title, your email address, your telephone number, your street address, your city, your state, country and zip code.
Information we collect when you visit the CISI Website.
Each time you visit the CISI Website, we will automatically collect the following:
- certain technical information, for example, the type of device (and its unique device identifier) you use to access the CISI Website, the internet protocol (IP) address used to connect your device to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, mobile network information and platform;
- information about your visit to the CISI Website, including the full Uniform Resource Locators (URL), clickstream to, through and from the CISI Website (including date and time), pages you viewed, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page; and
- [certain cookies that are capable of identifying your device (see our Cookie Policy to understand which cookies the CISI Website uses).]
Information provided by third parties.
If you are Participant, we will ask for certain types of information from third parties in order to service your policy and requests. This can be obtained when;
- You Sponsor enrolls you into a Group Policy and must provide;
- your first and last name, your date of birth, your gender, your email address, your street address, your city, your state and country and your zip code, your dates of travel and your destination(s).
- If you are not a United States Citizen and are being enrolled for insurance coverage in the United States, we will ask your Sponsor for the type of Visa you have and it’s expiration.
- Healthcare Providers submit a claim on your behalf and can provide:
- your first and last name, your date of birth, your date of birth, your gender, your address in your home country, your address in your host country, your email address, medical records or related documents that include your personal health information inclusive of current and historical medical care.
HOW WE USE YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO
We collect personal information so that we can operate effectively and provide you with the best possible service. The information we process depends on the context of your interactions with us and with the CISI Website. It also depends on the choices you make, for example the consents you provide, the functions you use and the privacy settings you select. You may choose not to provide or allow us to collect certain information, but if this is the case, we may be not be able to provide the some CISI services (where that information is necessary for us to do so). We will only process personal information where we have a valid lawful basis to do so.
Learn more below about how we use your information and what our legal basis is for using it if you are an:
- Participant
- Sponsor Contact
- Website Visitor
Participants
| Participant Type(s) of personal information we process | Type(s) of personal information we process | Type(s) of personal information we process |
|---|---|---|
| To help us identify you and any policy you hold with us (including verifying your eligibility to access and use the myCISI website). | To allow us to service the CISI policy under which you are covered and/or to take steps at your request prior to being enrolled into a CISI policy. |
| To enable us to consider your eligibility for a CISI policy. | To allow us to service the CISI policy under which you are covered and/or to take steps at your request prior to being enrolled into a CISI policy. |
| To carry out our obligations through the CISI policy under which you are covered and to provide you with information and services, inclusive of claims paying capabilities, that you request from us. | To allow us to service the CISI policy under which you are covered and/or to take steps at your request prior to being enrolled into a CISI policy. |
| To carry out our obligations through the CISI policy under which you are covered and to communicate and provide information to you during an emergency. | Your Consent |
| To deal with any enquiries, correspondence, concerns or complaints. | To allow us to service the CISI policy under which you are covered. |
| To carry out our obligations through the CISI policy under which you are covered and provide eligible payments. | To allow us to service the CISI policy under which you are covered. |
| Information we collect when you visit the CISI Website as described above | To conduct internal operations, including data analysis, testing, research, statistical purposes and troubleshooting. To ensure that content on the CISI Website is presented in the most effective manner for you and for your device. To analyse traffic to the CISI Website. As part of our efforts to keep the CISI Website secure and to prevent fraud. | To enable us to pursue our legitimate interests to:
|
Sponsor Contact
| Participant Type(s) of personal information we process | Type(s) of personal information we process | Type(s) of personal information we process |
|---|---|---|
In relation to you (i.e. the Sponsor Contact)
| To help us identify you and any policy you hold with us (including verifying your eligibility to access and use the myCISI website). | To allow us to service the CISI policy you hold for your participants. |
In relation to you (i.e. the Sponsor Contact)
| To help us provide timely invoicing including Past Due Notifications and Outstanding Invoicing Reports. | To allow us to service the CISI policy you hold for your participants. |
In relation to you (i.e. the Sponsor Contact)
| To send you information about opportunities, notifications or services of ours which may be of interest to you (including surveys). | Your Consent. |
In relation to you (i.e. the Sponsor Contact)
| To deal with any enquiries, correspondence, concerns or complaints. | To allow us to service the CISI policy you hold for your participants. |
In relation to your participants
| To enable us to consider your participant's eligibility for a CISI policy. | To allow us to service the CISI policy you hold for your participants. |
In relation to your participants
| To carry out our obligations through the CISI policy and to communicate and provide information to your participants during an emergency. | Your Consent. |
In relation to you (i.e. the Sponsor Contact)
| To enable us to consider your Educational or Cultural Exchange Program’s eligibility for our policies. | To allow us to consider your request for coverage and/or to allow us to take the steps required to quote a customized policy. |
| Information we collect when you visit the CISI Website as described above | To conduct internal operations, including data analysis, testing, research, statistical purposes and troubleshooting. To ensure that content on the CISI Website is presented in the most effective manner for you and for your device. To analyse traffic to the CISI Website. As part of our efforts to keep the CISI Website secure and to prevent fraud. | To enable us to pursue our legitimate interests to:
|
Website Visitor
| Participant Type(s) of personal information we process | Type(s) of personal information we process | Type(s) of personal information we process |
|---|---|---|
| Information we collect when you visit the CISI Website as described above | To conduct internal operations, including data analysis, testing, research, statistical purposes and troubleshooting. To ensure that content on the CISI Website is presented in the most effective manner for you and for your device. To analyse traffic to the CISI Website. As part of our efforts to keep the CISI Website secure and to prevent fraud. | To enable us to pursue our legitimate interests to:
|
More about the information we use and why
Where we have a legal basis to use your personal information without consent (as we have described above), this Policy fulfils our duty to process personal information transparently, and helps us to do so fairly and lawfully and in a manner that you would expect given the nature of our relationship with you, by giving you appropriate notice and explanation of the way in which your personal information will be used.
Where consent is required for our use of your personal information, we will ask you to positively opt-in by ticking the appropriate consent box or otherwise communicating your consent.
Where you provide us with personal information relating to other individuals (for example, if you are a Sponsor Contact and are enrolling participants and providing their names, dates of birth and email addresses), you must obtain the consent of those individuals before doing so.
If you have any questions or require any further information regarding our use of personal information please contact our data protection officer (see HOW TO CONTACT CISI).
SHARING YOUR INFORMATION
We may share your personal information with your consent or as is necessary with selected third party service providers that support us in the performance of the activities set out in the tables above.
We require all our third party service providers to take appropriate and stringent security measures to protect your personal information in line with our policies. We do not allow our third party service providers to use your personal information for their own purposes and we only permit them to process your personal information for specified purposes in accordance with our instructions.
We may also need to share your personal information with a regulator or otherwise to comply with the law or to respond to valid legal process, including from law enforcement or other government agencies.
Why might you share my personal information with third parties?
We may share your personal information with third parties where it is necessary in order to adjudicate your claim file, or access support and resources requested by you, where required by law (as above), or where we have another legitimate interest in doing so that is not overridden by your interests and fundamental rights. (For example, to protect Participants, Sponsors Contacts, or to operate and maintain the security of our computer systems.)
Who will you share my personal information with?
We will share – and, in some cases, you will provide – certain information about you with and to the following third parties for purposes specified:
| (CISI Policy Underwriter) |
| (CISI Policy Underwriter) |
| (Claim Management System Provider) |
| (Assistance Provider) |
| (Assistance Provider) |
| (Healthcare Cost Containment) |
| (Healthcare Resource Provider) |
|
|
RETAINING YOUR INFORMATION
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your information, the purposes for which we process your information and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Even if you request that we erase your information, we may still need to keep it (see YOUR RIGHTS) or may keep it in a form that does not identify you.
The following retention periods will apply, unless we inform you otherwise (or you request that we erase your information).
If you are Participant and you:
- register your interest in or apply to for a CISI Policy but do not purchase the CISI Policy we may retain some of your personal information (including your name, email address and date of birth) for a period of 1 year following the date when you first complete your registration and/or application; or
- enroll or are enrolled in a CISI Policy, we will process your personal information prior to your policy effective date and will retain your information for a period of [7 years] thereafter, for example, to keep in touch with you and/or for legal reasons. We will only retain information as necessary.
- incurred claim losses, we will process your personal information (inclusive of personal health information) and will retain your information for 7 years, thereafter, for example, to address additional claim filings and/or to respond to court orders and legal investigations.
If you are a Sponsor Contact and you:
- register your interest in or request a quote for a CISI Policy but do not accept the CISI Policy we may retain some of your personal information (including your name, email address and date of birth) for a period of 1 year following the date when you first complete your registration and/or application; or
If you are a Visitor and you do not use the CISI Website for 1 year, then we will erase your information.
We may keep certain information for longer periods than those stated above if you have agreed to us using it, for example, for keeping in touch about our services or for our promotional purposes (such as contributing testimonials to the CISI Website).
Please contact our data protection officer if you would like further details on how long we retain your information (see HOW TO CONTACT CISI).
KEEPING YOUR INFORMATION SECURE
All personal information that you provide to us is stored on secure servers. We have put in place (and require anyone we share your information with to put in place) appropriate measures to protect the security of your information.
In addition, we limit access to your information to those of our employees, agents, contractors and other third parties who have a business need to know. We will require them only to process your information on our instructions and they are subject to a duty of confidentiality.
You should be aware that the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of the information transmitted to the CISI Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access or inadvertent disclosure.
We have also put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
UPDATING AND ACCESSING YOUR INFORMATION
You have the right under data protection laws to access personal information held about you, subject to certain conditions, and to request its rectification or deletion.
If you would like to access or amend the personal information which we hold about you or you would like us to stop using your personal information, please contact our data protection officer (see HOW TO CONTACT CISI).
To learn more about the rights you may have in relation to your personal information see YOUR RIGHTS.
YOUR RIGHTS
By law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. We will need to prove your identity before we release any personal information to you.
- Request correction or erasure of your personal information (unless we have the legal right to retain it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
- Change your information processing preferences at any time (where this specifically relates to marketing messages, see MARKETING).
You should be aware that if you ask us to stop processing your personal information in a certain way or to erase your personal information, and this type of processing is necessary to consider your eligibility for a CISI Policy we may not be able to do so. This does not include your right to object to direct marketing, which can be exercised at any time without restriction.
If you want to exercise any of the rights listed above, please contact our data protection officer (see HOW TO CONTACT CISI).
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Right to withdraw consent
Where you have provided your consent to the collection, use or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our data protection officer (see HOW TO CONTACT CISI). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
MARKETING
If you are a Participant or a Sponsor Contact, we would like to send you information by email about opportunities or services of ours which may be of interest to you (including, surveys).
You have the right at any time to stop us from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, you can unsubscribe by using the “unsubscribe” link at the bottom of our marketing messages or by contacting our data protection officer (see HOW TO CONTACT CISI).
We will not provide your personal information to any other third party businesses for marketing purposes.
OTHER WEBSITES
The CISI Website contains links to other websites. This Policy only applies to the CISI Website so when you link to other websites you should read their own privacy policies.
CHANGES TO THIS POLICY
We keep this Policy under regular review and will post any updates on this webpage. This Policy was last updated in April 2018.
HOW TO CONTACT AIFS
We have appointed Gene Maillet as our Data Protection Officer to oversee compliance with this Policy. If you have any questions about this Policy or how we handle your personal information please contact our Data Protection Officer at gmaillet@aifs.com or +203-399-5544.
Complaints
If for any reason you are not happy with the way that we have handled your personal information please contact us at gmaillet@aifs.com or +203-399-5544. If you are still not happy, you have the right to make a make a complaint to the Information Commissioner’s Office see: https://ico.org.uk/global/contact-us/.