Claims Handling Privacy Notice

Who is responsible

SIA “PANDI BALT”, registration No. 40003271473, Mazā Alūksnes iela 7, Rīga, LV-1045, Latvia, is the current contact for privacy questions about matters submitted to us. Depending on the instruction and agreement with an insurer, P&I Club or another principal, Pandi Balt may decide how data is used as a controller or act on that principal’s documented instructions as a processor. In the latter case, that principal’s privacy information may also apply. Ask roman.rozkov@pandibalt.eu if you need to identify the responsible party for a specific matter.

Whose information and where it comes from

A file may include information about claimants, injured persons, drivers, passengers, crew, witnesses, policyholders, vessel owners or operators, employees, experts and other people involved. We may receive it directly from you or from an insurer, P&I Club, shipowner, employer, correspondent, other party to a claim, surveyor, lawyer, medical professional, repairer, authority or relevant public source.

When information comes from someone else, the GDPR may require us or the responsible controller to provide additional information about its source and use. The relevant Article 14 requirements and any applicable exception depend on the circumstances of the matter.

Information and purposes

Depending on the matter, the file may include names and contact details, claim and policy references, vessel, cargo or vehicle details, incident circumstances, statements, photographs, reports, correspondence, financial and payment information, and police, authority or court documents. Where relevant and necessary, it may also contain health information about an injury, treatment, incapacity or medical costs. Please do not upload detailed medical records unless we ask for them.

We use relevant information to receive and assess instructions, investigate events and losses, arrange surveys or expert input, assess liability and claims, communicate with parties, report to the instructing principal, administer settlement or payment where applicable, meet legal obligations, and establish, exercise or defend legal claims. Fraud or abuse prevention may be relevant in a particular matter.

The legal ground under GDPR Article 6 depends on the role and matter: it may include contractual steps or performance, legitimate interests of Pandi Balt or a principal, or a legal obligation. If health or other special-category information is necessary, a separate Article 9 condition is also required; in a relevant legal-claim context, Article 9(2)(f) may apply. We do not treat consent as the default ground for handling every claim.

Who may receive information

We disclose only what is necessary and lawful for the matter. Depending on the case, recipient categories may include the instructing insurer, P&I Club or other principal; relevant parties to the claim; Baltic partners assisting with the matter; surveyors, adjusters, lawyers, technical or medical experts, repairers and translators; courts, regulators or public authorities where required or permitted; and Microsoft, Cloudflare, Nano IT or other providers needed for secure communication, hosting and storage. The actual recipients depend on the instruction.

Retention and international transfers

An active file is kept while the matter is handled. An ordinary closed file is normally kept for up to three years after final closure. Where a specific claim, dispute or other obligation makes it necessary, relevant records may be retained for up to ten years or another applicable period. The principal’s documented instructions may apply when we act as processor. Temporary website-upload copies are separate from the working file and should be removed after transfer.

We may coordinate with partners in Latvia, Lithuania and Estonia. A recipient or technology provider may involve a transfer outside the European Economic Area in a particular case. Contact us for information about a specific transfer and the applicable safeguard. We do not describe every P&I Club or insurer as an EEA recipient without checking its legal entity.

Your rights and contact

To ask about a matter or exercise data-protection rights, contact Roman Rozkov at roman.rozkov@pandibalt.eu. We will identify the relevant controller and route a request where necessary. Rights, possible limits and the right to complain to a supervisory authority are explained in our Privacy Notice. Sending a claim does not by itself mean that Pandi Balt represents an insurer, accepts an instruction or accepts liability or coverage.