Introduction
This privacy statement (Privacy Statement) of HW International B.V. (trading as Dubois) with company number 33208401 whose registered office is at Professor W.H. Keesomlaan 1, 1183 DJ Amstelveen, The Netherlands (HW International B.V. (trading as Dubois), we, us or our) applies to the processing of your personal data collected through your use of duboisgroup.com and any related online contact forms, newsletters and digital services that link to this Privacy Statement (the Services).
It is important that you read this Privacy Statement carefully so that you understand how and why we use your personal data.
When processing your personal data, HW International B.V. (trading as Dubois) acts as the data controller within the meaning of the General Data Protection Regulation (GDPR).
Country-specific terms
Country-specific terms also apply. If you interact with us via our country pages or receive services from one of our local offices, additional privacy information may apply depending on where you are located and which Dubois entity provides the services.
- Australia: we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Please also read the Australian Privacy Addendum.
- Germany and Spain: please also read the relevant German Privacy Addendum and Spanish Privacy Addendum.
If there is any inconsistency between this Privacy Statement and a country addendum, the country addendum applies to the extent of the inconsistency for that location.
Children
Our Services are not directed at children, and we do not knowingly collect any personal information from children.
Contact
If you have any questions about this Privacy Statement or the processing of your personal data, please contact our privacy officer at privacy@duboisgroup.com.
1. The personal data we collect about you
1.1 What "personal data" means
Personal data means information that can be traced back to a person who can be identified (directly or indirectly), such as a first and last name, telephone number, postal and electronic addresses, date of birth, payment information and bank details. Data that cannot be traced back to a person (anonymous data) is not included.
1.2 Categories of personal data we may process
When using our Services, we may collect, use, store and share various categories of personal data from and about you. Because we work with both business clients and private individuals, the personal data we process may include:
- Contact details (such as your name, postal address, business address where relevant, telephone number and email address).
- Professional details (such as job title, occupation, employer and relationship to your organisation, where relevant).
- Enquiry and relationship details (information you provide in forms, emails, calls or meetings; preferences; correspondence).
- Insurance and risk information (information necessary to advise on, arrange, place and administer insurance, including information about the risk to be insured and, where relevant, policy and claims information).
- Claims-related information (information needed to support or manage claims and related communications).
- Identity and verification information (where required, information used to meet legal and regulatory obligations and to prevent fraud, such as date of birth and identification details)
- Compliance information (where required, information used to meet legal and regulatory obligations such as anti-fraud controls and sanctions screening).
- Financial and payment information (where relevant and provided to us, such as premium payment details and bank account details, and where applicable payment card details).
- Marketing preferences (subscription choices and communication preferences).
- Website usage and technical data (IP address, device and browser data, cookie identifiers and usage data).
- Other personal data that you share with us (for example via messages or attachments).
- Where relevant, additional details you provide or that are required for a particular service, such as nationality, gender, and identification numbers or copies of identification documents.
- Where we provide a login area, account information such as a username and password.
1.3 Data collected automatically (cookies and similar technologies)
We may also collect personal data automatically when you visit or use the Services, such as data collected through cookies and similar technologies. This includes:
- Data about your device and browser type (including IP address and device identifiers).
- Data about your use of our Services, such as the pages you have viewed, the hyperlinks you clicked on and websites you visited before you opened our Services.
For more information about cookies and your choices, please see our Cookie Policy and use Cookie Settings.
1.4 Special categories of personal data (including health information)
In principle, we do not process special categories of personal data about you unless we are legally obliged to do so or when it is legally permissible (for example, in order to take steps at your request prior to entering into a contract).
In limited circumstances, and only where permitted by law, we may need to process information that is treated as sensitive under applicable privacy laws in order to provide our services (for example, to arrange certain insurance products or to support claims). Further information relevant to Australia is set out in the Australian Privacy Addendum.
2. How we collect and use your personal data
2.1 How we collect personal data
In the course of providing our Services to you, we process personal data in various ways. Many of the personal data we collect are provided by you, for instance when corresponding with us, submitting an enquiry, or otherwise interacting with our Services.
2.2 Legal grounds for processing
We will only process your personal data when we have a legal ground to do so. We will only process your data when this is necessary:
- For the establishment and execution of the agreement we have with you (or your organisation) to provide our Services;
- To comply with our legal obligations (for example regulatory obligations); or
- To pursue our legitimate interests (provided that your interests and fundamental rights do not outweigh our legitimate interests).
2.3 Consent
If we want to process personal data and cannot base this on one of the legal grounds mentioned above, we will ask for your prior consent to such processing (and only if this is possible and allowed under the GDPR).
You can withdraw your consent at any time, either in the same way you consented or by contacting our privacy officer at privacy@duboisgroup.com. Upon withdrawal of your consent, we will stop processing the relevant data. The withdrawal of your consent does not affect the lawfulness of the processing operations that we carried out before the withdrawal.
2.4 The main situations where we process personal data
Below we explain the key purposes for processing, the types of personal data involved, the legal basis and how long we keep the data for that purpose.
Handling enquiries and requests
- Personal data: Contact details, professional details, enquiry content, correspondence.
- Legal basis: Legitimate interests; pre-contract steps.
- Retention: Kept for as long as needed to deal with the enquiry, then deleted or anonymised unless needed for compliance, disputes or audit.
Providing broking services (advice, market engagement, placement, policy administration, renewals)
- Personal data: Contact and professional details; insurance and risk information; communications; placement and policy records.
- Legal basis: Contract; pre-contract steps; legitimate interests; legal obligation (where applicable).
- Retention: Retained for the duration of the relationship and then for the period required by applicable legal, regulatory and professional record-keeping obligations.
Claims support and claims administration assistance
- Personal data: Contact and professional details; policy details; claims information; supporting documents; communications with relevant parties.
- Legal basis: Contract; legitimate interests; legal obligation (where applicable).
- Retention: Kept for as long as needed to handle the claim and related matters, then retained in line with limitation periods and regulatory record-keeping requirements.
Compliance and risk management
- Personal data: Identity and contact details; service records; screening results where applicable; audit logs; complaint records.
- Legal basis: Legal obligation; legitimate interests.
- Retention: Retained as required to demonstrate compliance and to protect our legal position, typically aligned to limitation periods and regulatory requirements.
Managing supplier relationships and professional advisers
- Personal data: Contact and business details; communications; access logs.
- Legal basis: Legitimate interests; legal obligation (where applicable).
- Retention: Retained for as long as the supplier relationship exists and afterwards as required for audit, security and legal purposes.
Marketing communications (where permitted)
- Personal data: Contact details; marketing preferences; basic interaction history.
- Legal basis: Legitimate interests and/or consent (depending on jurisdiction and channel).
- Retention: Kept until you opt out or we otherwise suppress your details; suppression lists retained to respect your preferences.
Website operation, analytics and security
- Personal data: IP address; device and browser data; cookie identifiers; usage data; security logs.
- Legal basis: Legitimate interests; consent for non-essential cookies where required.
- Retention: Cookie durations are set out in the Cookie Policy/cookie tool; security logs retained for a limited period unless needed to investigate incidents or misuse.
3. Sharing your data
3.1 Service providers
We may share your data with external service providers, such as IT service providers, banks (where relevant for payments), lawyers, external auditors, and marketing agencies. In accordance with our legal obligations, we will enter into a processing agreement with these external service providers (if necessary).
3.2 Other disclosures
We may also share your personal data with other parties if we believe it is necessary and permitted to do so, including:
- With competent supervisors or authorities in order to comply with requests or orders; with judicial authorities and other parties concerned in the context of legal proceedings; with other third parties in order to establish or exercise our legal rights or in the context of the settlement or institution of complaints or proceedings;
- With parties that we need to involve in order to investigate, prevent or detect suspected fraudulent or other unlawful activities and/or to take action against them;
- With interested parties in connection with a proposed sale, merger, acquisition, consolidation or disposal of assets or our business activities, or in the unlikely event of bankruptcy. In these situations, we will only share personal data to the extent necessary and, where possible, only share anonymised or aggregated data; or
- Other third parties insofar as we are legally or contractually obliged to do so (and permitted under the GDPR).
As an insurance broker, where relevant we may also share personal data with insurers, underwriters, claims handlers, loss adjusters and other parties involved in arranging insurance and supporting claims, to the extent necessary for the services you request.
3.3 No sale of personal data
We will not sell your personal data to third parties.
4. International transfer
4.1 Transfers outside the EEA
We may share your personal data with third parties to the extent necessary for the purposes described in this Privacy Statement and to the extent permitted by law. These third parties may in certain cases be located outside the European Economic Area (EEA).
Where possible, we aim to keep personal data collected through our European websites and European client services on systems hosted in the EEA. However, access from outside the EEA can occur where needed for international placements, claims support, security, business continuity, or specialist IT support.
4.2 Safeguards
Where we transfer personal data outside the EEA, we will ensure an appropriate transfer mechanism is in place as required by law. Contact privacy@duboisgroup.com for more information.
4.3 Australia-specific note
Australian client data may, depending on the services provided and systems used, be stored on our Australian systems and/or on our European Microsoft 365 tenant. Australian client data may also be shared with insurers, underwriters and other parties located in the UK or other countries when required to arrange insurance and support claims.
5. Data security
We take the security of your personal data very seriously. We have therefore implemented appropriate technical and organisational security measures to prevent your personal data from being lost, used, accessed by unauthorised persons, modified or disclosed in an unauthorised manner.
Access to your personal data is only authorised for people who have a need to know basis to access your personal data. We ensure that the people who can access your personal data are bound by confidentiality obligations.
6. Retention period of your personal data
We will retain your personal data for the period necessary to fulfil the purposes set out in this Privacy Statement. The main retention periods are described in section 2.4 above.
7. Your rights
Your rights and how you can exercise them may vary depending on where you are located and which Dubois entity is providing the Services. The sections below describe rights under the GDPR. If you are located in Australia, please also refer to the Australian Privacy Addendum for information about access and correction rights and how to make a complaint under the Privacy Act.
7.1 Rights under the GDPR
In accordance with the GDPR, you have the right to access, rectify and delete your personal data, the right to restrict and object to the processing of your personal data and the right to data portability.
7.2 More detail about your rights
- Right to access: This gives you the right to receive a copy of the personal data we process about you, to check whether the data is correct and whether we process it lawfully.
- Right to correction: You can have any incomplete or incorrect personal data that we hold amended or completed.
- Right to deletion: You can request deletion if your personal data is no longer needed; you withdraw your consent and no other legal basis applies; you object and we do not have a compelling legitimate ground for processing; your personal data are processed unlawfully; or your personal data must be removed to comply with a legal obligation.
- Right to object: We will comply unless we have a legitimate interest that outweighs your interests or if we need to continue processing your personal data to establish, exercise or defend a legal claim or to comply with our legal obligations.
- Right to restrict processing: You can request restriction where the accuracy of your personal data is disputed; the processing is unlawful and you oppose deletion; we no longer need your personal data but you need it for a legal claim; or you have objected while we assess compelling grounds.
- Right to data portability: You can request us to receive your personal data and/or to send it to a third party, as far as this is feasible. You only have this right if it concerns personal data that you have provided to us and the processing is based on consent or based on the necessity for the performance of our contract with you.
7.3 How to exercise your rights
You can exercise your rights as set out above by submitting a request by e-mail to our privacy officer at privacy@duboisgroup.com. We will endeavour to respond to your request within one month of receipt. However, this one month period may be extended by two months, for example, in the case of a large or complex request. In this case, we will notify you within one month of receiving your request and explain why the extension is necessary.
7.4 Complaints
You also have the right to lodge a complaint with the supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens) about the way we process your personal data. However, we would appreciate the opportunity to address your complaint before you turn to the supervisory authority.
8. Changes to this Privacy Statement
We may change this Privacy Statement from time to time. If the changes are substantial, we will always actively inform you about them and provide you with a new version of the Privacy Statement.
Last modified: April 8, 2026