Privacy Policy
Information about how MCS collects, uses, shares, protects and retains personal data.
UK English version · Updated for 2027This Privacy Policy explains how MCS del Mediterraneo Correduria de Seguros S.L. (“MCS”, “we”, “us” or “our”) processes personal data and the rights available to individuals under Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
MCS is part of Grupo Concentra.
This policy covers personal data processed through the MCS website and in connection with enquiries, quotations, insurance brokerage services, client relationships and other activities described below.
Data controller and contact details
You may contact MCS concerning privacy and data protection either by post at the registered office above or by email at rgpd@concentragrupo.com .
Personal data we may process
The personal data processed by MCS depends on the relationship you have with us and the service you request.
This may include:
- name and contact details;
- postal address;
- telephone number;
- email address;
- identification information where required;
- information submitted through website forms;
- telephone, email, WhatsApp and chatbot communications;
- information required to prepare an insurance quotation;
- policy and customer information;
- information required to administer insurance policies;
- information relating to claims;
- health or other special-category data where necessary for an insurance product or claim and where processing is legally permitted;
- complaints and correspondence;
- website usage and technical information; and
- cookie and consent preferences.
Insurance quotations
When you ask MCS to prepare or obtain an insurance quotation, we process the information required to understand your insurance requirements, assess suitable options and obtain quotations from relevant insurance companies.
This may include information submitted through an online form or communicated by telephone, email, chat, WhatsApp or another communication channel.
Processing may include analysing your circumstances and requirements, identifying potentially suitable insurance products, obtaining quotations and providing insurance brokerage advice.
Legal basis: Taking steps at your request before entering into a contract and compliance with applicable legal and regulatory requirements, including Royal Decree-Law 3/2020.
Recipients: Relevant insurance companies and, where appropriate, companies within Grupo Concentra or service providers required for the requested service.
Retention: Information is retained for as long as necessary to deal with the quotation and subsequently for any period required to meet applicable legal or regulatory responsibilities.
Insurance brokerage clients
Where you become an MCS client, we process personal data in order to provide insurance brokerage services, administer our relationship with you, arrange insurance and provide assistance where required.
This may include processing data to:
- analyse your insurance requirements;
- provide insurance brokerage services;
- arrange and administer insurance policies;
- provide information to policyholders, insured persons and beneficiaries where necessary;
- assist with policy administration and claims;
- meet legal and regulatory obligations; and
- inform existing customers about similar MCS products or services where this is permitted by law.
Legal basis: Performance of a contract, compliance with legal obligations and, where applicable, legitimate interests or consent.
Retention: Client records are generally retained for six years after the end of the relevant contractual relationship, after which information may remain blocked where necessary to meet applicable legal responsibilities.
Recipients: Relevant insurers, banking or payment organisations where required, Grupo Concentra companies where legally appropriate, professional advisers and other parties necessary to provide or administer the service.
Website contact forms and email enquiries
The MCS website allows visitors to contact us through online forms and email.
Current website forms may request information such as your name, email address, telephone number, policy or customer number, subject and message. The website also uses reCAPTCHA technology to help protect forms against automated abuse.
Information submitted through website contact forms and website-related email enquiries may be stored in a separate communications database so that MCS can respond, follow up and maintain continuity in communications.
If an enquiry develops into an insurance quotation, client relationship, policy, complaint, claim or another regulated business process, the relevant information may then form part of the corresponding business record and the retention period applicable to that record will apply.
The legal basis for processing a general enquiry will normally be MCS’s legitimate interest in responding to the request or, where the communication concerns a quotation or proposed service, taking steps at your request before entering into a contract.
MCS website chatbot
The MCS website provides an automated chatbot to help visitors find information about insurance and MCS services.
Chatbot conversations may be stored in a separate database. MCS uses these conversations to understand the questions visitors ask and to improve the usefulness of the chatbot and website.
In particular, conversations may be analysed to:
- identify questions that were not answered adequately;
- identify frequently asked questions;
- improve chatbot knowledge and responses;
- identify missing information on the MCS website;
- improve existing website information; and
- develop useful new website content.
After this period, conversations are deleted or anonymised unless specific information must be retained for another lawful purpose.
Please do not submit unnecessary sensitive information, passwords, payment-card information or full medical records through the chatbot.
The chatbot does not make binding insurance decisions or independently approve insurance applications or claims.
WhatsApp, telephone and other communications
MCS provides several ways to communicate with its offices, including telephone, email, WhatsApp and website forms.
Where you contact MCS using one of these channels, we process the information you provide in order to respond to your enquiry, provide requested services and maintain appropriate business records.
When using a third-party communication service such as WhatsApp, that provider may separately process information under its own privacy terms.
Recruitment
Where MCS receives personal data from job applicants, the information may be processed for the purpose of managing recruitment and selection procedures.
Legal basis: Consent for unsolicited applications or pre-contractual measures where an application relates to an active recruitment process.
Retention: Applicant data may be retained for up to one year.
Recipients: Information may be shared with relevant Grupo Concentra companies where necessary for recruitment management and where this is legally permitted.
Suppliers and business contacts
MCS may process personal data relating to suppliers, self-employed professionals and business contacts for the purpose of managing contractual, commercial, financial and professional relationships.
The applicable legal basis may include performance of a contract and legitimate interests, including the provisions applicable to professional contact information under Spanish data protection legislation.
Commercial communications
Where permitted, MCS may process contact information to send information about insurance products or services that may be of interest.
This may be based on consent or, for existing clients and similar products or services, another lawful basis permitted under applicable electronic communications legislation.
Where consent is required, you may withdraw that consent at any time. Marketing communications will also provide an appropriate way to unsubscribe where required.
Where a person has authorised communications from Grupo Concentra companies, relevant information may be shared within the group for that purpose in accordance with the consent provided and applicable law.
Website analytics, cookies and similar technologies
The MCS website may use cookies and similar technologies for essential website operation, security, remembering preferences and, where consent has been provided, analytics or other optional purposes.
The website may use services such as Google Analytics and Google reCAPTCHA. Depending on the service and your consent choices, technical information such as browser, device, website usage and IP-related information may be processed.
Non-essential technologies are used in accordance with the consent choices available through the MCS cookie controls where consent is legally required.
Customer satisfaction surveys
MCS may invite clients to participate in satisfaction surveys in order to assess and improve the quality of MCS services and relevant services provided during the insurance process.
Where survey participation is based on consent, participation is voluntary and the information is retained only for as long as necessary for the relevant purpose and applicable legal responsibilities.
Internal reporting system
Where applicable, MCS and Grupo Concentra may process personal data submitted through an internal reporting or whistleblowing system in order to assess reports, conduct appropriate investigations, take corrective measures and communicate with the reporting person.
Processing is carried out in accordance with applicable Spanish whistleblower protection legislation, including Law 2/2023 where applicable.
Personal data within such a system is subject to the applicable statutory retention periods and access restrictions.
Complaints and claims against MCS
Personal data may be processed where you submit a complaint or grievance to MCS so that we can understand the circumstances, investigate the matter, communicate with you and provide an appropriate response.
The legal basis may include legitimate interests and compliance with legal and regulatory obligations applicable to insurance intermediaries.
Complaint information is retained for as long as necessary to deal with the matter and thereafter for any period required to meet or defend legal and regulatory responsibilities.
Compliance with legal and regulatory obligations
MCS processes personal data where necessary to comply with obligations imposed by Spanish and European legislation and regulation applicable to insurance intermediaries.
This may include insurance-distribution requirements, accounting and regulatory obligations, fraud prevention, legal claims and, where applicable, obligations relating to the prevention of money laundering and terrorist financing.
Information may be disclosed to competent public authorities where required by law.
Sharing personal data
MCS does not sell personal data.
Depending on the service and legal basis, personal data may be disclosed to or processed by:
- insurance companies;
- Grupo Concentra companies;
- banks and payment-service providers where required;
- medical or healthcare providers where relevant;
- loss adjusters and claims professionals;
- professional advisers;
- IT, hosting and website service providers;
- communications and chatbot technology providers;
- analytics and security providers;
- courts and judicial bodies; and
- competent public or regulatory authorities.
Information is only shared where there is an appropriate purpose and lawful basis.
International data transfers
Some technology or service providers may process personal data outside Spain or the European Economic Area.
Where a transfer is subject to GDPR international-transfer requirements, MCS uses an appropriate transfer mechanism where required, such as an adequacy decision, Standard Contractual Clauses or another legally recognised safeguard.
Retention of personal data
Personal data is not retained for longer than is reasonably necessary for its purpose, subject to statutory, regulatory and legal retention requirements.
A website enquiry may move into a different retention category if it results in a quotation, policy, client relationship, claim, complaint or other regulated record.
Your data protection rights
Subject to the conditions set out in applicable law, you may exercise the following rights:
- Access – to obtain information about the personal data we process about you.
- Rectification – to correct inaccurate or incomplete personal data.
- Erasure – to request deletion where the applicable legal requirements are met.
- Restriction – to request restriction of processing in circumstances provided by law.
- Objection – to object to processing based on legitimate interests in applicable circumstances.
- Data portability – where the legal requirements for portability are met.
- Withdrawal of consent – where processing is based on consent.
Exercising these rights is normally free of charge. MCS may request reasonable information to verify your identity before completing a request.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Right to lodge a complaint
If you believe that your personal data has not been processed in accordance with applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.
In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).
Security
MCS applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration, disclosure or destruction.
Security measures are reviewed in light of the nature of the information, available technology and relevant risks.
No internet-based system can guarantee absolute security, and visitors should avoid sending unnecessary sensitive information through ordinary email or general website communication channels.
Confidentiality
Personal data collected through the website or through communications with MCS is treated confidentially and is subject to the confidentiality and professional obligations applicable to MCS and its authorised personnel and service providers.
Links to external websites
The MCS website may contain links to websites or services that are not operated or controlled by MCS.
MCS is not responsible for the privacy practices of independent third-party websites. Before providing personal data to another website or service, you should review the privacy information provided by that organisation.
Changes to this Privacy Policy
MCS may update this Privacy Policy to reflect changes in legislation, regulatory guidance, Grupo Concentra policies, MCS services, website functionality or the way personal data is processed.
Where required by law, material changes will be communicated appropriately.
The version published on this website is the current version.
Questions about your personal data?
Contact the MCS / Grupo Concentra data protection contact if you have a privacy question or wish to exercise your rights.
