Privacy policy

Who is responsible for your information

Cogotec Limited is a Hong Kong company with business registration number 74373704 and registered address at Rooms 1703-1704, 17/F, Tung Chiu Commercial Centre, 193 Lockhart Road, Wanchai, Hong Kong. We operate Expat Life Insure and decide why and how information is used for the website and enquiry handling described in this policy. We are the responsible data user for those activities.

Instly supplies technology services to Cogotec. It processes information on our instructions to operate and support the platform. Privacy questions and requests concerning this service should be sent to privacy@instlytechnologies.com, or by post to our registered address, marked “Expat Life Insure privacy request”.

This policy covers Expat Life Insure and its connected quote journey, including quote.expatlifeinsure.com and the same branded tool opened through its hosted service address. Cogotec.com and other websites may use different tools and have their own privacy notices.

Information collected when you browse

The marketing website does not have a customer lead form or store your quote answers. Searching the resource library and ticking the preparation checklist happen within the page and are not saved by the website in browser storage.

Our website host receives the technical information needed to deliver and protect the site, such as your IP address, requested pages, browser information and request times. Security and operational logs may contain this information.

Quote links carry limited campaign or referral information from the page address to the quote service. This helps us identify the source of an enquiry. Avoid putting personal details in referral links or page addresses.

Information collected in the quote service

The tool asks for the information relevant to the route you choose. This can include your country of residence, age, gender, tobacco or nicotine use, the reason for seeking cover, cover amount, duration and product choice. Savings routes can also ask about contributions, savings goals, retirement timing or a child’s age. Some answers can reveal health-related or financial information.

The service records visits, steps taken, answers submitted, indicative results, timestamps and a generated session reference. It also records campaign and referral information, broad device type, language and time zone. Application activity records include a shortened hash derived from your IP address; hosting and security systems may separately process the original IP address. A hashed value or session reference does not make the records anonymous.

Application activity recording starts after you acknowledge the collection notice and confirm that you are aged 18 or over. It continues as you answer questions, before you request a callback or provide your name. Hosting and security systems still receive the technical information needed to load the page. Records are available through the authorised adviser dashboard. If you later leave contact details, the session reference allows those details to be connected with your earlier quote activity.

Back and Start again change the journey shown in your browser. Reloading starts a new journey. These actions do not delete activity or enquiries already recorded on the service.

Please answer only the questions asked. Do not put identity documents, account numbers, detailed medical histories or information about other people into free-text answers.

When you request contact

If you ask for follow-up, we collect the name and email address or telephone number you provide, your contact channel, the quote inputs and results associated with the enquiry, and the request time. We use these details to handle the request and pass the enquiry to the relevant licensed insurance partner.

You can browse the guides without giving us contact details. The quote tool needs the answers relevant to a calculation to show an indicative result. Contact details are optional for seeing an estimate, but we cannot arrange a callback without a usable contact method.

If you choose a WhatsApp, LINE or email link, you move to the relevant communication service. The prepared message can contain a quote reference. That service receives information under its own terms and privacy notice. You decide whether to send the message.

Before you enter callback details, we ask you to confirm that you request contact about your enquiry and agree to sharing your contact details and quote information with licensed insurance partners for that purpose. We store the notice version, the wording of that choice and the server receipt time with the enquiry. This is not consent to unrelated marketing.

Why we use information

We use personal information for the purposes explained when it is collected and directly related purposes permitted by applicable law. If a different use requires your consent, we will ask for it before that use.

The tool automatically calculates indicative results from the answers supplied. It does not decide whether an insurer will accept an application, issue cover or pay a claim.

• To operate the website and generate the indicative results you request.
• To handle an enquiry, connect it with its quote activity and facilitate requested follow-up by a licensed insurance partner.
• To understand referral sources and where people encounter problems in the quote journey.
• To prevent abuse and duplicate submissions, maintain security, investigate errors and administer access to the adviser system.
• To respond to privacy requests and complaints, meet applicable legal obligations and establish or defend legal rights where necessary.

Who receives information

An estimate request is processed by the quote platform’s calculation services. It is not, by itself, an insurance application submitted to Atlas Life or Manhattan Trust. If you later apply for a policy, the adviser and insurer will explain the additional information they require and their own privacy responsibilities.

Independent brokers and insurers are responsible for information they handle for their own advice, underwriting, policy administration and claims purposes. Their notices and retention rules may differ from ours.

• Authorised Cogotec personnel and Instly personnel who need access to operate, support or administer the service.
• Cloud and infrastructure providers used to deliver the service. The current platform uses Cloudflare for the marketing website, Railway for application hosting and Supabase for stored enquiry and activity records.
• Licensed insurance brokers or other appropriately licensed insurance intermediaries handling an enquiry you ask us to pass on. Their role and identity should be made clear before you proceed with advice or an application.
• Communication providers when you choose email or a messaging service, and professional advisers or public authorities where disclosure is necessary and lawful.

Contact preferences and direct marketing

A request for contact concerns the enquiry you make. It is not permission to send unrelated promotions. Where the law requires consent for direct marketing, or written consent to provide information to another organisation for its direct marketing, we will obtain the required consent and explain the relevant recipients, information, subjects and any transfer for gain.

You can ask us to stop marketing or change your contact preferences at privacy@instlytechnologies.com. We will not charge you for opting out. Necessary responses to a request you have made, or communications required by law, are handled separately.

International processing and security

Cogotec is registered in Hong Kong and has a team in Bangkok. Authorised access and service-provider processing may take place outside the country where you live, including in Hong Kong, Thailand and the countries in which the relevant cloud or communication services operate. Laws in those places may differ from those in your country.

We limit access to people who need it for their duties and use HTTPS for the website and quote service. We require service providers handling information on our instructions to protect it and use it for the agreed purposes. Where applicable law requires additional safeguards for an international transfer, those safeguards must be in place before the transfer.

No transmission or storage system can be guaranteed completely secure. If an incident affects your information, we will assess it and provide notifications required by applicable law.

How long we keep information

If an enquiry does not result in an ongoing client relationship, our retention limit is 12 months from first collection. An automated cleanup runs hourly to remove enquiries and associated activity that have reached that limit. We delete information earlier when it is no longer needed. Where a continuing relationship is established, we keep only the information necessary to administer that relationship and meet applicable obligations.

Activity and technical records are kept only for as long as needed for the stated operational, attribution and security purposes. Connecting activity to an enquiry does not create a separate reason to retain it indefinitely. We apply the enquiry retention limit to personal activity records retained as part of an unsuccessful enquiry.

Specific information may need to be retained longer where a legal obligation, an unresolved complaint or a legal claim requires it. Such a hold must have a recorded reason and expiry date. We restrict its use to that reason and delete it when that reason ends. Provider backups and security logs follow their own limited retention cycles, so removal from active records does not immediately erase every recovery copy. Recovery copies are restricted to recovery purposes, and expired records must be removed before restored data returns to normal use.

Independent advisers and insurers apply their own retention rules to their records. Their continuing relationship with you does not automatically justify Cogotec keeping every item of platform information.

Cookies and browser storage

Expat Life Insure does not currently add advertising trackers, Google Analytics or a third-party chat widget. Fonts are served with the site. The marketing website and public quote interface do not use cookies, local storage or session storage to remember your answers. Necessary hosting or security functions can still process technical information.

The private adviser console uses sign-in sessions for authorised staff. These are separate from a visitor’s public quote journey. External messaging services have their own cookie and storage practices.

If optional analytics or advertising technologies are introduced, we will update this notice and obtain any consent required before using them.

Your requests and complaints

You can ask to access the personal information we hold about you or correct inaccurate information by emailing privacy@instlytechnologies.com or writing to our registered address. Include enough information to identify your enquiry, such as its reference and the contact method used. Do not send identity documents unless we explain why a proportionate identity check is needed.

We handle requests within the time limits and conditions of applicable law. If we cannot comply, we explain the reason and any available next step. You can also ask about deletion, retention, contact preferences or withdrawal of consent for a particular use. We explain any information that must still be retained and why. Other rights may apply depending on your location and the law governing the processing.

Please contact us if you are concerned about our handling of information. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or another authority with jurisdiction. Our privacy policy does not remove your statutory rights.

Children and changes to this policy

The quote journey is intended for adults aged 18 or over. A parent or guardian using a savings illustration should provide only the limited child-age information requested and should not enter a child’s name, contact details or documents.

We will identify the effective date of the published policy and update it when our practices materially change. Where a change needs a separate notice or fresh consent, publishing a revised policy alone will not replace that requirement.