Hiscox is committed to protecting your privacy. This fair processing notice (this ‘notice’) sets out details of the information that we may collect from you and how we may use that information. Please take your time to read this notice carefully. When using a Hiscox website, this notice should be read alongside the website terms and conditions.
Hiscox is an international insurance business. We offer insurance to individuals, companies and other insurers. We do this both by providing insurance ourselves and by placing insurance with other insurers. We also offer insurance to other insurers (known as ‘reinsurance’). For the purposes of this notice, references to insurance also mean reinsurance.
In order for us to provide you with a quote and then insurance, and deal with any claims or complaints that might arise, we need to collect and process data about you. This makes the relevant Hiscox company a ‘data controller’. In this notice we use ‘we’ or ‘us’ or ‘Hiscox’ are to:
Hiscox Syndicates Limited, company number 02590623, registered address: 1 Great St Helens, London EC3A 6HX.
Hiscox Underwriting Services Limited, company number 03294530, registered address: 1 Great St Helens, London EC3A 6HX.
Hiscox Underwriting Ltd, company number 02372789, registered address: 1 Great St Helens, London EC3A 6HX
Hiscox Insurance Company Limited, company number 00070234, registered address: 1 Great St Helens, London EC3A 6HX.
Hiscox Underwriting Group Services Limited, company number 04137419, registered address: 1 Great St Helens, London EC3A 6HX
The specific company acting as a data controller of your personal information will be listed in the documentation we provide to you. If you are unsure you can also contact us at any time by telephoning 01904 681198 or by emailing us at [email protected] or writing to us at 1 Great St Helen's, London EC3A 6HX.
Insurance involves the use and disclosure of your personal data by various insurance market participants such as intermediaries, insurers and reinsurers. The London Insurance Market Core Uses Information Notice (https://www.londonmarketgroup.co.uk/gdpr) sets out those core necessary personal data uses and disclosures. Our core uses and disclosures are consistent with the London Market Core Uses Information Notice. We recommend you review this notice.
The personal information that we collect will depend on your relationship with us. We will collect different personal information depending on whether you are a Hiscox policyholder, a beneficiary under a Hiscox insurance policy, a claimant, a witness, a broker or another third party. .
In certain circumstances we will request or receive your ‘sensitive personal information’ (which is information relating to your health, genetic or biometric data, criminal convictions, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership). For example we may need access to information about your health in order to provide you with a quote, provide your insurance policy, or process any claims you make. We may also need details of any unspent criminal convictions you have for purposes such as preventing, detecting and investigating fraud.
If you provide personal information to us about other individuals (for example, members of your family) you agree that you will inform them about the contents of this notice and obtain any required consent in accordance with this notice.
Please click on the relevant section below for detailed information about the types of personal information we are likely to collect and use about you in different circumstances.
This section will apply if you apply for or take out an insurance policy with us directly (e.g. a household policy) or if you are listed as an applicant or beneficiary under a policy that someone else applies for or has with us (e.g. a named driver on a motor policy).
Where the provision of information is legally or contractually required, we will tell you this at the time of collection.
General information such as your name, address, contact details, date of birth, gender and relationship to the policyholder (where you are not the policyholder).
Identification information such as national insurance number, passport number or driving licence number.
Information about your job including job title, your status as a director or partner, employment history, education history and professional accreditations.
Information which is relevant to your insurance policy including details of previous insurance policies and claims history. This will depend on the type of policy you hold with us. For example, if you hold a household policy, we may collect and use information which relates to your property or if you hold a travel policy, we may collect and use information which relates to your travel plans.
Information relevant to any claim or complaint you may make. This will depend on the type of claim or complaint you make. For example, if you make a claim following a road traffic accident, we may use personal information which relates to your vehicle and named drivers.
Financial information such as your bank details, payment details and information obtained as a result of our credit checks. This may include details of any bankruptcy orders, individual voluntary arrangements or county court judgements.
Information (including photographs) obtained as a result of carrying out checks of publically available sources such as newspapers and social media sites in the event that we suspect fraudulent activity.
Information we obtain as a result of checking sanctions lists, such as those published by United Nations, European Union, UK Treasury, the U.S. Office of Foreign Assets Control (OFAC) and the U.S. Department of Commerce, Bureau of Industry and Security.
Information such as IP address and browsing history obtained through our use of cookies. You can find more information about this in our cookies policy which can be found at https://www.hiscox.co.uk/cookies-privacy/cookie-policy.
Information obtained during telephone recordings.
Your marketing preferences and details of your customer experience with us.
Information relating to criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).
If relevant, details of your current or former physical or mental health condition. For example, if you hold a travel policy, we may need details about any medical conditions that affect you, another member of your party or any other person upon whose health your trip depends. This may take the form of medical reports or underlying medical data such as x-rays or blood tests.
In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to your policy or claim. For example, we may process information relating to your trade union membership if you take out a policy with us via your trade union body and we may process information relating to your religious beliefs if relevant as part of your medical treatment.
We will collect information directly from you and from the following third parties:
the named policyholder (where you are a beneficiary);
third parties involved in the relevant insurance policy or claim (such as our business partners and representatives, brokers or other insurers, claimants, defendants or witnesses to an incident);
third parties who provide a service in relation to the relevant insurance policy or claim (such as loss adjusters, claims handlers, and medical experts);
publically available sources such as internet search engines, news articles and social media sites;
other companies within the Hiscox Group;
credit reference agencies;
financial crime detection agencies and databases (such as for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as ‘CUE’);
third parties who provide sanctions checking services;
government agencies such as the police, the National Crime Agency, the DVLA or HMRC;
insurance industry bodies (including the Employers’ Liability Tracing Office and the Association of British Insurers);
third parties who provide us with details of individuals who have expressed an interest in hearing about insurance products;
in limited circumstances, private investigators;
third-party data suppliers (for example in relation to flood modelling data and property surveys and valuations);
third party administrators and suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers;
our own websites; and
selected third parties in connection with any sale, transfer or disposal of our business.
We may use your information for a number of different purposes. For each purpose we must have a ‘legal ground’ to use your personal information in such a way.
When the information that we process is classed as ‘sensitive personal information’, we must have a specific, additional ‘legal ground’ to process such information.
We need to use your personal information to enter into or perform a contract that we hold with you. For example, we need to use your personal information to provide you with a quote or to provide your insurance policy and other associated products (e.g. legal expenses cover). We will rely on this for activities such as assessing your application, managing your insurance policy, handling claims and providing other products to you.
We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.
We have an appropriate business need (sometimes referred to as a ‘legitimate interest’) to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.
Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.
You have provided your consent to our use of your personal information (e.g. in relation to your marketing preferences).
When the information that we process is classed as ‘sensitive personal information’, we must have an additional ‘legal ground’. We will rely on the following legal grounds when we process your ‘sensitive personal information’:
We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.
We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.
We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.
We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.
Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.
You have provided your explicit consent to our use of your sensitive personal information.
You will find further details of our ‘legal grounds’ for each of our processing purposes set out below.
| Purpose for processing | Legal grounds for using your personal information | Legal grounds for using your sensitive personal information |
To carry out fraud, credit and anti-money laundering checks. |
It is necessary to enter into or perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (to prevent fraud and other financial crime). |
Such use is necessary for insurance purposes. It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to establish, exercise or defend legal rights. You have given us your explicit consent. |
To evaluate your insurance application or renewal and provide you with a quote. |
It is necessary to enter into or perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (to assess your insurance application and manage the application process). |
Such use is necessary for insurance purposes. You have given us your explicit consent. |
To administer your insurance contract including taking payments and making changes where requested or necessary. |
It is necessary to enter into or perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (administer your insurance contract). |
Such use is necessary for insurance purposes. You have given us your explicit consent. |
To manage insurance claims. |
It is necessary to perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (to assess and pay your claim and manage the claims process). Such use is necessary to protect your vital interests. |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. Such use is necessary to protect your vital interests. You have given us your explicit consent. |
To prevent and investigate fraud and other crime. |
It is necessary to enter into or perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (to prevent and detect fraud and other financial crime). |
Such use is necessary for insurance purposes. It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
To communicate with you (including assessing whether you are a vulnerable person) and resolve any complaints that you might have. |
It is necessary to enter into or perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (to send you communications, record and investigate complaints and ensure that future complaints are handled appropriately). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To comply with our legal or regulatory obligations. |
We have a relevant legal or regulatory obligation. |
Such use is necessary for insurance purposes. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers, or carrying out customer satisfaction surveys) |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
|
To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice) |
We have an appropriate business need (to effectively manage our business). We have a relevant legal or regulatory obligation. |
We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
For insurance risk modelling and product and pricing refinement. |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
|
To apply for and claim on our insurance. |
We have an appropriate business need (to ensure that we have appropriate insurance in place). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend legal rights. You have given us your explicit consent. |
|
To carry out marketing analysis, customer segmentation and campaign planning. |
You have given us your explicit consent. We have an appropriate business need (to plan our marketing activities). |
Not applicable. |
|
To provide marketing information to you in accordance with preferences you have expressed. |
You have given us your explicit consent. We have an appropriate business need (to send you selected communications about other products and services we offer). |
Not applicable |
|
To buy or sell Group companies or to restructure our business. |
We have an appropriate business need (to buy or sell Group companies or to restructure our business). We have a relevant legal or regulatory obligation. |
You have given us your explicit consent. |
From time to time, we may share your personal information with the other companies in our Group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes set out above.
If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.
Where relevant, we will share your personal information with:
our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
other third parties who assist in the administration of your insurance policy or claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;
companies who provide you with certain services such as home emergency cover and legal expenses cover;
our regulators;
other insurers;
fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
the police and other third parties (such as banks or other insurance companies);
other insurers who provide our own insurance;
industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
credit referencing agencies and third parties who carry out sanctions checks on our behalf;
our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers;
third parties who handle our direct marketing on our behalf (this includes, for example, inclusion or suppression of your personal information from our contact lists, sending marketing communications, and analysis of responses to our marketing communications);
social media sites (such as Facebook) to carry out marketing;
selected third parties in connection with any sale, transfer or disposal of our business; or
where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).
This section will apply if you make a claim in relation to a third party who has a Hiscox insurance policy. For example, if you are involved in a road traffic accident with a third party who is insured by us. Where the provision of information is legally required, we will tell you this at the time of collection.
General information such as your name, address, contact details, date of birth and gender.
Identification information such as your national insurance number, passport number or driving licence number.
Information about your job including job title, your status as a director or partner, employment history, education history and professional accreditations.
Information relevant to your claim. This will depend on the type of claim you make. For example, if you make a claim following a road traffic accident, we may use personal information which relates to your vehicle and named drivers.
Information relating to previous insurance policies or claims.
Financial information such as your bank details and payment details.
Information (including photographs) obtained as a result of carrying out checks of publically available sources such as newspapers and social media sites in the event that we suspect fraudulent activity.
Information we obtain as a result of checking sanctions lists.
Information such as IP address and browsing history obtained through our use of cookies. You can find more information about this in our cookies policy which can be found at https://www.hiscox.co.uk/cookies-privacy/cookie-policy.
Information obtained during telephone recordings.
Information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).
If relevant, details of your current or former health condition. For example, if you are injured whilst at a property insured by Hiscox, and the owner of the property makes a claim under their insurance policy in relation to your injury.
In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to your claim. For example, we may process information relating to your religious beliefs if relevant as part of your medical treatment.
We will collect information directly from you and from the following third parties:
the policyholder;
third parties involved in the relevant insurance policy or claim (such as our business partners and representatives, brokers or other insurers, claimants, defendants or witnesses to an incident);
third parties who provide a service in relation to the relevant insurance policy or claim (such as loss adjusters, claims handlers, and medical experts);
publically available sources such as internet search engines, news articles and social media sites;
other companies within the Hiscox Group;
credit reference agencies;
financial crime detection agencies and databases (such as for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as ‘CUE’);
third parties who provide sanctions checking services;
government agencies such as the police, the National Crime Agency, the DVLA or HMRC;
insurance industry bodies (including the Employers’ Liability Tracing Office and the Association of British Insurers);
in limited circumstances, private investigators;
third party data suppliers (for example in relation to flood modelling data and property surveys and valuations);
third-party administrators and suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers;
our own websites; and
selected third parties in connection with any sale, transfer or disposal of our business.
We may use your information for a number of different purposes. For each purpose we must have a ‘legal ground’ to use your personal information in such a way.
When the information that we process is classed as ‘sensitive personal information’, we must have a specific, additional ‘legal ground’ to process such information.
We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.
We have an appropriate business need (sometimes referred to as a ‘legitimate interest’) to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.
You have provided your consent to our use of your personal information.
When the information that we process is classed as ‘sensitive personal information’, we must have an additional ‘legal ground’. We will rely on the following legal grounds when we process your ‘sensitive personal information’:
We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include managing claims and preventing and detecting fraud.
We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.
We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.
We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.
You have provided your explicit consent to our use of your sensitive personal information.
You will find further details of our ‘legal grounds’ for each of our processing purposes set out below.
| Purpose for processing | Legal grounds for using your personal information | Legal grounds for using your sensitive personal information |
To administer claims |
We have an appropriate business need (to assess and pay your claim and manage the claims process). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To carry out fraud, credit and anti-money laundering checks. |
We need to use your information in order to comply with our legal obligations. |
Such use is necessary for insurance purposes. It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to establish, exercise or defend legal rights. You have given us your explicit consent. |
To communicate with you (including assessing whether you are a vulnerable person) and resolve any complaints that you might have. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to send you communications, record and investigate complaints and ensure that future complaints are handled appropriately). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To comply with our legal or regulatory obligations. |
We have a relevant legal or regulatory obligation. |
Such use is necessary for insurance purposes. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers, or carrying out customer satisfaction surveys) |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice) |
We have an appropriate business need (to effectively manage our business). We have a relevant legal or regulatory obligation. |
We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To prevent and investigate fraud and other crime. |
It is necessary to enter into or perform your insurance contract. We have a relevant legal or regulatory obligation. We have an appropriate business need (to prevent and detect fraud and other financial crime). |
Such use is necessary for insurance purposes. It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
For insurance risk modelling and product and pricing refinement. |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
To apply for and claim on our own insurance. |
We have an appropriate business need (to ensure that we have appropriate insurance in place). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To buy or sell Group companies or to restructure our business. |
We have an appropriate business need (to buy or sell Group companies or to restructure our business). We have a relevant legal or regulatory obligation. |
You have given us your explicit consent. |
From time to time, we may share your personal information with the other companies in our Group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes explained above.
If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.
Where relevant, we will share your personal information with:
our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
other third parties who assist in the administration of your insurance claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;
companies who provide you with certain services such as home emergency cover and legal expenses cover;
our regulators;
other insurers;
fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
the police and other third parties (such as banks or other insurance companies);
other insurers who provide our own insurance;
industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
credit referencing agencies and third parties who carry out sanctions checks on our behalf;
our third-party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers;
selected third parties in connection with any sale, transfer or disposal of our business; or
where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).
This section will apply if your information is processed in relation to a commercial insurance policy held by a third party (for example, if you are a member of the crew on a ship or aircraft which we insure) or if your information is processed in relation to an insurance policy that we provide to another insurer.
Where the provision of information is legally or contractually required, we will tell you this at the time of collection.
General information such as your name, address, contact details, date of birth and gender.
Identification information such as your national insurance number, passport number or driving licence number.
Information about your job including job title, your status as a director or partner, employment history, education history and professional accreditations.
Information relevant to any claim made.
Information relating to previous insurance policies or claims.
Financial information such as your bank details and payment details.
Information (including photographs) obtained as a result of carrying out checks of publically available sources such as newspapers and social media sites in the event that we suspect fraudulent activity.
Information we obtain as a result of checking sanctions lists.
Information such as IP address and browsing history obtained through our use of cookies. You can find more information about this in our cookies policy which can be found [here].
Information obtained during telephone recordings.
Information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).
If relevant, details of your current or former health condition. For example, if you are injured whilst at a property insured by Hiscox, and the owner of the property makes a claim under their insurance policy in relation to your injury.
In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to the policy. For example, we may process information relating to your religious beliefs if relevant as part of your medical treatment.
We will collect information directly from you and from the following third parties:
the policyholder;
third parties involved in the relevant insurance policy or claim (such as our business partners and representatives, brokers or other insurers, claimants, defendants or witnesses to an incident);
third parties who provide a service in relation to the relevant insurance policy or claim (such as loss adjusters, claims handlers, and medical experts);
publically available sources such as internet search engines, news articles and social media sites;
other companies within the Hiscox Group;
credit reference agencies;
financial crime detection agencies and databases (such as for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as ‘CUE’);
third parties who provide sanctions checking services;
government agencies such as the police, the National Crime Agency, the DVLA or HMRC;
insurance industry bodies (including the Employers’ Liability Tracing Office and the Association of British Insurers);
in limited circumstances, private investigators;
third party data suppliers (for example in relation to flood modelling data and property surveys and valuations);
third party administrators and suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers;
our own websites; and
selected third parties in connection with any sale, transfer or disposal of our business.
We may use your information for a number of different purposes. For each purpose we must have a ‘legal ground’ to use your personal information in such a way.
When the information that we process is classed as ‘sensitive personal information’, we must have a specific, additional ‘legal ground’ to process such information.
We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.
We have an appropriate business need (sometimes referred to as a ‘legitimate interest’) to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.
Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.
You have provided your consent to our use of your personal information.
When the information that we process is classed as ‘sensitive personal information’, we must have an additional ‘legal ground’. We will rely on the following legal grounds when we process your ‘sensitive personal information’:
We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing the insurance application, managing claims and preventing and detecting fraud.
We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.
We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.
We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.
Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.
You have provided your explicit consent to our use of your sensitive personal information.
You will find further details of our ‘legal grounds’ for each of our processing purposes set out below.
| Purpose for processing | Legal grounds for using your personal information | Legal grounds for using your sensitive personal information |
|
To carry out fraud, credit and anti-money laundering checks. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to prevent fraud and other financial crime). |
Such use is necessary for insurance purposes. It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to establish, exercise or defend legal rights. You have given us your explicit consent. |
|
To manage any claims you make under the relevant Hiscox insurance policy. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to assess and pay your claim and manage the claims process). |
Such use is necessary for insurance purposes. We need to establish, exercise or defend legal rights. Such use is necessary to protect your vital interests. You have given us your explicit consent. |
|
To comply with our legal or regulatory obligations. |
We have a relevant legal or regulatory obligation. |
Such use is necessary for insurance purposes. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
To communicate with you (including assessing whether you are a vulnerable person) and resolve any complaints that you might have. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to send you communications, record and investigate complaints and ensure that future complaints and handled appropriately). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
To prevent and investigate fraud and other crime. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to prevent and detect fraud and other financial crime). |
Such use is necessary for insurance purposes It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers). |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
|
To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice). |
We have an appropriate business need (to effectively manage our business). We have a relevant legal or regulatory obligation. |
We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
|
For insurance risk modelling and product and pricing refinement. |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
|
To buy or sell Group companies or to restructure our business. |
We have an appropriate business need (to buy or sell Group companies or to restructure our business). We have a relevant legal or regulatory obligation. |
You have given us your explicit consent. |
From time-to-time, we may share your personal information with the other companies in our Group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes explained above.
If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.
Where relevant, we will share your personal information with:
our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
other third parties who assist in the administration of the insurance policy or claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;
our regulators;
other insurers;
fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
the police and other third parties (such as banks or other insurance companies);
other insurers who provide our own insurance;
industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
credit referencing agencies and third parties who carry out sanctions checks on our behalf;
our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers;
selected third parties in connection with any sale, transfer or disposal of our business; or
where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).
This section will apply if you are a witness to an incident which is the subject of a claim. Where the provision of information is legally required, we will tell you this at the time of collection.
General information such as your name, address, contact details, date of birth and gender.
Identification information such as your national insurance number, passport number or driving licence number.
Information relevant to the incident that you have witnessed.
Depending on the nature of the incident you have witnessed, and only if relevant, we may collect information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction) or details of your current or former physical or mental health condition.
In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to the your role as a witness.
We will collection information directly from you and from the following third parties:
third parties involved in the incident you witnessed (such as brokers or other insurers, claimants, defendants or other witnesses);
other third parties who provide a service in relation to the claim which relates to the incident you witnessed (such as loss adjusters, claims handlers, and experts);
publically available sources such as the electoral roll, court judgments, insolvency registers, insurance industry databases, internet search engines, news articles and social media sites; and
other companies within the Hiscox Group.
We may use your information for a number of different purposes. For each purpose we must have a ‘legal ground’ to use your personal information in such a way.
When the information that we process is classed as ‘sensitive personal information’, we must have a specific, additional ‘legal ground’ to process such information.
We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.
We have an appropriate business need (sometimes referred to as a ‘legitimate interest’) to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.
You have provided your consent to our use of your personal information.
When the information that we process is classed as ‘sensitive personal information’, we must have an additional ‘legal ground’. We will rely on the following legal grounds when we process your ‘sensitive personal information’:
We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.
We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.
We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.
We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.
You have provided your explicit consent to our use of your sensitive personal information.
You will find further details of our ‘legal grounds’ for each of our processing purposes set out below.
| Purpose for processing | your personal information | Legal grounds for using your sensitive personal information |
To investigate and manage claims made under an insurance policy. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to assess and pay claims and manage the claims process). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice) |
We have an appropriate business need (to effectively manage our business). |
You have given us your explicit consent. |
To comply with our legal or regulatory obligations. |
We have an appropriate business need (to comply with our legal and regulatory obligations). We have a relevant legal or regulatory obligation. |
Such use is necessary for insurance purposes. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. You have given us your explicit consent. We need to use your information in order to establish, exercise or defend legal rights. |
To prevent and investigate fraud and other crime. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to prevent and detect fraud and other financial crime). |
Such use is necessary for insurance purposes. It is necessary to prevent or detect crime. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To communicate with you (including assessing whether you are a vulnerable person) and resolve any complaints that you might have. |
We have a relevant legal or regulatory obligation. We have an appropriate business need (to send you communications, record and investigate complaints and ensure that future complaints and handled appropriately). |
Such use is necessary for insurance purposes. We need to use your information in order to establish, exercise or defend our legal rights. You have given us your explicit consent. |
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers). |
We have an appropriate business need (to develop and improve the products and services we offer). |
You have given us your explicit consent. |
To buy or sell Group companies or to restructure our business. |
We have an appropriate business need (to buy or sell Group companies or to restructure our business). We have a relevant legal or regulatory obligation. |
You have given us your explicit consent. |
From time to time, we may share your personal information with the other companies in our Group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes explained above.
If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.
Where relevant, we will share your personal information with:
our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
other third parties who assist in the administration of the insurance policy or claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;
our regulators;
other insurers;
fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
the police and other third parties (such as banks or other insurance companies);
other insurers who provide our own insurance;
industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
credit referencing agencies and third parties who carry out sanctions checks on our behalf;
our third-party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers;
selected third parties in connection with any sale, transfer or disposal of our business; or
where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).
This section will apply if you are a broker doing business with us, an appointed representative or other business partner such as an introducer or supplier.
Where the provision of information is legally or contractually required, we will tell you this at the time of collection.
General information such as your name, address, contact details, date of birth and gender.
Information about your job such as job title, your status as a director or partner, employment history, education history and professional accreditations.
Information which we obtain as part of checking sanctions lists.
Other information (including publically available information) obtained as part of our due diligence checks.
Information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).
As well as obtaining information directly from you, we will collect information from:
Invoices, contracts, policies, correspondence and business cards.
Other Hiscox Group companies.
Publically available sources such as internet search engines.
From service providers who carry out sanctions checks.
We may use your information for a number of different purposes. For each purpose we must have a ‘legal ground’ to use your personal information in such a way.
When the information that we process is classed as ‘sensitive personal information’, we must have a specific, additional ‘legal ground’ to process such information.
We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.
We have an appropriate business need (sometimes referred to as a ‘legitimate interest’) to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.
You have provided your consent to our use of your personal information.
When the information that we process is classed as ‘sensitive personal information’, we must have an additional ‘legal ground’. We will rely on the following legal grounds when we process your ‘sensitive personal information’:
We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.
We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves.
We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.
We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.
You will find further details of our ‘legal grounds’ for each of our processing purposes set out below.
| Purpose for processing | Legal grounds for using your personal information | Legal grounds for using your sensitive personal information |
|
To comply with our legal or regulatory obligations. |
We have an appropriate business need (to comply with our legal and regulatory obligations). We have a relevant legal or regulatory obligation. |
Such use is necessary for insurance purposes. Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty. You have given us your explicit consent. We need to use your information in order to establish, exercise or defend legal rights. |
|
To write insurance policies and for claims handling. |
We have an appropriate business need (to effectively write policies and manage claims). |
Not applicable. |
|
For relationship and business development purposes. |
We have an appropriate business need (relationship management and business analysis). |
Not applicable. |
|
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers). |
We have an appropriate business need (to develop and improve the products and services we offer). |
Not applicable. |
|
To manage and handle any queries you may have. |
We have an appropriate business need (to effectively manage our business and respond to queries). |
Not applicable. |
We will keep your personal information confidential and only share it for the purposes outlined about where necessary with the following parties:
our other insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
our regulators;
fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
the police and other third parties (such as banks or other insurance companies) where reasonably necessary for the prevention or detection of crime;
other insurers who provide our own insurance;
industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
credit referencing agencies and third parties who carry out sanctions checks on our behalf;
our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers; or
third parties who handle our direct marketing on our behalf (this includes, for example, inclusion or suppression of your personal information from our contact lists, sending marketing communications, and analysis of responses to our marketing communications).
We may use your personal information to provide you with information about products or services which may be of interest to you where you are an existing customer or where you have provided your consent for us to do so. We may do this by post or email.
We are committed to only sending you marketing communications that you have clearly expressed an interest in receiving. If you wish to opt out of marketing, you may do so by clicking on the ‘unsubscribe’ link that appears in all emails or telling us when we call you. Otherwise you can always contact us using the details set out in section 10 to update your contact preferences.
Please note that, even if you opt out of receiving marketing messages, we may still send you service related communications where necessary.
We will only keep your personal information for the minimum periods required in order to fulfil the relevant purposes set out in this notice.
We are also required to keep certain information in order to comply with our legal and regulatory obligations.
The exact time period will depend on your relationship with us and the type of personal information we hold. For example, if you take out an insurance policy with us, we will keep your personal information for longer than if you obtain a quote from us but do not take out a policy.
If you would like further information regarding the periods for which your personal information will be stored, please contact us using the details set out in section 10.
We (or third parties acting on our behalf) may store or process information that we collect about you in countries outside the European Economic Area (‘EEA’). Where we make a transfer of your personal information outside of the EEA we will take the required steps to ensure that your personal information is protected. Such steps may include placing the party we are transferring information to under contractual obligations to protect your personal information to adequate standards.
Where we transfer personal information within the Hiscox Group of companies, we do so in reliance on ‘Standard Contractual Clauses’ which are set out clauses approved by the European Commission.
If you would like further information regarding the steps we take to safeguard your personal information, please contact us using the details set out in section 10.
We are Cyber Essentials certified and use a range of organisational and technical security measures to protect your information, including:
physical security measures such as on-site security and CCTV;
network security measures such as intrusion detection systems
access controls such as password protection and user logging; and
virus and malware controls on our systems.
We review our security measures periodically. We also ensure that our employees receive appropriate data security training.
The provision of insurance is often based on profiling the likelihood of the insured event occurring. For example, we will use the information you provide in conjunction with the information provided by third party sources to assess the likelihood of a claim being made and how much it might cost and use that assessment to decide whether or not to offer you insurance and at what price.
Insurance applicationFor certain policy types we use an automated underwriting engine to process the personal information you provide to us for your insurance application, together with information obtained from third party sources (such as flood risk information for home insurance policies) to determine your policy premium. Other information may also be used to calculate your premium, such as the use of any specialist devices we may have provided to you as a benefit of your policy, as well as any policy history you have with us. This information is required in order to provide you with an appropriate policy premium.
Fraud preventionWe may use profiling to assess the probability that claims may be fraudulent or inaccurate. We use your personal information to evaluate and predict risks and outcomes. We do not make automated decisions based on these profiles.
MarketingWe may use profiling to provide you with information about our products and benefits that are most appropriate to you. We may also use your personal information and profile to help us to improve our marketing materials, targeting and customer journeys.
We analyse our customers to determine common characteristics and preferences. We do this by considering various types of information which may include: your location, demographic information (such as age or job title) alongside additional policy information. These characteristics and preferences enable us to understand our customers as well as to send you appropriate communications, and information which is most relevant to you.
Automated decision making
Like many insurers, sometimes we make decisions using solely automated means. This automated process is often used in order to assist us predict the likelihood of events such a claim being made, its value and potential fraud. This helps us efficiently set premium prices which are appropriate for the insurance being provided. For example, an automated process may provide a home insurance policy price based on your postcode, risk of flooding and local crime rate.
The majority of automated decisions we make will be necessary to enter into or perform your insurance contract or necessary for insurance purposes. If not, we will ask for your consent before making any automated decisions which have a legal or substantially similar effect.
Where we make an automated decision which has a legal or substantially similar effect, you may request a review of that decision by a member of our team. We will take into account your comments and assess whether the decision was made correctly.
Under data protection law you have certain rights in relation to the personal information that we hold about you. There will not usually be a charge for dealing with these requests. You may exercise these rights at any time by contacting us using the details set out in section 10.
Please note:
the rights set out below do not apply in all circumstances;
in some cases we may not be able to comply with your request (for example, where there is a conflict with our own obligations to comply with other legal or regulatory requirements). However, we will always respond to any request you make and if we can't comply with your request, we will tell you why.
in some circumstances exercising some of these rights (such as the right to erasure or the right to restrict processing) will mean we are unable to continue providing you with insurance and may therefore result in its cancellation. You will therefore lose the right to bring any claim or receive any benefit, including in relation to any event that occurred before you exercised your right of erasure, if our ability to handle the claim has been prejudiced. Your policy terms and conditions set out what will happen in the event your policy is cancelled.
Your rights include:
You are entitled to a copy of the personal information we hold about you and certain details of how we use it.
Your information will usually be provided to you in writing, unless otherwise requested, or where you have made the request by electronic means, in which case the information will be provided to you by electronic means where possible.
We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you do not believe this is the case, you can ask us to update or amend it.
In certain circumstances, you have the right to ask us to erase your personal information, for example where the personal information we collected is no longer necessary for the original purpose or, where we are relying on consent as our legal ground, you withdraw your consent. However this will need to be balanced against other factors. For example, we may have legal and regulatory obligations which mean we cannot comply with your request.
In certain circumstances, you are entitled to ask us to stop using your personal information, for example where you think that the personal information we hold about you may be inaccurate or where you think that we no longer need to use your personal information.
In certain circumstances, you have the right to ask that we transfer personal information that you have provided to us to another third party of your choice.
You can ask us to stop sending you marketing messages at any time. You can do this either by clicking on the ‘unsubscribe’ button in any email that we send to you or you can contact us using the details set out in section 10. Please note that even if you opt out of receiving marketing messages, we may still send you service related communications where necessary.
As set out in section 8, you have a right to object to an automated decision in certain circumstances.
Where we process your personal information based on our appropriate business needs, you can object to such processing. In such cases, we will assess your objection against our business needs.
For certain uses of your personal information, we will ask for your consent. Where we do this, you have the right to withdraw your consent to further use of your personal information.
Please note that for some purposes, we need your consent in order to provide your policy. If you withdraw your consent, we may need to cancel your policy or be unable to pay your claim. We will advise you of this at the point you seek to withdraw your consent.
You have a right to complain to the Information Commissioner's Office (ICO) if you believe that any use of your personal information by us is in breach of applicable data protection laws and regulations. More information can be found on the Information Commissioner’s Office website: https://ico.org.uk/
Making a complaint will not affect any other legal rights or remedies that you have.
If you would like further information about any of the matters in this notice or have any other questions about how we collect, store or use your personal information, you may contact us by telephoning 01904 681198 or by e-mailing us at [email protected] or writing to us at 1 Great St Helen's, London EC3A 6HX.
From time to time we may need to make changes to this notice, for example, as the result of changes to law, technologies, or other developments. Where we make substantial changes to this notice we will provide you with an updated copy. You can also check our website: https://www.hiscox.co.uk/barclays/privacy-policy periodically to view the most up-to-date notice.
This notice was last updated on: 23rd July 2018.
Service review
As a bespoke offer for our Premier customers, you will be contacted by a member of the Hiscox team for a mid-year review of your current Buildings and Contents cover. The review will assess any new purchases or items you may have sold, meaning you always have peace of mind that you're home and personal belongings are fully covered and you're only paying for the cover you need.
You can contact us at any time if you don't feel the review is right for you on 0800 781 3065 alternatively you can email Hiscox at [email protected].