We ll collect and process information about you from a number of sources, including details:

Transcription

1 General Data Prtectin Regulatin (GDPR) - Privacy Ntice - SmartMiles Intrductin Yur privacy s imprtant t us and we g t great lengths t prtect it. This privacy ntice tells yu abut the persnal data we hld abut yu, s we can prvide yu with a Qute and an insurance plicy. It explains hw we may cllect, use and share yur details and tells yu abut yur rights under data prtectin laws. 1. Wh we are Hastings Insurance Services Ltd (trading as Hastings Direct Smartmiles), igo4 Ltd and Advantage Insurance Cmpany Ltd are the data cntrllers f yur persnal infrmatin, excluding driving data, under yur Smartmiles mtr insurance plicy. Hastings Insurance Services Ltd (HISL) and Advantage Insurance Cmpany Ltd (AICL) are the data cntrllers f yur driving data. Arc Legal Assistance Ltd, Carpenters Slicitrs and Inter Partner Assistance SA are the data cntrllers f yur persnal infrmatin under yur Mtr Legal Expenses plicy. In this privacy plicy, we refers t all f these cmpanies unless stated therwise. In relatin t yur Smartmiles plicy, Hastings Direct Smartmiles prvides the plicy, igo4 acts as the intermediary arranging the plicy and Advantage Insurance Cmpany is the insurer f the plicy. We have a single cntact pint fr data privacy matters at dataprtectin@ig4.cm r by writing t us at Data Prtectin Officer, Smartmiles Insurance, igo4 Huse, Staniland Way, Peterbrugh PE4 6JT. Fr the purpse f this privacy ntice: Data subjects are Plicyhlders, premium finance custmers and named drivers. Persnal data is infrmatin abut an identified r identifiable natural persn that culd allw a living persn t be identified 2. Infrmatin we cllect frm r abut yu We ll cllect and prcess infrmatin abut yu frm a number f surces, including details: yu give us we cllect frm yur use f ur services we get frm ther surces (bth public and private). If yu chse nt t give persnal data: Smetimes we have t cllect yur persnal data by law r under the terms f a cntract we have with yu. If yu dn t give us the data we ask fr, we might nt be able t give yu a Qute r perfrm the cntract we have with yu. If this happens, we may have t cancel ne f yur prducts r services. We ll tell yu if this happens. Infrmatin yu give us: When yu apply fr ur prducts and services When yu make payments r give payment details fr yur premiums r premium finance Abut any incident (like an accident r theft), whether r nt yu re ging t make a claim By phne, r letter e.g. fr queries r Qutes Fr surveys r t give feedback n ur prducts and services. Infrmatin we cllect frm yur use f ur services: Qutes thrugh ur website We may recrd inbund and utbund calls Page 1 f 9

2 Website usage e.g. ckies and tags. See ur ckie plicy fr mre details at: We may recrd the sending, buncing, pening and use f any links cntained directly in s and whether yu mark an as junk, including the time and date. Driving data cllected frm a SmartMiles telematics device. Infrmatin we get frm ther surces: Price cmparisn r ther intrductry services Credit reference agencies Claims underwriting exchanges and ther registers and databases Fraud preventin agencies DVLA External partners wrking n ur behalf Medical practitiners Market researchers Electral rll Gvernment and lawful enfrcements agencies. Infrmatin cllected may include: Persnal details such as yur name (including frmer names), date f birth, cntact details (e.g. yur hme address and frmer addresses, telephne numbers and address), length f time yu ve been a UK resident, marital status and identifiers such as yur driving licence number Sensitive persnal data (special categry data and criminal data), such as infrmatin abut yur health r criminal cnvictins Infrmatin abut yur insurance requirements, such as details f yur car, details f family and scial circumstances like yur marital status r yur use f the vehicle Driving data cllected by the Smartmiles telematics device Plicy details such as the dates yu jined r left (including yur reasn fr leaving, where relevant) Infrmatin abut yur ther and past plicies such as yur claims histry, Qutes histry, payment histry and claims data Bank accunt and/r payment card details t arrange payment f yur premiums r premium finance Infrmatin abut incidents and claims Emplyment details such as yur jb title Survey feedback and yur respnses including custmer satisfactin surveys and IP addresses Lcatin details Brwsing infrmatin as part f yu ging thrugh the Qute prcess t track and keep yur Qute jurney including incmplete Qutes In-bund and ut-bund phne call recrdings Cpies f yur identificatin and similar dcuments (e.g. driving licences) Infrmatin abut hw yu access ur website and app; including the website yu visited befre landing n ur websites. We autmatically receive the IP address f yur cmputer, mbile device, r the prxy server that yu use t access the Internet and this may include infrmatin t identify yur brwser r device t analyse web traffic Yur marketing preferences. 3. Persnal data abut thers We may cllect infrmatin abut ther peple in yur husehld r ther named drivers. If yu give us infrmatin abut anther persn, it s yur respnsibility t make sure they: have been tld abut wh we are and hw their data will be used have given their permissin fr yu t use their data (including any sensitive persnal data). 4. Hw we use yur infrmatin S we can prvide yu with Qutes and plicies, and t manage yur plicy, we must have a legal reasn t use yur persnal data. Page 2 f 9

3 Legal basis fr prcessing yur Persnal Data We are allwed t use and share yur infrmatin in the ways described in this Privacy Ntice: S that we can prvide yu with a qutatin at yur request and can arrange, prvide and administer yur plicy. Where we need t prcess sensitive infrmatin such as health and/r criminal cnvictin infrmatin fr insurance purpses, we d s n the permitted basis that it is in the public interest t ensure that insurance is available at reasnable cst thrugh risk-based pricing. S that we can cmply with legal and regulatry bligatins, such as legal bligatins t share infrmatin with ur Regulatrs and Ombudsmen, r carry ut financial sanctins checks. Where ur use f yur infrmatin is necessary fr ur legitimate business interests, such as marketing f ur prducts and services (unless yu ask us nt t), research and statistical analysis and cnducting custmer surveys. Additinal purpses f prcessing yur data: T make and manage custmers payments We cllect and share yur payment details with financial institutins t allw us t carry ut financial transactins n yur plicy. If yu ve already agreed t a cntinuus payment authrity, we ll use the card details yu gave us t cllect payments fr mid-term changes, missed instalments (including any fees), balances fllwing cancellatin and the renewal f yur plicy. We ll tell yu abut this befre we take a payment. Yu can cancel the cntinuus payment authrity at any time by cntacting us at cntact@hastingsdirectsmartmiles.cm. If yu chse t pay yur premium by instalments, this will be via a finance arrangement with ur premium finance supplier. We will share yur persnal, plicy and payment details with the finance cmpany t enable them t enter int the credit agreement with yu, cllect yur instalments and administer their service. The finance cmpany will becme data cntrller in respect f the infrmatin they prcess in prviding this service. We may pass yur data, and may assign yur debt, t selected debt cllectin agencies where we have been unable t recver the debt urselves. Surveys Yu may be asked t cmplete a survey r give us feedback n ur prducts and services. Often, we use third parties t carry ut these surveys. Yu dn t have t cmplete them but if yu d, we ll use the results t mnitr custmer service satisfactin and t imprve custmer service and, where yu have given yur cnsent, fr marketing purpses. Call recrding We may recrd in-bund and ut-bund phne calls and use the recrdings t prevent fraud, fr staff training and fr quality-cntrl purpses. Yur use f ur website We use varius sftware including ckies and tags t imprve yur digital jurney and t identify and prevent fraud. We cllect and stre infrmatin abut hw yu access and use ur website and app (including the website yu visited befre cming t ur websites). We autmatically receive the IP address f yur cmputer, mbile device, r the prxy server yu use t access the Internet and this may include infrmatin t identify yur brwser r device t analyse web traffic. Fraud preventin ckies cllect infrmatin abut certain features f yur device, such as yur IP address, device type, brwser type, screen reslutin and perating system. This is t prevent and detect devices assciated with fraudulent r ther malicius activity and allws us t authenticate yur accunt. s and webchat We may recrd the sending, delivery, pening and use f any links in s and webchat and whether yu mark an as junk, including the time and date f these actins. This helps cnfirm the successful delivery and the use f the s we send. T help us imprve the custmer experience, we may recrd the device the was viewed n, the web brwser used, hw lng an was viewed and any pages yu are directed t n ur websites. Marketing cmmunicatins Page 3 f 9

4 We d like t keep yu up t date abut ur prducts and services that might be f interest t yu. Hwever, if yu have indicated that yu prefer nt t be kept infrmed, we will make sure yu are nt cntacted in this way. Yu have the right t change yur mind abut receiving marketing frm us at any time and can d s by ing dataprtectin@ig4.cm r writing t Data Prtectin Officer, igo4, igo4 Huse, Staniland Way, Peterbrugh, PE4 6JT. Whatever yu chse, yu ll still receive ther imprtant infrmatin abut the prduct and services yu have with us such as: payment infrmatin details n hw t manage yur plicy using ur nline tls infrmatin abut a claim messages abut yur renewal. Marketing prfiling We may use yur data t cnduct analysis that grups individuals by ne r many variables (e.g. age, lcatin) t understand behaviural trends and t target grups f similar individuals wh we think may have an interest in ur prducts, services and/r ffers. We ll tailr ur ffers and cmmunicatins t yu based n the results f this prfiling. We ll never prvide infrmatin abut yu t cmpanies utside ur Grup t use fr their wn marketing purpses. Industry databases and ther surces We might use infrmatin abut yu frm industry-wide databases and ther third parties, t help us calculate an insurance Qute, manage a plicy and fr anti-fraud purpses. Details f the databases we currently use are available n request. We may als validate the infrmatin yu give us when requesting a Qute and if a claim is made n yur plicy. We d this t identify and prevent crime and fraud t prtect the interests f us and ur custmers. We may at any time check and/r file yur details with fraud preventin agencies and databases if yu give us false r inaccurate infrmatin and fraud is suspected (see Sectin 5). Custmer database changes S we can make sure ur custmer infrmatin is up t date, we ll smetimes use external data partners t prvide checks n any changes t custmer data r status that we might nt have been made aware f therwise, such as changes f address r deaths Price cmparisn r ther intrductry services If yu get a Qute thrugh a price cmparisn website (PCW) r ther service, we ll get the infrmatin yu ve given t that service, s we can respnd t yur request. This is t imprve yur nline experience by nt having t re-enter yur details. We als prcess the infrmatin yu ve given t a PCW and ther intrductry services t get a Qute (whether yu buy the plicy r nt), t validate later data given by yu t us and/r PCWs, t detect fraud, t develp acceptance risk criteria and t build bth underwriting (insurer(s)) and retail price mdels. Where yu ve bught a plicy using an intrductry cash back incentive cde, link r claim a reward thrugh ne f the price cmparisn websites, we get and share infrmatin abut yu with the incentive prvider r price cmparisn website t validate yur claim. Credit searches and data checks Credit reference agencies cllect and maintain infrmatin abut cnsumers and businesses credit behaviur. This includes the electral register, fraud data, search histry, credit infrmatin and public infrmatin such as Cunty Curt Judgments and bankruptcy rders. We pass infrmatin abut yu t a credit reference agency, where it s needed t carry ut a search n yur credit file t identify yu, befre we can give yu any services (including Qutes and befre ffering a renewal). We als ask them t give us yur credit scre and infrmatin abut yur public credit infrmatin, fr example Cunty Curt Judgments r inslvency, as this infrmatin is used in ur credit assessment. The credit reference agency keep a recrd f the search and place a sft ftprint n yur credit file, whether r nt yur applicatin cntinues. This can nly be seen by us, them, and yu and wn t be used by ther rganisatins t make credit decisins. Page 4 f 9

5 In additin, if yu chse t pay by instalments, ur funding agency Clse Brthers Limited trading as Clse Brthers Premium Finance will use credit referencing agencies fr a hard credit check fr new plicies and renewals. Yur entire credit histry will be searched and a mark will be left n yur credit reprt, s whenever prspective lenders lk at yur credit reprt they can see yu applied fr credit and whether yu were accepted. Claims Underwriting Exchange (CUE) and ther registers and databases. We and ther Insurers exchange infrmatin with varius databases and registers t help us check the infrmatin yu give us, t detect and prevent crime and fraud and t get infrmatin abut yur n claims histry. These may include: the Claims and Underwriting Exchange Register (CUE), run by Insurance Database Services Limited (IDS Ltd) the Hunter Database run by MCL Sftware Ltd the Mtr Insurance Anti-Fraud and Theft Register, run by the Assciatin f British Insurers (ABI) the N Claims Histry Database, run by RELX Grup trading as LexisNexis. Infrmatin may be shared with these registers and checks carried ut against the infrmatin held n these registers when we are dealing with: yur request fr insurance yur renewal when amendments are made t yur mtr plicy where a claim is made where it is necessary t update ur plicy recrds. Under the Terms and Cnditins f yur plicy, yu must tell us abut any incident (such as an accident, fire r theft) which might cause a claim. When yu tell us abut an incident, we will pass this infrmatin t the abve registers and any ther relevant registers. Fraud preventin agency The persnal data yu ve given us, we ve cllected frm yu r we ve received frm third parties will be used t cnfirm yur identity and t identify and prevent fraud and mney laundering. The type f infrmatin that will be prcessed culd be yur: name address date f birth cntact details financial infrmatin emplyment details device identifiers including IP address vehicle details. We, and fraud preventin agencies, may als allw law enfrcement agencies t access and use yur persnal data t detect, investigate and prevent crime. We prcess yur persnal data n the basis that we have a legitimate interest in preventing fraud and mney laundering and t cnfirm yur identity. This is s we can prtect ur business and cmply with laws that apply t us. Such prcessing is als a cntractual requirement f the services r financing yu have asked fr. Fraud preventin agencies can hld yur persnal data fr different perids f time and if yu re cnsidered t pse a fraud r mney laundering risk, yur data can be held fr up t seven years. If we, r a fraud preventin agency, determine yu re a fraud r mney laundering risk, we may refuse t prvide the services and financing yu ve asked fr, r t emply yu, r we may stp prviding any existing services. A recrd f any fraud r mney laundering risk will be kept by the fraud preventin agencies and may result in thers refusing t prvide services, financing r emplyment t yu. If yu ve any questins abut this, r fr mre infrmatin n the fraud preventin agencies we share data with r t exercise yur data prtectin rights, yu can cntact us as explained in Sectin 7. Autmated decisin-making The nature f insurance is t prvide a price fr a ptential risk (including its ptential claim value) based n the prbability f it arising. S we can give yu the best pssible price at a speed expected when getting Qutes n the Internet, we use autmated decisin-making. Autmated decisin-making includes: Page 5 f 9

6 - the creatin f pricing mdels and risk acceptance criteria - the prfiling f yu, based n the data we cllect and hld abut yu t validate and supplement the data we hld and t maintain its accuracy - the applicatin f the pricing and risk mdels using data we hld abut yu, t accept r decline yur request fr insurance and t calculate the price f yur plicy - assessing yur ability t pay the insurance premiums and/r credit - assessing the risk f fraud being cmmitted n yur plicy - measuring yur driving behaviur and calculating a driving scre. Frm these checks, yur premium, plicy terms and credit terms will be determined, r we may nt be able t give yu insurance r credit. As described in Sectin 7, yu have the right t express yur pint f view and t bject t an autmated decisin, and t get human interventin t review it. Driving data Hastings Direct Smartmiles and Advantage Insurance Cmpany will use the Smartmiles device data fr the purpse f prviding yu with yur plicy and ensuring that yu are paying a premium that is reflective f yur driving perfrmance and that f any named drivers n yur plicy. The Smartmiles device data will be used t calculate a driving scre which will be displayed nline n yur Smartmiles Dashbard. We will prvide yu with lg in details fr this nce the Smartmiles device has been activated. The driving scre relates t yur car and nt t yu specifically, s yu shuld be aware f this if ther peple have permissin t drive yur car. Yur infrmatin, including the Smartmiles device data, will be used fr the fllwing purpses: t cntribute twards the calculatin and charging f yur insurance premium based upn actual vehicle usage and driving behaviurs; t help us handle any claims, and reduce fraud, by assisting with the identificatin, assessment r investigatin f claims made and t prvide clarificatin as t the circumstances f the claim; if yu have a prfessinally fitted r self-installed Smartmiles device, t prvide yu with the theft tracking service included in yur plicy; t prvide yu with any ther additinal services requiring use f the Smartmiles device which we may ffer yu and yu may agree t take up frm time t time; t help understand safe driving behaviurs which we will use t develp underwriting f this prduct and t infrm develpment f similar prducts; t validate ther infrmatin prvided by yu when buying, adjusting r renewing yur plicy, including but nt limited t where yur car is kept and yur annual mileage; t issue us with crash ntificatins s we culd cntact yu t ffer assistance. The infrmatin cllected by the Smartmiles device and sme f the infrmatin prvided by yu at the pint f applicatin, such as age, gender, marital status, the vehicle registratin number, make, mdel and engine size f yur car will als be used by us and ur respective agents fr analysis and research purpses bth during the perid f insurance and nce yur plicy has ceased. Fllwing expiry r cancellatin f yur plicy, we will cease t cllect data frm the Smartmiles device. If yu have a prfessinally installed Smartmiles device, yu may ask fr it t be remved frm yur car subject t payment f the administratin charge as shwn in ur Terms and Cnditins. If yu have a selfinstalled Smartmiles device, it may be dispsed f by yu upn expiry r cancellatin and the app uninstalled frm yur phne. 5. Hw we share yur data This sectin explains hw yur data will be shared by us. Wh we share yur persnal data with We may share yur persnal data, including Qute infrmatin we hld abut yu (whether yu buy a plicy frm us r nt), with the fllwing third parties fr the reasns explained in Sectin 4: a) ptinal extra prduct prviders wh prvide yu with an insurance Qute thrugh us as a brker and/r price cmparisn website; b) third party rganisatins with whm we get and als share yur data, as described in Sectin 2 and Sectin 4 c) ur third party suppliers wh specialise in nline custmer jurney ptimisatin d) with suppliers acting n ur behalf - fr example, ur claims suppliers such as lss adjustrs, slicitrs, private investigatrs, vehicle repairers r car hire prviders Page 6 f 9

7 e) gvernment rganisatins such as ur regulatrs, the Financial Ombudsman Service (FOS); the Plice, Trading Standards f) fraud preventin rganisatins and agencies such as, Insurance Fraud Register; CUE and the Mtr Insurance Anti-Fraud and Theft Register If we find yu ve given us false r inaccurate infrmatin we may pass yur details t fraud preventin agencies. T prevent fraud and mney laundering, we and ther rganisatins, including law enfrcement agencies may als access and use infrmatin recrded by fraud preventin agencies, fr example, when: - Checking details n applicatins fr credit, credit related r ther facilities - Managing credit and credit related accunts r facilities and recvering debt - Checking details n prpsals and claims fr all types f insurance - Cmpleting credit and fraud searches, such as a driving licence checks - Checking any fraud detected thrugh yur jb applicatins and emplyment. g) finance institutins t allw us t carry ut a financial transactin in respect f yur plicy h) prfessinal auditing bdies fr auditing purpses i) third party debt cllectin agencies j) We will disclse infrmatin cllected by the Smartmiles device in the fllwing circumstances: - where yu have prvided yur agreement; - t ur agents and suppliers fr peratinal reasns and fr the prcessing and analysis f Smartmiles device data, including fr research purpses; - if we are required by law t disclse the infrmatin, such as t regulatrs r t the Plice. We will nt pass the Smartmiles device data t the Plice unless required t d s. We may als share yur persnal data if the structure and make-up f Hastings r ther data cntrllers changes in the future. We may chse t sell, transfer r merge parts f ur business r assets. We may als seek t acquire ther businesses r merge with them. During this prcess, we may share yur data with ther parties. We ll nly d this if they agree t keep yur data safe and private. If a change like this happens, then the ther parties may use yur data in the same way as set ut in this privacy ntice Sending data utside the EEA We may transfer persnal data t, and prcess persnal data in a cuntry utside f the Eurpean Ecnmic Area (EEA). If we d transfer yur data utside f the EEA, we will make sure that it is prtected in the same way as if it was being used in the EEA. In mst cases, this will be by using apprved EU Standard Cntractual Clauses which can be viewed at We may als prcess yur data in cuntries which have reached Adequacy Decisins with the Eurpean Cmmissin, r are part f the Privacy Shield in the US. Whenever fraud preventin agencies transfer yur persnal data utside f the EEA, they t will impse cntractual bligatins n the recipients f that data t prtect yur persnal data t the standard required in the EEA. They als require the recipient t subscribe t internatinal framewrks intended t allw secure data sharing. 6. Hw lng will we stre yur infrmatin? If yu ask fr an insurance Qute, either directly r thrugh a price cmparisn website, we will keep yur persnal data (whether yu buy the plicy r nt) fr up t three years frm the date f Qute. After yur Qute has been prvided we will prcess this data fr develping ur acceptance risk criteria, pricing mdels and t prevent and detect fraud. Where yu buy an insurance plicy frm us, we will keep yur persnal data fr the duratin f yur plicy and fr up t seven years afterwards fr the fllwing reasns: t respnd t any questins r cmplaints t deal with claims against yur plicy. HISL and AICL might keep yur data fr lnger than seven years after yu stp being a custmer in the fllwing circumstances: where a claim has been settled after yu stp being a custmer where minrs are invlved in a claim where there is a claim n yur plicy ver a set amunt - we use such persnal data t infrm ur pricing mdels after the claim is finally determined. Page 7 f 9

8 7. Yur rights and hw t cntact us Yu have the right t: a cpy f yur persnal data held (see sectin 8); have yur data crrected if it is inaccurate r incmplete; have yur data deleted r remved if it is n lnger necessary fr the purpses fr which it was cllected and where there is n ther valid legal grund t retain it; restrict the prcessing f yur persnal data; withdraw any cnsent yu have given in respect f yur persnal data (including marketing). data prtability - t retain and reuse yur data in an electrnic frm fr yur wn purpses r t request we pass the infrmatin t anther rganisatin; btain human interventin, where yu are subject t a decisin based slely n autmated prcessing, including prfiling, which has a significant effect n yu, t express yur pint f view and/r t cntest the decisin - See Sectin 4 fr further details n the autmated decisin making; bject where we re prcessing yur infrmatin n the grunds f it being in ur legitimate interests t d s. We have established a data prtectin team wh are respnsible fr verseeing questins in relatin t this privacy ntice. If yu have any questins abut this privacy ntice, including any requests t exercise yur legal rights, please cntact ur data prtectin team using the details set ut belw. When cntacting us, please prvide yur full name, plicy and/r qute number if applicable, address and date f birth and address t: Data Prtectin Officer Hastings Direct SmartMiles igo4 Huse Staniland Way Peterbrugh PE4 6JT dataprtectin@ig4.cm. 8. Subject Access Request Yu have the right t btain: cnfirmatin that yur data is being prcessed; access t yur persnal data; ther supplementary infrmatin, which is prvided in this privacy ntice. If yu wish t request cnfirmatin that yur data is being prcessed, r access t yur persnal data, yu shuld d this in writing by using the cntact details prvided in Sectin Cmplaints If yu are nt happy with the way yur persnal data is held r prcessed; please cntact us at the address abve. Yu als have the right t cmplain t the Infrmatin Cmmissiners Office (ICO), the UK supervisry authrity fr data prtectin issues ( The ICO will usually require yu t have apprached us first t try t reslve the matter. 10. Plicy updates We may update r amend this privacy ntice frm time t time t cmply with the law r meet changing business requirements. Any changes t this plicy will be psted n this page. This versin was last updated n 1st May 2018 and histric versins are archived can be btained by cntacting us. Page 8 f 9

9 11. Glssary "data prtectin laws" means the General Data Prtectin Regulatin ((EU) 2016/679) and any natinal implementing laws, regulatins and secndary legislatin, as amended r updated frm time t time, in the UK. IP address is the term fr an Internet Prtcl address which is a numerical cde that each device cnnected t the Internet has in rder t identify that device. The cde cntains an element that supprts lcatin identificatin (t varying levels f accuracy). Terms and Cnditins the terms and cnditins set ut in the plicy and r plicy bklet(s) issued t yu. Qute fr the purpse f this privacy ntice shall include any qute fr a new plicy, renewal f yur existing plicy r when yu make a mid-term change t yur existing plicy. Page 9 f 9