Cyber Liability Insurance

Transcription

1 Cyber Liability Insurance Contents Declaration form A summary of cover A statement of demands and needs Our range of services Our terms of business agreement How to proceed Please ensure that you read this document thoroughly. Should you wish to proceed with the insurance, please select the level of cover required from the proposal form and return this together with your cheque in settlement. Cheques should be made payable to Bluefin Insurance Services Limited. All completed forms should be signed and returned to the address below. Alternatively, scan and send your completed form to enquiry.professions@bluefingroup.co.uk. Bluefin Professions Castlemead Lower Castle Street Bristol BS1 3AG Cover will only commence once the enclosed declaration form and payment have been received, accepted and acknowledged by Bluefin. A copy of this application pack should be retained for your insurance records. A copy of your policy wording can be downloaded from our website at the following address: As a client of Bluefin you will have access to the following additional benefits: Free legal and tax advice helplines Free health, medical and counselling advice helplines We would also take this opportunity to remind you that you are responsible, on an ongoing basis, for providing us with all material facts relating to the insurance cover we have arranged on your behalf. Failure to advise material changes at the earliest possible opportunity may mean that your cover is invalid. If you are in any doubt as to what facts are considered to be material then you should disclose them to us. Bluefin Professions is a trading name of Bluefin Insurance Services Limited. Registered Office: 1 Tower Place West, Tower Place, London, EC3R 5BU. Registered in England No: Authorised and regulated by the Financial Conduct Authority.

2 CyberEdge Declaration Instructions The following proposal form is only applicable to proposed policyholders with total gross revenue of 20,000,000 or less and excludes Insurance Brokers and Independent Financial Advisors. Please request a Proposal Form if you fall outside of these parameters. Signing or completing this proposal does not bind the Proposer, or any individual or entity he or she is representing to complete this insurance. Please provide by addendum on the Company headed paper of the Proposer any supplementary information which is material to the response of the questions herein, and/or complete answers to the listed questions if they do not fit in the space provided on the application. For the purpose of this proposal form, Proposer means the entity stated below and all its subsidiaries to be covered. All answers should be given as a group response i.e. if any subsidiary company has different responses these should be provide separately on your headed paper. Cover will only commence once this declaration form and payment have been received, accepted and acknowledged by Bluefin. 1 Proposer information Company name Registered address Business address Postcode: Business description / industry Postcode: Web address Total gross revenue / fee income for the last financial year YYYY Number of client records 2 Cover selection Based on the total gross revenue for the last financial year, tick the box indicating the Premium for the option required. Limit of Liability (Any one claim and in the aggregate) Total Gross Revenue 100,000* 250,000* 500,000* 1,000,000* 2,000,000* 3,000,000* Excess** Up to 100, , , , ,001 to 250, , , , ,0001 to 500, , , , ,001 to 1,000, , , , , ,000,001 to 2,500, , , , , , ,500,001 to 5,000, , , , , , , ,000,001 to 10,000,000 1, , , , , , , ,000,001 to 20,000,000 2, , , , , , , If you require a limit of liability above the 3,000,000, or the total gross revenue is above 20,000,000, approach your Broker to obtain a specific alternative quote. Please note that this document does not represent a unilateral offer and that the terms herein are subject to confirmation by the Insurer. *Standard premiums above are including insurance premium tax currently levied at 12%. A Bluefin administration fee of 50 will be added to the total. **Applicable to all sections of the policy, except for First Response where Nil excess applies. 3 Coverage. Coverage Sub Limit of Liability Separate Excess A. Event Management Full policy limit General policy excess A.1 First Response Full policy limit Nil excess B.1 Data Protection Investigators Full policy limit General policy excess B.2 Data Protection Fines Full policy limit General policy excess C. Liability Full policy limit General policy excess Bluefin Professions CyberEdge Declaration v1.0

3 4 Optional extensions If you would like to add any of the optional extensions, tick the box(es) indicating the option(s) required. Coverage Sub Limit of Liability Separate Retention/Excess Additional Premium *** Digital Media Full policy limit General policy excess 10% of standard premium Cyber / Privacy Extortion Liability Full policy limit General policy excess 5% of standard premium Outsource Service Provider 100,000 General policy excess 10% of standard premium Network Interruption Full policy limit Waiting period 12 hours 25% of standard premium *** Select the optional extra cover required and add the percentages together to find the TOTAL PERCENTAGE to be added to the STANDARD PREMIUM Total % to add to STANDARD PREMIUM % If you have ticked to include the Outsource Service Provider extension please complete the following questions: (N.B. An OSP is defined as an entity which is not owned, operated or controlled by the Company that the Company has appointed to provide specified services) i) Please provide the name of the biggest outsource provider used ii) If applicable, please provide details of the second largest outsource provider used iii) Please confirm what type of service is being provided: a) Application Service Provider b) Data Centre Hosting c) Data Processing d) Intrusion Detection e) Managed Security f) Other please provide details below 5 Premium calculation Standard premium from page 1 (inclusive of IPT) Add % for optional extensions (if applicable) (inclusive of IPT) Add Bluefin administration fee Total Premium Due (inclusive of IPT and administration fee) 6 Conditions Applicable Wording: AIG CyberEdge Version: CyberEdge 2014 Retroactive Date Inception Period requested: 12 months with inception from / / Quote valid for: 30 days from date of declaration

4 Confirmation of insured s status I/We confirm that the Insured and its subsidiaries: a) Are not Financial Institutions, Medical, Call Centres, Telemarketing, Data Processing (outsourcers), Internet Service Providers, Telecommunications b) Have security software controls (Antivirus protection, firewalls, intrusion detection, vulnerability testing) on all IT systems, including portable devices c) Have back up and recovery procedures for all mission critical systems, data and information assets d) Do not have any domiciled operation or derived revenue from the territory/jurisdiction of USA and/or Canada e) Has a documented Business Continuity Plan (BCP) or Disaster Recovery Plan (DRP) YES NO f) After a full enquiry of its directors and officers, do not have any knowledge of any act or omission, fact, event or circumstance which might give rise to a loss under this Cyber Edge insurance contract If you tick NO to any of the above statements, please provide full details and approach Bluefin to obtain a specific alternative quote. Declaration Your duty to make a fair presentation of the risk You must make a fair presentation of the risk to us when you take out, renew or amend your policy. A fair presentation requires you to tell us about all facts and circumstances which may be material to the insurance or sufficient information to put a prudent insurer on notice that further enquiries are needed, in a clear and accessible manner. Material facts are those which are likely to influence an insurer in the acceptance or assessment of the terms or pricing of your policy. If you are in any doubt as to whether a fact is material, you should tell us about it. If you fail to make a fair presentation of the risk, where that failure is deliberate or reckless, the insurer may treat your policy as if it had not existed, refuse to pay any claims and keep the premium paid. Where the failure is not deliberate or reckless but the insurer would not have accepted the policy had you told them about a material fact or circumstance, the insurer may treat your policy as if it had not existed and refuse to pay any claims but must return the premium. In other cases, the insurer may only pay part of the value of your claim or impose additional terms. For these reasons, it is important that you check all of the facts, statements and information set out in the documentation provided by us are complete and accurate, and that you answer any questions completely and accurately. If there is more than one person involved in your business or employed by you, you should check with them, where appropriate, that the facts and statements that you make are complete and accurate. If any of the facts, statements and information in this document, or any additional information provided are incomplete or inaccurate, you must contact us immediately. Failure to do so could invalidate your policy or lead to a claim not being paid. I declare that the above statements and particulars are true, full enquiry having been made, and I have not omitted, suppressed or misstated any material facts and undertake to inform the insurer of any change to any material fact. I understand that the information provided will be used by the insurer and/or their agents to arrange and administer the insurance and in handling claims which may necessitate sharing information with third parties and that information may be shared with business partners to deliver any additional services provided with this insurance. A copy of this proposal should be retained by you for your own records This form must be signed by a principal of the firm Signature: Date: / / Print name: Position: Please return this application form along with any other supplementary information sheets to the address detailed below:- Bluefin Professions Castlemead Lower Castle Street Bristol BS1 3AG t: enquiry.professions@bluefingroup.co.uk Bluefin Professions is a trading name of Bluefin Insurance Services Limited. Registered Office: 1 Tower Place West, Tower Place, London, EC3R 5BU. Registered in England No: Authorised and regulated by the Financial Conduct Authority Bluefin Insurance Services Limited

5 Summary of cover AIG CyberEdge The following information is a brief outline of the cover provided by the AIG CyberEdge policy. It is only a summary for general guidance and scope and terms are subject to the terms and conditions of the policy wording, CyberEdge 2014 (Ref: CIS /13). You are advised to read the policy document in full in order to ensure that you understand the cover provided. Policy summary features and benefits The best way to protect against cyber attacks is to prevent them in the first place, but sometimes that is not possible. If the first line of your defence is breached, CyberEdge is designed to help you manage and control the impact and get back to business as usual. The typical covers available are: First Response A specialist response service that you can access in the event of a data or privacy breach and thereby ensure your and your customer s positions are protected Immediate response from a breach coach within 1 hour of notification Expert forensics, what s been affected, how can it be contained, repaired or restored Expert legal response and PR consultancy to contain reputational damage Main exclusions The First Response fees and expenses will only be paid during the 48 hours from notification Consultancy services All necessary costs and expenses up to your selected sum insured incurred in determining whether electronic data can or cannot be restored or recreated Professional consultancy costs to prevent or minimise potentially adverse effects of a newsworthy cyber event Costs of notifying data subjects who may be affected by the breach and costs of credit monitoring to prevent further losses Main exclusions The Insurer will only pay fees and expenses for the above that are incurred during 185 days from notification Data Protection Legal costs incurred to defend a criminal prosecution or an enforcement action brought under the Data Protection Act Defence costs in respect of any regulatory investigation Data protection fines and penalties that you are legally liable to pay in respect of any regulatory investigation Main exclusions Regulatory investigation will not include any industry-wide, non-firm specific, inquiry or action Excludes any criminal fines and penalties Liabilities Necessary costs and expenses to defend a claim against you and damages awarded in connection with: Any breach of personal or corporate data Contaminating someone else s data with a virus Theft of system access code Jan 2015 AIG CyberEdge2014 CIS /13

6 Theft of hardware containing personal data A negligent act or error by an employee in relation to any of the above Optional extensions Digital Media Liability Defence costs and damages relating to your performance of or failure to perform digital media activities arising from the following wrongful acts: Libel or slander Unintentional infringement of intellectual property rights Infringement of privacy or breach of confidentiality Plagiarism, piracy or misappropriation Passing off Main exclusions Any loss arising out of the publication of financial data Any broadcast on your internal messaging services Any infringement of trademarks Any claim in relation to disputes over the ownership or exercise of rights in digital media Any software copyright infringement Cyber/Privacy Extortion Liability Monies paid in relation to an extortion threat relating to your data or data held on behalf of a third party company Ransom monies Necessary fees to conduct an investigation to determine the cause of and to end an extortion threat Main exclusions Any loss arising out of a threat made by a government entity or public authority It is a condition precedent under this section that you must notify the Cyber Extortion Advisor immediately in the event of an extortion threat at the contact details provided in the policy Schedule Network Interruption Insurance Cover for loss of net profit following a material interruption to your network caused by a security breach, including: Receipt of or transmission of malware which causes damage to third party data Physical theft of hardware Theft of a password or network access code Conditions There is no cover provided in the first 12 hours of a material interruption Mitigation costs during a material interruption to be paid after half of the Waiting Period has elapsed Written proof of loss to be provided within 180 days after resolution of the material interruption Main exclusions Any claims made by third parties Any network loss involving an order of any government entity or public authority, other than as a result of a Regulatory Investigation Network interruption caused by loss of communications with a third party Legal costs, unfavourable business conditions or removal of software programme errors Enhancement of system to a level beyond what existed prior to the loss Any failure of any hosted computer infrastructure or computing platforms Jan 2015 AIG CyberEdge2014 CIS /13

7 Outsource Service Provider (OSP) Cover responds to a security failure at your OSP that results in the loss of protected data or stops you accessing data or services. Legal and consulting costs to manage and mitigate the incident Costs of reconstituting data and software Network interruption loss resulting from a material interruption to an OSP s computer system OSP interruption and mitigation costs Conditions Written proof of loss to be provided within 180 days after resolution of the material interruption Main exclusions Any network loss involving an order of any government entity or public authority Network interruption controlled by an OSP caused by failure of an electronic device Legal costs, unfavourable business conditions or removal of software programme errors Enhancement of system to a level beyond what existed prior to the loss Any failure of any hosted computer infrastructure or computing platforms Significant exclusions and limitations Please refer to the policy wording for all exclusions and conditions of cover that apply. Notable exclusions, applicable to the whole policy, include: Antitrust violation, restraint of trade or unfair competition Any deliberate, intentional or reckless act committed by or in collusion with your directors, principals, partners or responsible officer Any dishonest, fraudulent or criminal act committed by or in collusion with your directors, principals, partners or responsible officer Infringement of intellectual property due to unauthorised disclosure Obligations to make licensing fees or royalty payments Violation of any law or regulation relating to the purchase or sale of securities Face value of coupons, price discounts, prizes or awards given in excess of the contracted amount Failure to put right deficiencies that a responsible officer was aware of Rectifying deficiencies that existed prior to the security or system failure Wrongful collection of corporate or personal information Fees, compensation or costs of providing services In addition, points a - g under the Confirmation of insured s status on the final page of the separate CyberEdge Declaration form part of the policy contract and may affect the cover provided under this policy. It is, therefore, important that you have answered those questions honestly and accurately. Limit of Liability The limit of liability is an aggregate limit for the policy period and is the total amount payable in respect of all insurance covers, including any cover provided by the optional extensions. Except with respect to First Response and OSP First Response of the Outsource Service Provider Additional Coverage Section (if purchased) where the insurers liability is in addition to the limit of liability but limited to the fees and expenses incurred within the first 48 hours of notification. A sub limit of 100,000 will apply to the Outsource Service Provider extension, and is included in the overall limit of indemnity. Policy excess General policy retention varies depending on total gross revenue: Up to 1,000,000 revenue, 1,000 retention 1,000,001 to 5,000,000 revenue, 2,500 retention 5,000,001 to 10,000,000 revenue, 5,000 retention 10,000,001 to 20,000,000 revenue, 7,500 retention No retention is applicable to First Response or OSP First Response of the Outsource Service Provider Additional Coverage Section (if purchased) Jan 2015 AIG CyberEdge2014 CIS /13

8 Claims notification This policy is underwritten on a claims made basis which means that the policy will only respond to claims that are first made against the insured and notified to the insurer during the policy period. It is a condition precedent that all claims are to be made in writing as soon as practicable and no later than 60 days after the end of the policy period. Failure to comply with a condition precedent could result in the insurer avoiding a claim. The insurer The insurance policy is underwritten by AIG Europe Limited Policy duration This is an annually renewable policy Law applicable The laws of England and Wales apply to this policy Cancellation rights You may cancel this policy and as long as no claims have been made or circumstances notified prior to the cancellation the insurer shall retain 25% of the original premium plus the pro-rata proportion due for time on risk. The insurer can cancel the policy giving you a minimum of 30 days written notice (10 days in the event of cancellation for non-payment of premium). In such case the insurer shall be entitled to a pro-rata proportion of the premium. Complaints Sometimes things may not go entirely to plan. Both Bluefin and the Insurer welcome the opportunity to discuss any concerns that you may have about any aspect of the service you have received. Should you wish to discuss a problem please contact Bluefin in the first instance at the following: Bluefin Professions Castlemead Lower Castle Street Bristol BS1 3AG Tel: Fax: If Bluefin are unable to resolve your complaint then this can be referred to the insurer at the following: Claims related complaints Head of Financial Lines & Professions Claims Claims Manager 58 Fenchurch Street London EC3M 4AB Tel: claims.fl2@aig.com All other complaints Customer Relations Unit AIG Europe Limited 2-8 Altyre Road Croydon CR9 2LG Tel: Fax: uk.customer.relations@aig.com Financial Services Compensation Scheme (FSCS) The insurer is covered by the FSCS and you may be entitled to compensation from the scheme in the unlikely event that the insurer cannot meet its obligations. This depends on the type of business and the circumstances of the claim. Full details are available at Jan 2015 AIG CyberEdge2014 CIS /13

9 Our range of services What we do for our commercial customers The services delivered to you by our trained, professional staff depend upon the particular risks you face and your insurance cover requirements. Here are some examples of what we may do for you, depending on your individual circumstances: Initially and at renewal confirm the purpose of making contact with you answer your queries and provide insurance advice collate and check the information required to review your insurable risks. Market search identify insurance products that match your needs review relevant insurers for their suitability, including things such as pricing, policy terms, service standards, claims service present your requirements to insurers monitor the receipt of insurers quotations and negotiate price, terms & conditions. Presenting our recommendations provide a breakdown of the price give an explanation of the cover including any significant or unusual conditions or exclusions explain the scope of our search of the market clarify on whose behalf we act when arranging your policy tell you if we have used another intermediary to place your insurance cover clarify on whose behalf we act for when dealing with a claim make clear any fees or charges due in the period of the policy in addition to the insurance premium. Confirming cover discuss our personal recommendation and take your instruction as to how you wish to proceed request insurers to start cover and confirm to you when they have agreed check the policy is issued correctly and meets your demands and needs. Day-to-day Claims carry out regular analysis of the insurance market to enable us to provide you with professional advice answer queries on the policy cover, insurance matters or proposed change to your insurance risk confirm mid term adjustments to your insurer under your instruction. report claims on your behalf or ensure you have the relevant contact details for speedy reporting of a claim liaise with your insurer or with the loss adjuster they may appoint. Accounting - we will arrange monthly payments if requested (subject to qualification) issue an invoice detailing the payment we require reconcile your payment and pay your insurer obtain return premiums for you, when appropriate. You are entitled, at any time, to request information regarding any commission which we may have received as a result of placing your insurance business. Cyber Liability Advised Jan 2015

10 Statement of demands and needs Client name Business description We ve assessed what you need based on the information you gave us, and our recommendations are summarised below. Your main requirements are for insurance policies that give you the following cover: Policy type Cyber Liability Insurance Your main requirements You require a policy that provides cover against risks associated with accidental loss or misappropriation of electronically stored data or unauthorised accessing of your computer system. We recommend: Policy type Cyber Liability Insurance Recommendation We are recommending a policy from AIG (Europe) Ltd, because they have become one of the market leaders in cyber liability insurance. In addition to the above, the cover from AIG also includes; your accidental contamination of a third party s data with a virus indemnity for your legal liability arising out of breaches of data protection legislation following a cyber attack access to specialist PR consultants to help manage any serious data breach should one occur Cyber Liability Advised Jan 2015

11 Our capacity and services The capacity in which Bluefin is acting Bluefin usually acts as your agent in its capacity as an insurance intermediary. Because of this we are subject to the law of agency, which sets out our duty of care to you. In some circumstances, we may act for and have a duty of care to insurers. The following table sets out these circumstances, so you can see any possible conflicts of interest. Sourcing a suitable policy when we get quotes for you Placing the insurance when we arrange for your cover to start In the event of a claim Cyber Liability Insurance We act We act We act We act We will We will as your as agent as your as agent act as act as agent of the agent of the your agent of insurer insurer agent the insurer How we made our selection Policy Cyber Liability Insurance Market selection Fair Limited Single Other Delegated analysis number of insurer intermediary authority insurers What we mean by: Fair analysis: we have carried out a fair analysis of the market in order to identify a suitable product. This means that we have compared products from a sufficiently large range of insurance providers in terms of cover, price, quality of service and other relevant features in order to select an appropriate policy for you. Limited number of insurers: our search for a product to meet your requirements has involved a limited number of insurers. We are happy to discuss with you the scope and outcome of our search. You can ask us at any time for a list of the insurers we may, and do, use. Single insurer: we have chosen to approach one insurer for this specific type of insurance. You can ask us at any time for a list of the insurers we may, and do, use. Other intermediary: to access the insurance product that best suits your needs, we will use another intermediary to place your business. Delegated authority: the terms for your policy have been provided using an authority delegated to us by an insurer. Cyber Liability Advised Jan 2015

12 The duty of disclosure and fair presentation Please read this guidance note carefully, as any failure to comply with the duty of fair presentation and disclose material information to your insurer could adversely affect the validity of your insurance policy. If you have any questions, please do not hesitate to contact your usual Bluefin adviser. REMEMBER You are responsible for the accuracy and completeness of all the information you provide to us and to your insurer. Your Obligations If you are a business and your insurance policy is governed by English law, you must, at all times, act with utmost good faith towards your insurer. Before your policy is placed, at renewal, and when varying or extending the policy you have a duty under the Insurance Act 2015 to make a fair presentation of the risk and you must disclose to your insurer all information, facts, and circumstances which are, or ought to be, known to you and which are material to the risk. In addition, if your policy contains a particular clause stating that any change in circumstances must be advised to your insurer, you will also have to disclose certain information during the policy period. When providing information or completing a proposal form or otherwise confirming any information to your insurer, you should take care to ensure that the details provided are complete and accurate. Even where a proposal form is used, you should note that your duty to make a fair presentation is not confined to answering the specific questions listed in the form and/or asked by us or your insurer and that all material circumstances should be disclosed to your insurer, regardless of whether or not your insurer has asked for the information. The Insurance Act 2015 gives some guidance as to what a fair presentation of the risk means: You must disclose every material circumstance which is known by: i. your senior management (the Act defines senior management as those individuals who play significant roles in the making of decisions about how the insured s activities are to be managed or organised ); and ii. those individuals responsible for arranging your insurance (which includes risk managers and any employee who assists in the collection of data, or who negotiates the terms of the insurance, such as your individual brokers). 1 You ought to know what should reasonably have been revealed by a reasonable search of information available to you. This means you must conduct a reasonable search for, and disclose, material information that is available to you. It is important to note that this includes not only information held within your organisation 2 but also outside it, including information held by your agents, and also by persons and entities who are to be covered by the insurance. You must not make any misrepresentations to your insurer. You must provide the information to your insurer in a manner which would be reasonably clear and accessible to a prudent insurer. This is a new standalone, duty. What is Material? Under English law, every circumstance is material if it would influence the judgement of a prudent insurer in fixing the premium and/or the terms of the insurance and/or determining whether to accept the risk. This refers to any prudent insurer, not just the insurer who has been offered the risk. A circumstance may be material even if disclosure would not necessarily lead to an increased premium or declinature of the risk.

13 In the context of business insurance policies, insurers are likely to regard matters such as, but not limited to, the examples detailed on the following page of this document as material. If you are unsure whether a fact or circumstance should be disclosed, or whether the duty to disclosure information continues throughout the period of a particular policy, we recommend that you disclose the information anyway, as failure to do so may lead to your insurer reducing its claim payment, applying additional terms or even avoiding the policy. When to disclose Your duty to make a fair presentation applies throughout the negotiations preceding the placing of your policy until your insurer has agreed to accept the risk and has set the terms, price and level of participation, and the contract has been finalised. After the policy has been placed, your duty to make a fair presentation arises again: if you wish to make changes to the policy so that your insurer takes additional risk; or when there is an extension of the policy period; or when a policy condition requires you to advise your insurer of a specific increase or alteration in risk. Your duty to make a fair presentation and disclose material facts and circumstances also arises again during the renewal process. Failure to disclose The consequences of failing to comply with the duty of fair presentation and failing to disclose a material fact or circumstance will depend on the precise terms of your insurance policy. The Insurance Act 2015 sets out remedies that your insurer will have if you fail to comply with the duty of fair presentation. Your insurer s remedies will depend on whether or not your failure was deliberate or reckless: If you deliberately or recklessly fail to comply with your duties, your insurer will be able to avoid the policy, that is, to treat it as if it had never existed, and may retain the premium. If your failure to comply with your duties was not deliberate or reckless, your insurer s remedy will depend on what the insurer can show it would have done had you made a fair presentation of the risk : If your insurer would not have entered into the contract on any terms, it can still avoid the contract but must return the premium; i. If your insurer would have entered into the contract but on different terms (not relating to premium), the contract may be treated as if it included those terms from the outset; ii. If your insurer would have entered into the contract but would have charged a higher premium, the amount paid on a claim may be reduced proportionately. Please note that the proportionate remedies available to your insurers under the Insurance Act 2015 will also apply to alterations made to policies on or after 12 August 2016, even if the policy commenced before this date 3 1 If you are an individual taking out a business insurance policy, for example if you are a sole trader or a trustee, you must disclose the material information that you know and this is known by the individuals responsible for arranging your insurance. 2 If you are an individual taking out a business insurance policy, this means that it will not only be information that is known or held by you that may have to be disclosed. 3 Similar proportionate remedies are available to your insurer in the event of a breach of the duty of fair presentation in relation to a variation of your policy made on or after 12 August 2016, and will depend on whether the breach was deliberate or reckless and what the insurer can show it would have done had the duty not been breached. This may result in the insurer treating the policy as if the variation was never made, reducing your claim payment, applying additional terms, or even avoiding the entire policy.

14 Non-exhaustive illustrative examples of material information Circumstances which may be considered material are: Special or unusual facts relating to the risk. Any particular concerns which led you to seek insurance cover for the risk. Anything which would generally be understood as something that should be disclosed for the type of risk in question. By way of example: General information about your business Business activity (or change to business activity), including processes, products and geographical presence. New companies, markets, acquisitions, or disposals. Additional premises/insurable items Changes to premises Higher than ordinary degree of risk or liability (specific to your business or industry-specific). Business financial status. Loss history/experience, including paid and outstanding claims and potential claims / circumstances / incidents / losses that were not reported as claims (whether insured or not). Details of criminal charges and convictions of your organisation, its directors or employees; regulatory investigations or enforcement / health and safety investigations and prosecutions. Any insurers previous declinatures, refusals to renew, imposed terms / restrictions in cover, midterm cancellations, etc. Material damage policies Changes in construction and/or purpose. New/amended processes. Changes to fire protections. Increased storage of hazardous materials / attractive stock. Any attempted break-in or arson attack Use of temporary / third party premises. Liability policies Changes to business activities (including disclosing historic activities that have ceased). The creation or acquisition of new companies for which cover is required. Products export to, or work in, overseas territories (particularly the USA or Canada). Work in or on hazardous locations such as offshore installations. Health and safety investigations / prosecutions. Motor fleet policies Driving convictions. Corporate investigations / prosecutions. Undisclosed accidents. Changes to vehicle performance. Change of use of vehicle. Business personal accident and travel policies Changes to business activities. Material differences in the travel pattern (different geographies, number of journeys, etc.). REMEMBER this list provides examples only. If in doubt disclose.

15 Instructions and guidance Your operations in countries / regions / territories that are subject to sanctions You must notify us with the relevant details of all circumstances, including those which may arise during the period of your insurance cover, involving activity by your business or its group companies (including direct or indirect imports and exports, other forms of trading, services, travel and working abroad) in the following countries, regions, territories: Belarus, Crimea, Cuba, Democratic Republic of Congo, Iran, North Korea, Russia, Somalia, South Sudan, Sudan, Syria, Ukraine and Zimbabwe. Confidentiality and copyright To protect our intellectual rights we ask that you don t show this pack, or the advice within it, to anyone else or reproduce it for them. Key conditions Please take time to read your policy documents and make sure you understand the terms and conditions. If you breach the conditions of your policy any claim you make might not be paid or your cover might be withdrawn. Reasonable care Despite being insured, you still need to take the same care that you would if you weren t insured. And if something happens that could lead to a claim, you need to take reasonable steps to minimise any losses. Subjectivities Sometimes your insurer will need specific information from you or ask you to take particular action, and generally you will still be covered while doing what they ve asked. If this happens we will make sure you know what to do and by when, and what will happen if you don't. Warranties and conditions precedent Your policy will tell you clearly what you need to do to comply with 'warranties' and 'conditions precedent'. If you don't comply then a claim, or claims, may not be paid until the warranty or condition is complied with. Terrorism Most policies don't insure you against losses caused by terrorist activities. You can usually arrange separate cover for this, so please get in touch if you d like a quotation. Complaints Sometimes things may not go entirely to plan. Both Bluefin and the insurers we deal with welcome the opportunity to discuss any concerns that you may have about any aspect of the service you receive. Should you need to discuss a problem, please contact us in the first instance. Details of how to contact the insurer will be in the policy document. Law applicable You and the insurers are free to choose the laws applicable to a policy. As insurers are based in England, they propose to apply the laws of England and Wales and by purchasing a policy you will have agreed to this.

16 Terms of business agreement - commercial customers Bluefin Insurance Services Limited Authorised and regulated by the Financial Conduct Authority No: Registered Office: 1 Tower Place West, Tower Place, London, EC3R 5BU. Registered in England No: Data Protection Act Registration No: Z Please read this document carefully. It sets out the terms and conditions on which we agree to act for you, contains details of our responsibilities together with your responsibilities both to us, to insurers and to other third party providers. Please contact us immediately if there is anything in this document that you do not understand/or with which you disagree. Your receipt of this document constitutes your informed consent to its contents. By instructing us you are accepting this terms of business agreement. In the interests of security, staff training and to generally improve our service please be aware that telephone calls may be monitored and/or recorded. 1. Definitions 1.1. Commercial customer means a customer who is acting within their trade or profession in respect of the insurance cover requested or arranged You or your means you (and/or your appointed agent) We or us or our or Bluefin means Bluefin Insurance Services Limited Affiliate means, in relation to a company, its subsidiaries and subsidiary undertakings and any holding company it may have and all other subsidiaries and subsidiary undertakings of any such holding company (as such terms are defined in the Companies Act 2006). In addition to the foregoing, in reference to Bluefin the term Affiliate shall include Marsh Limited and its subsidiaries, the Marsh and McLennan group of companies and Jelf Group plc and all of its subsidiaries. As the term applies to you, "Affiliate" shall also include your partners, co-ventures and/or other co-insureds to whom we or any of our Affiliates may assume a responsibility as a consequence of the provision of the services or any additional services. 2. Who regulates us? 2.1. We are authorised and regulated by the Financial Conduct Authority (FCA) an independent body that regulates the UK financial services industry. Our details may be confirmed on the Financial Services Register or by phoning the FCA on Our service 3.1. We are committed to providing you with quality advice, service and insurance products. As an intermediary and your agent we owe various duties to you and will advise you as necessary if circumstances occur that may create a possible conflict of interest Our permitted business activities are advising, arranging (bringing about) deals, making arrangements with a view to transactions, dealing as agent, assisting in the administration and performance of a contract and agreeing to carry on a regulated activity in respect of General Insurance contracts as well as credit broking and exercising/having right to exercise lender's rights and duties under a regulated credit agreement We will advise you and will make a personal recommendation after we have assessed your insurance needs. This will include the type of cover you require together with the costs involved. We undertake to explain the main features of the products and services that we offer to you as well as the basis on which we have provided information and/or advice 3.4. Upon receipt of your instructions we will place, amend or renew insurance cover on your behalf with insurers. We will advise you of any inability to place your insurance You are not to rely on any insurance policy you have instructed us to place on cover until we have confirmed in writing to you that the insurer has agreed to such insurance cover being in place. Please note that you must comply with the terms and conditions of the insurance policy you purchase including any matters where the insurer makes cover subject to your compliance with conditions or with express or implied warranties. Failure to comply may entitle the insurer to cancel your insurance contract and/or risks a claim you make not being paid in part or in full. (Also see Clause 14. Claims) Please also note, unless your policy confirms otherwise, the rights under your policy may only be pursued in an English court. 4. Our remuneration and other income 4.1. We are usually remunerated by commission from your insurer(s) for our insurance broking services, or by way of a fee negotiated and agreed with you. If we receive both, this will be confirmed in writing to you at the time of incepting or renewing your insurance. In addition: Where we are remunerated by commission, we may also make individual charges up to 100 to cover the administration of your insurances e.g. arranging a new policy, mid-term adjustments, short period or mid-term cancellations, renewals, issue of replacement or duplicate documents. We may also make individual charges where we prepare and issue documents on behalf of insurers, these will be confirmed in writing to you at the time of incepting or renewing your insurance where applicable Some insurers may make additional payments to us reflecting the size and/or profitability of our account with them and/or in respect of work we undertake on their behalf. In addition we may also receive payment from other firms, such as premium finance providers, where non-insurance products or services are supplied to you Our remuneration in whatever form and in respect of any policy shall be due on the date of inception or renewal of that policy. We shall be entitled to retain all commission and/or agreed fees in respect of the full policy period including where you appoint another intermediary in our place during the currency of a policy or where a policy is cancelled after inception or renewal. (Also see Clause 13. Short period and cancelled policies) You are entitled, at any time, to request information regarding any commission which we may have received as a result of placing your insurance business or arranging your premium finance facility. Page 1 of 6 Bluefin-Marsh Commercial TOB Feb 2017

17 5. If domiciled in a country other than the UK 5.1. The law or regulations in your country of domicile may take precedence over any relevant UK legislation. Therefore references in this document to the FCA or Financial Ombudsman Service or Financial Services Compensation Scheme and any rights or benefits thereunder may not apply. If you wish to clarify your position in this respect then we will discuss this on request. 6. Duty of fair presentation 6.1 It is your duty to disclose to insurers, all information, facts and circumstances which are, or ought to be, known to you and which are material to the risk and to do so in a reasonably clear and accessible manner. This duty arises when you take out and renew insurance, and when you vary an existing policy. A material circumstance is one that a prudent underwriter would consider influential in determining whether or not to provide cover, if so on what terms and what price to charge for the cover. It is likely that any changes to facts previously advised will be material and such changes should therefore be notified. A fact should not be regarded as immaterial merely because it is not the subject of a question on a proposal form and your duty is not limited to answering the specific questions that insurers or we ask you. For example, an un-notified claim is likely to be a material fact to be disclosed. If in any doubt as to whether information is material, you should disclose it, as failure to do so could prejudice your right to recover in the event of a claim or allow underwriters to apply additional terms or even to avoid the policy from inception and treat it as if it had never existed. You should also ensure that all the information you provide to us is correct. Your attention is specifically drawn, and we ask you to read carefully, the separate The Duty of Disclosure and Fair Presentation document, which sets out in further detail your duty to disclose all material circumstances. If having read the above and that document you think we need any further information, or if you have any questions, please let us know. 6.2 All statements and material facts disclosed on proposal forms, statements of fact, claims forms and other documents should be full, true and accurate. Where forms are completed or partially completed on your behalf, you should check them for accuracy before signing. If you are in any doubt as to whether a fact is relevant, you should disclose it and then ask for guidance. 6.3 If there is more than one person involved in your business or employed by you, you should check with them, where appropriate, that the facts and statements that you make are complete and accurate. Examples of some people that should be included within your enquiries are: Senior management within your business (which is anyone who plays a significant role in making decisions about how your activities are to be managed or organised). Any person or entity for whom cover is provided by the contract of insurance. Anyone who is responsible for the procurement of your insurance. When considering the extent of your search you should take in to account the nature of the insurance you wish to purchase and consider who is best placed to provide relevant information. This could include information held both within your business and by any other person outside it. 7 Notification of changes, alterations and renewals 7.1 Amendments to policies may be arranged upon receipt of full details and on return of the certificate of insurance (if applicable). Cover is subject to acceptance by insurers and payment of any additional premium required inclusive of Insurance Premium Tax (IPT). 7.2 Renewals are invited on the basis that there have been no changes in the risk other than those specifically notified to us or your insurers. 8 Insurer security 8.1 We will only place cover with insurers who satisfy certain minimum criteria assessed by the rating agencies and/or our own assessment, or for whom you have given us specific approval to use. Whilst the information upon which we rely is obtained from sources considered to be reliable, and we use all reasonable endeavours to review that information in order to protect your interests, predictability of solvency cannot be, and is not, guaranteed by us. The financial standing of any insurer can, of course, change after the insurance contract had incepted. We do not guarantee the ongoing ability of any insurer to meet their contractual obligations. 9 Quotations 9.1 Quotations are valid until the date cover commences up to a maximum of 30 days, unless otherwise stated. Specimen policy wordings are available upon request. 10 Documentation 10.1 It is your responsibility to read all documentation upon receipt and raise any query regarding it otherwise you risk a loss you suffer not being paid in part or in full. Documentation including your policy and certificate, if applicable, will be issued to you upon receipt from insurers You must check all documentation issued to you to ensure the details are correct and the insurance cover provided meets your requirements. We will arrange insurance cover according to your instructions but only you can identify if it does not meet your intentions. If you have any concerns in respect of your insurance cover or are uncertain as to the meaning of any terms and conditions or if you discover errors in the documentation, then you must notify us immediately. 11 Payment of the premium 11.1 We must receive your payment, unless it is made by you directly to your insurer, by cheque, credit or debit card, electronic funds transfer or be in receipt of a completed premium instalment application form (with deposit where requested) drawn on a bank, building society or other UK financial institution account in the policyholder s name and before cover commences unless we agree otherwise. A charge may apply to payments made by credit card and this will be confirmed to you in writing at the time of incepting or renewing your insurance. If we agree to accept payment from someone other than the policyholder then this must be notified to us and agreed by us We have no obligation to fund any premium, taxes or fees (if applicable) on your behalf nor do we have any responsibility for any loss you may suffer as a result of cancellation of insurance cover or any other prejudicial steps taken as a result of late payment substantially attributable to you. If we decide to retain certain documents whilst awaiting payment, we shall provide details of your insurance cover and any information or documents required by law We shall be entitled (but not obliged) without providing notice to you to set off any amounts due to us from you, against any amounts which we may receive on your behalf (i.e. claims moneys, refunded premiums and other sums). Please be aware that full or partial nonpayment of a premium or default on a credit agreement may result in the cancellation or lapsing of your policy. Page 2 of 6 Bluefin-Marsh Commercial TOB Feb 2017