|
Purpose
|
Is your express consent required?
|
|
Quote and subscription to the insurance contract.
|
No, to the extent that the activities of processing are necessary to execute the insurance contract to which you are a party and to take the necessary steps to put the insurance in place prior to the conclusion of this contract.
|
Administration of the insurance contract (i.e. handling claims and complaints, investigating claims and seeking confirmations necessary to determine the existence of an insured event and the amount of compensation to be paid or the type of assistance to be provided etc. in relation thereto.
|
For ordinary personal data:
No. Processing is necessary to perform the insurance contract (Article 6(1)(b)) or is based on our Legitimate Interests in managing claims, and vulnerable customers (Article 6(1)(f)).
For special category data including health data:
No. Explicit consent is required where we rely on the DPA 2018 Schedule 1, paragraph 20 insurance condition — processing necessary for an insurance purpose (including administering a claim) in the public interest. This applies to the majority of health data processed in connection with claims.
Where we need to process your special category data to monitor the treatment of vulnerable customers or those with protected characteristics, we rely on DPA 2018 Schedule 1, paragraph 9 (equality of opportunity and treatment) or, where appropriate, the insurance condition. Explicit consent under Article 9(2)(a) is only sought for specific processing activities that fall outside the insurance condition and for which no other Schedule 1 condition is available.
|
To conduct quality surveys on the services provided, in order to assess customer satisfaction and improve it.
|
No. Our specific Legitimate Interest is to ensure that we have fulfilled our contractual obligations satisfactorily and to identify service improvements. We have assessed that this interest is proportionate and does not override your rights. You have the right to object at any time to this processing by contacting us as explained in section 12 below. On receipt of a valid objection, we will cease processing your data for this purpose.
|
|
To comply with any legal obligations (for example, those arising from laws that apply to insurance contracts and insurance activities, compliance with tax obligations, accounting laws and administrative obligations.
|
No. In these circumstances, the processing activities are expressly and legally permitted without the requirement for express consent.
|
|
For verifications purposes, to comply with legal and/or contractual obligations or internal procedures.
|
No. We may process your personal data as required to comply with both internal or external audit requirements that are required by law or external/internal procedures. We will not request your express consent for these purposes if the reason for processing is justified under the regulations in force or under our Legitimate Interest. However, we will ensure that only personal data that is strictly necessary will be used for this purpose and that the data will be held in strict confidentiality.
|
|
To analyse the data for the purposes of carrying out statistical and qualitative analysis based on the rate of compensation claims.
|
No. In these circumstance, we will only be processing anonymised personal data. Anonymized data is not considered to fall into the category of personal data and your express consent is therefore not required.
|
|
For debt collection management (i.e. to request payment of the premium or claims from third parties, allocating compensation between different insurance companies covering the same risk)
|
No, our specific Legitimate Interest is in recovering premiums owed, managing subrogation, and allocating compensation between co-insurers. Where this involves the processing of special category data (such as health data relevant to the disputed claim), we rely on Article 9(2)(f) of the UK GDPR (processing is necessary for the establishment, exercise or defence of legal claims), without requiring explicit consent. You may object to processing based on Legitimate Interests by contacting us as set out in section 12.
|
|
For the purposes of detecting and preventing fraud, compliance with anti-money laundering requirements and compliance with applicable civil and/or criminal regulations, including, economic sanctions and where applicable, the comparison of your information to that appearing on previous requests/claims with us or other organisations.
|
No. Our specific Legitimate Interest is to detect, prevent and investigate insurance fraud, money laundering, economic sanctions breaches and other unlawful acts, in order to protect our business, our customers and the wider insurance market. From February 2026, certain fraud prevention processing also qualifies as a Recognised Legitimate Interest under Article 6(1)(ea) of the UK GDPR as amended by the Data (Use and Access) Act 2025. You have the right to object to processing based on Legitimate Interests by contacting us as set out in section 11, although we may be able to demonstrate compelling legitimate grounds that override your objection where fraud prevention is concerned.
|
|
To transfer risk via reinsurance and co-insurance
|
We may process and share your personal data with other insurance or reinsurance companies with which we have signed, or will sign agreements of coinsurance or reinsurance. Coinsurance is where a risk is covered by several insurance companies by means of a single contract, each assuming each a percentage of the risk or in dividing the covers between them. Reinsurance is an insurance policy covering an insurer's exposure to a policy or class of policies that it has insured. However, this is an internal agreement between us and the reinsurer and you have no direct contractual link to it. These risk transfers occur under the Legitimate Interests of an insurance company which are generally authorised by law (including sharing personal data strictly necessary for this purpose).
|
|
Additional requirements for Call Recordings
Recording calls is a standard practice aimed at ensuring quality monitoring, providing training, and fulfilling legal and compliance obligations.
The recordings are encrypted and stored securely. Only authorised and trained personnel will use these recordings for the purposes outlined in this privacy notice.
|
For ordinary personal data captured in call recordings:
No. Our primary lawful bases are:
- Legal obligation (Article 6(1)(c)):
- Contract performance (Article 6(1)(b)): where a recording documents the terms of an insurance contract agreed on the call;
- Legitimate Interests (Article 6(1)(f)): for quality monitoring, staff training, fraud detection and demonstrating regulatory compliance.
For special category data (e.g. health information discussed during a travel or personal accident claim call):
No. Explicit consent is required. We rely on the DPA 2018 Schedule 1, paragraph 20 insurance conditions (substantial public interest, insurance purpose). You will be informed by automated message at the start of a call that it may be recorded and for what purposes. You have the right to object to processing based on legitimate interests by contacting us as set out in section 12.
However, in cases where we may need to:
- assist in the quality monitoring of staff performance, to investigate any concern you express about our dealings with you, and preventing or detecting fraud and/or abuses; or
- to cooperate with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws to the extent this requires the processing or disclosure of personal data to protect our rights or is necessary for our legitimate interest in protecting against misuse or abuse of our business, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes; or
- to demonstrate compliance with regulatory obligations,
we will not request your express consent for these purposes if the reason for processing is justified under the regulations in force or under our Legitimate Interest.
|
