Privacy Notice

WHO WE ARE

Generation Underwriting Management Limited are committed to safeguarding the privacy of our customers. We gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection Regulation and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data. Generation Underwriting Management Limited is a wholly owned subsidiary of Arden UW Limited, which is a wholly owned subsidiary of WFRisk Group Limited. WF  Risk Group Limited is a wholly owned subsidiary of WF Risk Group (Holdings) Ltd.

Generation Underwriting Management Limited’s registered office is at Office 032, The Grainger Suite, Eldon House, Regent Centre, Newcastle Upon Tyne NE3 3PF and we are a company registered in England. We are registered on the Information Commissioner’s Office Register; registration number Z1982497, and act as the data controller when processing your data. If you have any query, please contact Richard Small, Director – Underwriting, at rsmall@generationunderwriting.com. We process your Personal Data in accordance with this Privacy Notice, which is also available on www.generationunderwriting.com.

What DATA DO WE COLLECT AND WHERE DO WE GET IT FROM?

For the purposes set out in this notice, the Information Commissioner (ICO) requires us to advise you that, information, including personal information detailed below relating to you or anyone else to be covered by an insurance policy (“Personal Data and Special Categories of Data”) will be collected and processed by us and/or on our behalf by our third-party service providers:

Personal Data….
This is information we may gather from you that will directly or indirectly identify you as an individual and may also provide information about your cultural or social identity. This type of data must be processed strictly in accordance with identified bases of law stated which we have outlined in the table below. This data will include but may not be limited to:

Your title, name, postal address, risk address, civil status, gender, current and or previous occupation, date of birth, contact details, registration number, mental health conditions, bank details, credit / debit card details, credit searches, National Insurance Number, next of kin information, children’s data where the child is under 16.

Special Categories of Data….
This is information we may gather from you that might reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, your health, sex life or sexual orientation. This data will be processed strictly in accordance with identified bases of law stated in the table below. This data will include but may not be limited to:

Your title, gender, race, ethnic origin, political opinions, religious beliefs, physical or medical health conditions, driving licence origin, UK residency period, children’s data where the child is under 16, criminal history. Data for criminal convictions and offences will only be collected as permitted by UK Law.

This data will be provided by:

• You; or your insurance intermediary;
• Your family members, employer or representative
• Other insurance market participants
• Credit reference agencies
• Anti-fraud databases, sanctions lists, court judgements and other databases
• Government agencies such as the DVLA and HMRC
• Open electoral register; or
• In the event of a claim, third parties including the other party to the claim (claimant/defendant), witnesses, experts (including medical experts), loss adjusters, solicitors and claims handlers
• For risk management services this may also be provided as above, and by your employees, subsidiaries, agencies, third parties, health & safety executive, insurers, insurance providers, loss adjusters, engineers, and experts as deemed appropriate and from paperwork, forms and documents pertaining to you.

Which of the sources apply will depend on your circumstances.

You will either be completing application forms or answering questions your insurance intermediary, or agent, uses to collect the information we require. We will also ask for specific, or more detailed, information from time to time. We may also obtain information from other sources that you provide us with, for example, your driving licence, or other official documentation required in order to administer the policy(ies) of insurance. We may also obtain information which is readily available in the public domain such as the Internet of Things (IoT), Social Media, Press etc.

Each time you visit our website, we may automatically collect personal data and technical information including IP addresses.

HOW AND WHY DO WE PROCESS YOUR PERSONAL DATA?

We will limit the collection and processing of information to information necessary to achieve one or more legitimate purposes as identified in this notice.
Our legal basis for processing your data
In order to arrange and administer your insurance, we will be using one or more of the following legal bases:

• Processing is necessary in order for us to take steps, at your request, to enter into a contract of insurance when you, or your insurance intermediary, or agent, ask us to provide a quotation, place cover, and for the performance of that contract and when you need to make a claim.
• Processing is necessary for us to comply with any legal or regulatory
• Where we believe a customer is vulnerable, processing might be necessary to protect the vital interests of that person or other person covered by the
• Where you, or your insurance intermediary, or agent request details of the services we provide, you, or your insurance intermediary, or agent have received a quotation, or we arrange and administer insurance or ancillary services on your behalf we will have a legitimate interest to provide you with further information about our services and those of our associated companies. We may have a legitimate interest in processing the data for changes to any quotation or policy which you, or your insurance intermediary, or agent may request, or for any other reason necessary to undertake any other requests related to your insurance

In respect of children’s data, a child being a person under the age of 16, which is only collected for the purposes of reporting an accident, injury, circumstance, or claim we will seek parental consent to hold the data and record that consent.

Why we collect your data
We obtain, collect and process your personal data and special categories of data (which includes sharing your data with others) to enable us to provide the following:

• Quotation/inception
  • Setting you up as a client, including possible fraud, sanctions, credit and anti-money laundering checks, and to provide you with details of other services we provide which may be of interest to you.
  • Evaluating the risks to be covered and matching to appropriate policy/premium
  • Payment of premium where the Insured/Policyholder is an individual
• Policy Administration
  • Client care, including communicating with you, or your insurance intermediary, or agent and sending you, or your insurance intermediary, or agent updates
  • Payments to and from individuals
• Claims Processing
  • Managing insurance and reinsurance claims
  • Defending or prosecuting legal claims
  • Investigation or prosecuting fraud
• Renewals/Reviews
  • Contacting the Insured/Policyholder, or your insurance intermediary, or agent to renew the insurance policy
  • Evaluating the risks to be covered and matching to appropriate policy/premium
  • Payment of premium where the Insured/Policyholder is an individual
• Other purposes outside of the insurance lifecycle but necessary for the provision of insurance throughout the lifecycle period
  • Complying with our legal or regulatory obligations
  • General risk modelling

Transferring books of business, company sales and reorganisations

Please note that in addition to the disclosures we have identified against each purpose, we may also disclose personal data for those purposes to Underwriters, Claims Management Companies, our service providers, contractors, agents and group companies that perform activities on our behalf.

If you, or your insurance intermediary, or agent do not provide the requested data it may not be possible to obtain a quote or provide you with a policy.

Who we share your data with and the reason for processing
We are a Data Controller, and in order to process your requests we may be sharing your data with one or various third parties. The parties we may share with and our reasons for sharing that information are listed but not limited to the following:

• Insurers, Reinsurers, Insurance providers, Delegated Authority Schemes, for General Insurance in order to provide you with quotations, cover, policy administration, to arrange and progress claims, and renewals and carry out
• Loss adjusters/assessors, surveyors, solicitors, private investigators, surveillance companies, possible suppliers for repair/replacement facilities including Third Parties’ representatives, i.e. their insurers or solicitors to assist in the event of a
• In the event of non-payment to debt agencies, courts and/or
• State, statutory and/or government departments, bodies or agencies such as regulators eg (FCA, PRA, ICO), Ombudsman eg.(FOS), crime agencies, Insurance Fraud Bureau, police, sanctions checking, Health & Safety Executive (HSE), Claims Underwriting Exchange (CUE), Motor Insurers Bureau (MIB), Motor Insures Database (MID), Employers Liability Tracing Office (ELTO), Financial Services & Compensation Scheme (FSCS), DVLA, Mylicence etc for the avoidance and detection of crime and/or fraud, to meet our regulatory and legal obligations and/or where we are required to by We will also interact with these parties to assist with your contract performance and your claim.
• Our Staff, sub-contractors acting on our behalf, our group/associated companies’ offices, internal and external auditors, financial institutions, such as our bank, interested parties (such as your property mortgage provider), Interpreters, call recording and monitoring, to assist with staff training, quality and monitoring, complaints, accounting controls and banking, customer service and/or in the event one of our sites temporarily goes We will also use this to exercise legitimate interest regarding our services.
• Telecommunications, IT providers, software, hardware, cloud and system and technical management providers to detect, secure, test and back up our systems, to safely process and hold all data, and collective management
• We may also use your data in an anonymised form as part of statistics or other aggregated data shared with third parties.
• Our own insurers, insurance providers, and solicitors, where we need to provide information about you and/or defending ourselves in a legal dispute or as required by law, or where a circumstance exists that a future claim may occur

Other third parties not detailed above, to be shared only for the purposes stated, or in a way you would reasonably expect us to, unless we inform you otherwise.

HOW LONG WE RETAIN YOUR DATA?

General Insurance
We will retain your Personal Data for as long as your insurance policy/contract is valid with us and for 10 years thereafter. In particular, for so long as there is any possibility that either you or we may wish to bring a legal claim under this insurance, or where we are required to keep your personal data due to legal or regulatory reasons.

IMPORTANT

• For some of our products eg: motor insurance, we may carry out automated decision making (including profiling) to process your personal data in order for insurers to underwrite and price your insurance online and/or process your We take care to ensure our profiling is fair, transparent and limited in purpose.
• We have stated the reasons we are collecting your data above, but in the event that you do not wish to provide us with your personal data for all or any of the above reasons, this may limit our ability to quote and agree to cover, and we not wish to offer cover at

If at any point in the future we need to amend this policy, every effort will be made to make you aware and our website will always have the latest version.

WHERE DO WE HOLD YOUR DATA?

At all times we will endeavour to hold your Data on servers within the UK. Where we share your information with other Data Controllers, they must also agree to hold your Data within the UK. Where another Data Controller advises their data is not held in the UK, we will make enquiries to ascertain where the data is held, and that equivalent organisational systems and controls exist, to protect your data. In the event your data is to be held in any other geographical area we endeavour to ensure that:

• Data Controllers do not do so without our prior written authority and
• An appropriate transfer agreement is put in place to protect your personal data

YOUR ACKNOWLEDGEMENT OF THIS NOTICE AND YOUR RIGHTS

Under General Data Protection Regulation, you have rights and these are listed below.

Right to Be Informed
The General Data Protection Regulation sets out the information we must provide to you about your Data. All of the information we are required to give you is contained within this Privacy Notice. If you do not understand any part of this, you, or your insurance intermediary, or agent should contact us immediately and we will be happy to explain it to you, or your insurance intermediary, or agent.

Right of Access
You have the right to access and obtain a copy of the personal data, and any supplementary information that we hold about you to enable you to verify the lawfulness of the processing carried out. This will be provided free of charge, unless your request is unfounded, excessive or repetitive, and the information will be sent to you within 30 days of your request being received. If we refuse your request, you have the right to complain to the ICO.

Right to Rectification
You have the right to request that we correct any inaccuracies in the personal data we hold about you. This will be corrected within one month. If we are unable to correct the inaccuracy you have the right to complain to the ICO.

Right to Erasure
You have the right to request that we erase your personal data. For example, you may exercise this right in the following circumstances:

• your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by us;
• you withdraw consent and no other legal ground permits the processing;
• you object to the processing and there are no overriding legitimate interests for the processing;
• your personal data was unlawfully processed; or
• your personal data must be erased for compliance with a legal

We refuse the right to delete your information when it falls within our data retention period stated above, as this data may be required to exercise or defend litigation in the event of a claim whether covered or not by the insurance policy. If you do not agree with this, you have the right to complain to the ICO.

Right to Restrict Processing
You have the right to restrict our processing of your personal data where any of the following circumstances apply, although we will still be allowed to store it:

• where you feel that the personal data which we hold about you is not accurate. Processing will be restricted until you verify the accuracy of the information
• where the processing is unlawful, and you do not want your personal data to be erased and request the restriction of its use instead;
• where we no longer need to process your personal data, but the data may be required to establish, exercise or defend a legal claim
• where you have objected to our processing of your personal data pending the verification of whether, or not, our legitimate business interests override your interests, rights and

Where you exercise your right to restrict our processing of your personal data, we will only continue to process it in accordance with the requirements of this policy or our legal obligations.

Right to Data Portability
You have a right to receive and transfer the personal data that we hold about you. This only applies to:

• personal data you, or your insurance intermediary, or agent have provided to us
• where the data was processed by you giving us your individual consent or for the performance of a contract
• and where processing was carried out by automated

Where you make such a request, this will be provided in a structured, commonly used, machine readable format such as a CSV file, or an agreeable format. This will be completed within one month of us receiving your request.

Right to Object to Processing
In certain circumstances, you have a right to object to our processing of your personal data

• Where we have processed it as a legitimate interest (including profiling)
• Direct Marketing (including profiling)
• Processing for scientific / historical research and statistics

We will still be able to process your personal data where

• We can demonstrate compelling legitimate grounds for us to process your Personal Data which override your interests, rights and freedoms

The processing is for establishment, exercise and defence of legal claims.

Right to Object to automated decision making including profiling
You have a right not to be subjected to decisions being made solely by automated means without any human involvement. This might be the case where quotations are obtained online. We will still be able to carry out this type of decision-making where:

• It is necessary to enter into or for the performance of a contract (such as a contract of insurance) which is the main reason we would use this type of decision-making; or
• You have given your explicit consent for us to do

We will only process data in the way you would expect it to be used, and you will be entitled to have a person from our firm to review the decision so that you can query it and set out your point of view and circumstances to us.

Right to Withdraw Consent
Where the legal basis of consent has been used (and in our business we only use this for parental consent when collecting children’s data), you have the right to withdraw that consent at any time. Where you exercise your right to withdraw parental consent of the processing of any children’s data, any data processed prior to the withdrawal of consent will remain valid. Withdrawing this consent may mean we will be unable to provide you with a quotation, or a contract of insurance, or assist you in the event of a claim.

If you would like to exercise any of your rights detailed above, please contact Richard Small, Director – Underwriting, by email rsmall@generationunderwriting.com.

You may raise any concerns about Generation Underwriting Management Limited’s processing of your Personal Data with the Information Commissioner Office on https://ico.org.uk/.

CHANGES TO THIS NOTICE

We may amend this notice on occasion, in whole or part, at our sole discretion. Any changes to this notice will be effective immediately and will be posted on our website www.generationunderwriting.com. If at any time we decide to use your personal data in a manner significantly different from that stated in this notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail or post and you will have a choice as to whether or not we use your information in the new manner. If you have questions or concerns about this notice, please contact Richard Small, Director – Underwriting, by email rsmall@generationunderwriting.com

INFORMATION ABOUT OR PROVIDED BY ANOTHER PERSON

Where your information for your policy has been provided to us by another person, we will make available a copy of this privacy notice to the person arranging the insurance. Where you have taken out a policy and provided us with information about another person, eg: an additional driver to your motor policy, you must provide them with a copy of this Privacy Notice so that they will know how their data is being used. Additional copies can be supplied on request and are available at www.generationunderwriting.com.