Chubb Master Privacy Policy

Chubb is a group of companies, including the Combined Insurance and Chubb Life Europe brands. The Chubb group company which was originally responsible for collecting information about you will be principally responsible for looking after your personal data (your Data Controller). If you have an insurance policy with us, this will be the Chubb company named on that policy.

You can find out the identity of each company that is processing your personal data in the context of providing your insurance cover in the following ways:

Where you took out the insurance policy yourself: the Chubb company or / and, if purchased through a broker, the broker will have provided you with its name, address and contact details.

Where your employer or a third party took out the policy for your benefit: you should contact your employer who should provide you with details of the Chubb company.

Where your personal data has been passed to another Data Controller (e.g. a reinsurer): the first Data Controller will inform you of who they are other Data Controllers with whom they have shared your personal data who you can contact about their use of your personal data, as we do in Section 6 of this policy.

A description of the entities that make up the Chubb group is available here.

You should be aware that although one Chubb company may be principally responsible for looking after your personal data, information may be held in databases which can be accessed by other Chubb companies. When accessing your personal data, [all] Chubb companies will comply with the standards set out in this Policy.

Prospective Insureds and Insured Persons. In order to underwrite and administer insurance policies, we collect information about the prospective insured, policyholder and related parties. This may include background and contact information on the prospective insured, policyholder or their representative, and matters relevant to the assessment of risk and management of insurance policies. The prospective insured or policyholder may be an individual, company or their representative. The level and type of personal data we process varies depending on the type of policy that is applied for or held and may include information on other individuals who need to be considered as part of the policy. In some instances, it is necessary for us to collect and use Sensitive Personal Data, such as information about health or past criminal convictions. We are required to establish a legal exemption to use your Sensitive Personal Data - see Section 5 for further details.

If you are an insured person, from time to time you may need to provide us with the personal data of third parties, for example an injured third party in relation to a claim under a liability policy. Wherever possible, you should take steps to inform the third party that you need to disclose their details to us, identifying Chubb as your insurer. We will process their personal data in accordance with this Policy.

Claimants. If you are making a claim under a policy, we will collect your basic contact details, together with information about the nature of your claim and any previous claims. If you are an insured person we will need to check details of the policy you are insured under and your claims history. Depending on the nature of your claim, it may be necessary for us to collect and use Sensitive Personal Data, such as details of personal injury you may have suffered during an accident.

Business Partners and Visitors. If you are a business partner, we will collect your business contact details. We may also collect information about your professional expertise and experience. We may collect your contact details, if you visit our website, register for a newsletter or attend one of our events. If we collect personally identifiable information through our website, we will make it clear when we collect personal information and will explain what we intend to do with it.

For more information on what information we collect click here

Prospective Insureds and Insured Persons

• We will collect information from you directly when you apply for a policy.
• Information about you may also be provided to us by an insurance broker, your employer, family member or any other third person who may be applying for a policy which names or benefits you.
• We may collect information about you from other sources where we believe this is necessary to manage effective underwriting of the risk associated with a policy and/or helping fight financial crime. These other sources may include public registers and databases managed by credit reference agencies and other reputable organisations.

Claimants

• We will collect information from you when you notify us of a claim. You might make a claim to us directly or through your representative or through your broker or one of our representatives who manage claims on our behalf.
• We may also collect information about you if the claim is made by another person who has a close relationship with you or is otherwise linked to the claim - for example if the policyholder is your employer, or if you are the subject of a third party claim.
• We may also be provided with information by your solicitors (or acting on behalf of your employer).
• We may collect information from other sources where we believe this is necessary to assist in validating claims and/or fighting financial crime. This may include consulting public registers, social media and other online sources, credit reference agencies and other reputable organisations.

Business Partner and Visitors

• We will collect information about you if you or your company provides your contact or other information to us in the course of working with us, either directly as a business partner or as a representative of your company.
• We may also collect information about you if you attend meetings, events or conferences that we organise, contact us through our website or sign up to one of our newsletters or bulletin services.
• We may collect information from other public sources (e.g. your employer's website) where we believe this is necessary to help manage our relationships with our business partners.

Applicable to All

• If you telephone Chubb (for example, when notifying a claim or discussing that claim with us) or if Chubb telephones you (for example, to sell an insurance policy) we may  record the telephone call.  We may also use Interactive Voice Response ("IVR") technology to automate responses to voice commands, and to analyse call recording data.  We use call recordings as an evidence of your agreement to purchase an insurance policy or submit a claim,  to help train our staff and to provide an accurate record of the call in case of complaints or queries.  We may also analyse call recordings using automated technology in order to detect where there may be customer service failings (and then to resolve these), or to detect potential evidence of fraud.  

Prospective Insureds and Insured Persons. If you are a prospective insured or an insured person we will use your personal data to consider an application for an insurance policy, assess and evaluate risk, and subject to applicable terms and conditions, provide you with a policy. The underwriting process may include Profiling. If we have provided you with your policy we will use your personal data to administer your policy, deal with your queries, and manage the renewal process. We will also need to use your personal data for regulatory purposes associated with our legal and regulatory obligations as a provider of insurance.

Claimants. If you are a claimant we will use your personal data to assess the merits of your claim, and potentially to pay out a settlement. We may also need to use your personal data to evaluate the risk of potential fraud, a process which may involve Profiling, which uses automated processes. If you are also an insured person, we will use personal data related to your claim to inform the renewal process and potentially future policy applications.

Business Partners and Visitors. If you are a business partner we will use your personal data to manage our relationship with you, including sending you marketing materials (where we have appropriate permissions) and to invite you to events. Where relevant, we will use your personal data to deliver or request the delivery of services, and to manage and administer our contract with you or with your employer. If you are a visitor, we will use your personal data; typically, to register for certain areas of our website, enquire for further information, distribute requested reference materials, or invite you to one of our events.

Data analytics. We routinely analyse information in our various systems and databases to help improve the way we run our business, to provide a better service and to enhance the accuracy of our risk and other actuarial models. We take steps to protect privacy by aggregating and where appropriate anonymising data fields (particularly in relation to Policy Information and Claim Details, as defined in Appendix 1) before allowing information to be available for analysis.

We will make sure that we only use your personal data for the purposes set out in Section 4 and in Appendix 2 where we are satisfied that:

• you have provided your consent to us using the data in that way, or
• our use of your personal data is necessary to perform a contract or take steps to enter into a contract with you (e.g. to manage your insurance policy), or
• our use of your personal data is necessary to comply with a relevant legal or regulatory obligation that we have (eg. to comply with ACPR / CNIL requirements)
• Our use of your personal data is necessary to support 'legitimate interests' that we have as a business (for example, to improve our products, or to carry out analytics across our datasets), provided it is conducted at all times in a way that is proportionate, and that respects your privacy rights.

Before collecting and/or using any Sensitive Personal Data we will establish a lawful exemption which will allow us to use that information. This exemption will typically be:

• your explicit consent;
• the establishment, exercise or defence by us or third parties of legal claims; or
• an insurance specific exemption provided under local laws of EU Member States and other countries implementing the GDPR, such as in relation to the processing of health data of an insured person's family members or the sensitive personal data of individuals on a group policy.

PLEASE NOTE. If you provide your explicit consent to permit us to process your Sensitive Personal Data, you may withdraw your consent to such processing at any time. However, you should be aware that if you choose to do so we may be unable to continue to provide insurance services to you (and where you withdraw consent to an insurer’s or reinsurer’s use it may not be possible for the insurance cover to continue). This may mean that your policy needs to be cancelled. If you choose to withdraw your consent we will tell you more about the possible consequences, including the effects of cancellation, (which may include that you have difficulties finding cover elsewhere), as well as any fees associated with cancellation.

Please click here to find out more about the information we collect and use about you and why we believe it is appropriate to use that information for such activities.

We work with many third parties, to help manage our business and deliver services. These third parties may from time to time need to have access to your personal data.

For Prospective Insureds and Insured Persons these third parties may include:

• Brokers, Other Insurers / Re-insurersand Third Party Administrators who work with us to help manage the underwriting process and administer our policies
• Service Providers, who help manage our IT and back office systems
• our regulators, as well as other regulators and law enforcement agencies in the E.U. and around the world
• Credit reference agencies and organisations working to prevent fraud in financial services
• Solicitors and other professional services firms

For Claimants this may include:

• who work with us to help manage the claims process
• Loss Adjusters and Claims Experts who help us assess and manage claims
• Service Providers, who help manage our IT and back office systems
• Assistance Providers, who can help provide you with assistance in the event of a claim
• Solicitors, who may be legal representatives for you, us or a third party claimant
• Credit reference agencies and organisations working to prevent fraud in financial services

We may be under legal or regulatory obligations to share your personal data with courts, regulators, law enforcement or in certain cases other insurers. If we were to sell part of our businesses we would need to transfer your personal data to the purchaser of such businesses.

We may use your personal data to send you direct marketing communications about our insurance products or our related services. This may be in the form of email, post, SMS, telephone or targeted online advertisements.

In most cases our processing of your personal data for marketing purposes is based on our legitimate interests, although in some cases (such as where required by law) may be based on your consent. You have a right to prevent direct marketing of any form at any time - this can be exercised by following the opt-out links in electronic communications, or by contacting us using the details set out in Section 12.

We take steps to limit direct marketing to a reasonable and proportionate level, and to send you communications which we believe may be of interest or relevance to you, based on the information we have about you.

From time to time we may need to share your personal data with members of the Chubb group who may be based outside Europe (outside of the European Economic Area). We may also allow our Service Providers or Assistance Providers, who may be located outside Europe, access to your personal data. Exceptionally, we may also make other disclosures of your personal data overseas, for example if this is necessary to comply with a legal or regulatory request from a foreign law enforcement body.

We will always take steps to ensure that any international transfer of information is carefully managed to protect your rights and interests:

• We will generally only transfer your personal data to countries where the European Commission has decided through an adequacy decision that the third country provides an adequate level of data protection comparable to the EEA standard. Where, in absence of legal provisions, there is no consistently high level of data protection in the third country outside the EEA, we will ensure that the protection of your data is adequately guaranteed;
• For transfers within the Chubb group of companies will be covered by an intra-group agreement which gives specific contractual protections designed to ensure that your personal data receives an adequate and consistent level of protection wherever it is transferred within the Chubb group;
• Transfers to Service Providers and other third parties will always be protected by the use of Standard Contractual Clauses issued by the European Commission for the protection of personal data;
• Any requests for information we receive from law enforcement or regulators will be carefully checked before personal data is disclosed.

You have the right to ask us for more information about the safeguards we have put in place as mentioned above. Contact us as set out in Section 12 if you would like further information.

Automated Decision Making refers to a decision which is taken solely on the basis of automated processing of your personal data. This means processing using, for example, software code or an algorithm, which does not require human intervention.

As Profiling uses automated processing, it is sometimes connected with automated decision making. Not all profiling results in automated decision making, but it can do.

If you are a Prospective Insured and Insured Person, we may use automated decision making to carry out a credit check on you. In an underwriting context, profiling is routinely carried out on your Personal Risk Information (as defined in Appendix 1) to assess your individual risk (or the impact you might have on the cumulative risk of a group of Insured Persons) in order to calculate insurance premiums or to make a decision about whether to extend or renew cover. We may also apply Automated Decision Making to Telematics Data to make decisions about renewal quotes.

If you are a Claimant, we may use Automated Decision-Making to decide whether to accept or decline your claim. Not all claims are processed using automated decision making – more complex claims are passed to a claims handler for manual review.

We have introduced automated decision making as it helps us to process straightforward claims more quickly and accurately, creating a smoother claims journey for all parties. Our algorithms go through rigorous testing before being used as part of the claims process.

Where we use automated decision making, we rely on the following legal bases:

• For all non-sensitive personal data (e.g., name, address, email, phone number), processing is necessary for the performance of a contract (i.e., the insurance policy).
• For all special category personal data (e.g., health data that may be relevant as part of your claim):

            - where processing depends on your explicit consent under Member                        State law, we will ask you for this when you submit your claim;

alternatively, where explicit consent is not required, the legal basis that will apply is,

           - where processing is necessary for reasons of substantial public interest,               on the basis of Member State law that allows for the processing of health               data in the context of insurance claims.

Where we use automated decision making to make a significant decision about you (e.g., rejection of a claim) you can:

• contest the automated decision / ask for human intervention – if you do this, we will ask one of our claims handlers to review the automated decision and determine whether it is correct; or
• express your point of view on the automated decision.

If you are a Claimant, we may use Profiling or other forms of automated processing to assess the probability that your claim may be fraudulent or suspect in some way.

Where Sensitive Personal Data is relevant to the Profiling, such as medical history for life insurance or past motoring convictions for motor insurance, your Sensitive Personal Data may also be used in the models.

You have certain rights in respect of automated decision making, where that decision has significant effects on you, including where it produces a legal effect on you. See Sections 10 & 11 for more information about your rights.

We will retain your personal data for as long as is reasonably necessary for the purposes listed in Section 4 of this Policy. In some circumstances we may retain your personal data for longer periods of time, for instance where we are required to do so in accordance with legal, regulator, tax or accounting requirements.

In specific circumstances we may also retain your personal data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal data or dealings.

We maintain a data retention policy which we apply to records in our care. Where your personal data is no longer required we will ensure it is either securely deleted or stored in a way which means it will no longer be used by the business.

You have a number of rights in relation to your personal data.

You may request access to your data, correction of any mistakes in our files, erasure of records where no longer required, restriction on the processing of your data, objection to the processing of your data, data portability and various information in relation to any Automated Decision Making and Profiling or the basis for international transfers. You may also exercise a right to complain to your Supervisory Authority. More information about each of these rights can be found by clicking on the relevant link or by referring to the table set out further below.

To exercise your rights you may contact us as set out in Section 12. Please note the following if you do wish to exercise these rights:

The primary point of contact for all issues arising from this Policy, including requests to exercise data subject rights, is our Data Protection Officer.  The Data Protection Officer can be contacted in the following ways:

dataprotectionoffice.europe@chubb.com

Data Protection Officer,
Chubb, 100 Leadenhall Street,
EC3A 3BP, London

If you have a complaint or concern about how we use your personal data, please contact us in the first instance and we will attempt to resolve the issue as soon as possible. You also have a right to lodge a complaint with your national data protection supervisory authority at any time.

Updated November 2022