Customer Privacy Notice

C. PROCESSED DATA

In order to perform our duties, we process your personal data. This includes information that allows us to identify you personally, such as your name, telephone number, address, or email address. Statistical data that cannot be linked to you personally does not fall under the definition of personal data.

As a broker, we need to process certain information about you:

First, we need your Contact details:

• Name, address, date of birth, age
• Telephone number, e-mail address
• Bank details

You will provide us with this information when you register.

We also process the following personal data:

• Gender
• Marital status
• Profession, status (FT, PT), address of employer and salary
• Special categories of data (e.g. health data)
• Smoking status
• Current insurance situation
• Family situation (partner, children)
• Living situation (current and planned)
• Hobbies and interests
• Pets
• Other personal/financial circumstances, care requirements

You will provide us with this information as part of our needs, requirements and identification check.

In addition, we process your Insurance details:

• Application data (data you provide when applying for insurance)
• Contract data for a specific contract (such as insurance policy number, insured amount, term, premium, risk, investment amounts, loan amounts)
• Benefit data (insurance claims, data at the time of occurrence of the claim or benefit event)

This data you share with us in the course of taking over or managing a brokerage mandate. If we take over an existing brokerage mandate, we will receive the data with your consent also from the insurers.

We also collect your Usage data:

• Interactions on the website and app or with emails (clicks, etc.)
• Visits to the websites and apps (which ones were accessed?)
• Time spent on websites and apps (how long did you view a page)
• Source page (ref URL)
• Time and date, e.g. of accessing our website or emails

We collect this data when you use our website and app.

Finally, we collect the following of your Device, browser and location data:

• Operating system of your device (e.g. Windows, Android or iOS)
• Model of your device (e.g. iPhone, Samsung Galaxy)
• Settings of your device, e.g. screen resolution
• Browser settings e.g. language setting, time zone, installed plugins and fonts IP addresses
• Your location (we do not use GPS data, but only the information derived from the IP address).

We collect this data when you use our website and app.

D. DATA PROCESSING BASED ON YOUR CONSENT

We require your consent if we process special categories of personal data as defined in Art. 9 UK GDPR. This includes, for example, information about your health status. We need this information if we advise you on insurance products, particularly when processing claims for health and liability insurance.

Therefore, we ask for your consent if you decide to purchase a corresponding product. You can revoke your consent at any time in the future by sending a message to yourdata@tom.co.uk.

We may also require your consent to send you marketing and/or advertising information.

This consent is voluntary. You can use our services without it. Furthermore, you can revoke your consent at any time. This will not affect the legality of the processing up to the time of revocation.

E. DATA PROCESSING FOR CONTRACT EXECUTION

In this section, we will inform you about the processing of your data in connection with the initiation and/or processing of an insurance contract with us. You will learn which data categories we process for which purposes, the legal basis under the General Data Protection Regulation (“GDPR”) on which we base this, and to whom we share your data, e.g., service providers who provide us with technical support, or broker pools and insurers. Finally, you will also learn how long we retain your data andwhatThis period is determined by the terms of use. We will also inform you there about the data processing used to send our newsletter and other marketing communications.

General information about our cooperation partners and data transfer

In connection with the purposes set out above, we will sometimes share Personal data with companies within the CLARK Group and third parties, including:

• Insurance brokers, financial advisers and business partners who help us arrange, manage and underwrite our products and who provide insurance services;
• Other insurers (either directly or via those acting for the insurer);
• Our insurers or reinsurers (either directly or through insurance brokers), who provide reinsurance services to us and each other in respect of risks underwritten by the Company, or insurers who cover the Company under our group insurance policies. We can supply on request further details of the insurers and reinsurers we provide your Personal Information to and how this may be used. If you require further details, please contact us;
• Third parties who provide you with certain services including assistance providers;
• Third party in relation to the relevant insurance policy or claim e.g. experts and in limited circumstances, private investigators;
• Legal advisers, accountants, auditors, financial institutions and professional service firms who act on our or your behalf;
• Data analysts and providers of data services who support us with developing our products and prices and measuring the effectiveness of marketing;
• Third parties that help us maintain the accuracy of our data e.g. identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details;
• Financial crime detection agencies, sanctions checking providers and third parties who maintain fraud detection databases or provide assistance with investigation in cases of suspected fraud;
• Regulators who regulate how we operate, including the FCA, PRA, FOS, HMRC, ICO and the Advertising Standards Agency;
• Government agencies and regulatory bodies including the police, courts and DWP;
• Debt advisors where breathing space is requested on outstanding debts;
• Insurance industry bodies, including the Association of British Insurers;
• Service providers, including those who help operate our IT and back office systems, underwriting and claims processes and our information security controls;
• Third party payment service providers, who process card and other payments for us.
• Medical professionals, if we need to access health records or assessments for the purposes of arranging and underwriting certain products or facilitating and handling claims;
• Clinicians, including hospitals and third party case managers from whom you and others covered under the policy receive insured treatment or who manage your care or treatment pathway;
• Research agencies and providers of market research services, including customer feedback surveys; – Providers of marketing and advertising services, including delivering and administering marketing, ensuring you receive marketing content that’s relevant to you and in accordance with your preferences and analysing marketing campaigns. These may include media agencies, fulfilment partners, social media and other online platforms and advertising technology companies.
• Third parties in connection with any sale, transfer or disposal of our business.

The information you will be asked for will include details about your medical history, which is essential to enable a broker to provide you with an accurate life insurance quote. TOM.co.uk and any trusted third parties who wish to provide a quote to you will then need to process the personal data provided by you for administration purposes, to enable quotes to be provided to you and, if you decide to proceed with the purchase of a policy, as reasonably required to provide life insurance to you.

F. USES OF PERSONAL DATA

The main purposes for which we use Personal data are to:

• Communicate with you and other individuals;
• Make assessments and take decisions, including whether to provide you with our products and services
• Provide our products and services, including insurance administration, taking payment, making changes where requested or necessary, claims assessment, settlement and dispute resolution and the provision of our apps and other technologies e.g. Polly, TOM apps
• Manage relationships with third parties, e.g. advisers and service providers;
• Prevent, detect and investigate fraud and other crime, including by carrying out fraud, sanctions and anti-money laundering checks.
• Improve our products and services, provide staff training and maintain information security, including by recording and monitoring telephone and online calls and screen sharing sessions;
• Provide marketing information and run promotions in accordance with preferences you have expressed.
• Help us better understand our customers and improve our customer engagement, including noting your interest in our website, understanding your customer journey, and use of profiled data (which is not actual information about you but predictions about you, e.g. assumptions about your interests based on the preferred leisure pursuits of households in your area). This allows us to make correlations about our customers to improve and promote our products and to suggest other products, services and information which may be relevant or of interest to customers;
• Carry out data analysis, including to ensure data accuracy and quality and for insurance risk modelling and product and pricing refinement.
• Manage complaints, including to allow us to respond to any current complaints, or challenges you or others might raise later, for internal training and monitoring purposes and to help us to improve our complaints handling processes. We may be obliged to forward details about your complaints, including your Personal data to the appropriate authorities, e.g. Financial Ombudsman Service
• Manage feedback and queries, and handle requests to exercise data subject rights.
• Manage our business operations, including by carrying out internal audits, quality assurance and training, financial analysis and accounting, producing management information and performing administrative activities in connection with the services we provide;
• Manage commercial risk, including by taking out and maintaining appropriate insurance and reinsurance;
• Comply with applicable legal, regulatory and professional obligations, including cooperating with regulatory bodies e.g. the FCA, PRA, ICO and government authorities, to comply with law enforcement and to manage legal claims;
• Identify and support customers requiring additional support, to help us better meet your needs and to comply with regulatory guidance about how we meet your needs. Sometimes you or a third party may tell us that you have additional support requirements, and in other cases we may infer this from your Personal Information and our interactions with you;
• Establish, enforce and defend our legal rights or those of third parties, including enforcing our terms and conditions, pursuing available remedies and limiting our damages;
• Carry out activities that are in the public interest, e.g. we may need to use Personal data to carry out anti-money laundering checks;
• Buy, sell, transfer or dispose of any part of our business;
• Archiving, scientific or historical research or statistical purposes.

G. LAWFUL BASIS FOR USES OF PERSONAL INFORMATION

We are committed to collecting and using Personal data in accordance with applicable data protection laws. By law, we must have a legal justification, known as a lawful basis, in order to use your Personal Information for the purposes described in this Privacy Policy. Depending upon the purpose, our lawful basis will be one of the following:

• Performance of a contract – to arrange, underwrite or manage our products, or handle claims in accordance with their terms;
• Compliance with a legal obligation – to meet responsibilities we have to our regulators, tax officials, law enforcement, or other legal responsibilities;
• Legitimate interests – to operate and improve our products and services and keep people informed about our products and services or for any other purposes we identify as appropriate to our business needs, or those business needs of a third party;
• Consent – where we have obtained appropriate consents to collect or use your Personal Information for a particular purpose.
• Where we rely on legitimate interests as our lawful basis, we are required to carry out a balancing test to ensure that our interests, or those of a third party, do not override the rights and freedoms that you have as an individual. The outcome of this balancing test will determine whether we can use your Personal Information for the purposes described in this Privacy Policy. Where we rely on the lawful basis of legitimate interests, the interests being relied upon will usually be:
  • To further our business and commercial activities and objectives, or those of a third party, e.g., to provide our products and services and produce management information on our performance and the performance of third parties;
  • To help us better understand our customers and improve our customer engagement and marketing campaigns including by carrying out analysis and profiling, e.g. by making certain predictions and assumptions about your interests;
  • To send you marketing information in accordance with your preferences, e.g. about other products and services we offer, and to administer promotions that you enter;
  • To provide you with helpful information relating to your products and about useful tools for managing and engaging with your products, e.g. the Polly, TOM apps. These are not marketing communications;
  • To comply with our legal and regulatory obligations, guidelines, standards and codes of conduct, e.g., background checks or the prevention, detection and investigation of financial crime or fraud;
  • To improve and develop our business, products and services, or those of a third party, e.g. to ensure the accuracy of customer data and to develop our pricing and risk methods and models;
  • To retain your policy record for a period of time in order to ensure we have appropriate records in place in respect of any future claims that may be insured by us;
  • To safeguard our business, shareholders, employees and customers, or a third party, e.g., maintaining the security of our IT network and information, enforcing claims, including debt collection;
  • To facilitate the purchase, sale, transfer or disposal of any part of our business; and
  • To analyse and assess competition in the market for our products services, e.g., by carrying out market research.

H. DURATION OF DATA STORAGE IN GENERAL

Information on the storage of information when using the CLARK website/app

How long we store the data we collect varies and depends on what data it is and for what purpose we use it.

Some data you can delete yourself. Some data is automatically deleted after a certain period of time or anonymised. In some cases, your data will only be deleted when your account is deleted or your contract with us ends.

We keep records, which may include your personal data – to meet legal, regulatory, tax or accounting needs. For example, we are required to retain an accurate record of your dealings with us, so we can respond to any complaints or challenges you or others might raise later. We’ll also retain files if we reasonably believe there is a prospect of litigation. The specific retention period for your Personal Information will depend on your relationship with us and the reasons we hold your Personal Information and we have carefully considered different retention periods that apply to each data category.

Our third parties are also subject to these regulations but we recommend that you check their privacy policies separately. This is to ensure that you do not inadvertently agree to authorise the use of your personal data in a manner you would not wish to have done, as your arrangements with these third parties are separate from your arrangements with us.

To support us in managing how long we hold your data and our record management, we maintain a data retention policy which includes clear guidelines on data retention and deletion.

If you would like more information about our data retention policy, please contact us.