Privacy policy

Hiscox is committed to protecting your privacy. This Privacy Notice (this 'notice') sets out details of the information that we may collect from you and how we may use that information. It will also inform you about your privacy rights and how the law protects these rights. Please take your time to read this notice carefully. When using a Hiscox website, this notice should be read alongside the website terms and conditions as well as our Cookie Policy.

Hiscox is an international insurance business. We offer insurance to individuals, companies and other insurers. We do this both by providing insurance ourselves and by placing insurance with other insurers. We also offer insurance to other insurers (known as "reinsurance"). For the purposes of this notice, references to insurance also mean reinsurance.

In order for us to provide you with a quote and then insurance, and deal with any claims or complaints that might arise, we need to collect and process personal information about you. This makes the relevant Hiscox company a "data controller".

In this notice we use "we" or "us" or "Hiscox" are to:

Hiscox Syndicates Limited, company number 02590623, registered address: Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

Hiscox Underwriting Services Limited, company number 03294530, registered address: Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

Hiscox Underwriting Ltd, company number 02372789, registered address: Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

Hiscox Insurance Company Limited, company number 00070234, registered address: Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

Hiscox Underwriting Group Services Limited, company number 04137419, registered address: Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

The specific company acting as a data controller of your personal information will be listed in the documentation we provide to you. If you are unsure you can also contact us at any time by e-mailing us at [email protected] or writing to us at Data Protection Officer, Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

Insurance involves the use and disclosure of your personal data by various insurance market participants such as intermediaries, insurers and reinsurers. The London Insurance Market Core Uses Information Notice https://www.lmalloyds.com/GDPR (external link) sets out those core necessary personal data uses and disclosures. Our core uses and disclosures are consistent with the London Market Core Uses Information Notice. We recommend you review this notice.

We work in partnership with the Motor Insurers’ Bureau (MIB) and associated not-for-profit companies who provide several services on behalf of the insurance industry. At every stage of your insurance journey, the MIB will be processing your personal information and more details about this can be found via their website: mib.org.uk. 

Set out below are brief details of the sorts of activity the MIB undertake: 

  • Checking your driving licence number against the DVLA driver database to obtain driving licence data (including driving conviction data) to help calculate your insurance quote and prevent fraud.

  • Checking your ‘No Claims Bonus’ entitlement and claims history.

  • Prevent, detect and investigate fraud and other crime, including, by carrying out fraud checks.

  • Maintaining databases of:

    - Insured vehicles (Motor Insurance & Policy Data or Motor Insurance Database)
    - Vehicles which are stolen or not legally permitted on the road (Vehicle Salvage & Theft Data or MIAFTR).
    - Motor, personal injury and home claims (CUE).
    - Employers’ Liability Insurance Policies (Employers’ Liability Database).
    - Managing insurance claims relating to untraced and uninsured drivers in the UK and abroad.
    - Working with law enforcement to prevent uninsured vehicles being used on the roads.
     

  • Supporting insurance claims processes.

Personal information is any information about you from which you can be identified. The personal information that we collect will depend on your relationship with us. We will collect different personal information depending on whether you are a Hiscox policyholder, a beneficiary under a Hiscox insurance policy, a claimant, a witness, a broker or another third party.

In certain circumstances, we will request or receive your “sensitive personal information” (which is information relating to your health, genetic or biometric data, criminal convictions, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership). For example, we may need access to information about your health in order to provide you with a quote, provide your insurance policy, or process any claims you make. 

If you provide personal information to us about other individuals, for example, members of your family, you agree that you will inform them about the contents of this notice and obtain any required consent in accordance with this notice.

We will obtain your personal information through lawful and transparent means, with your explicit consent where required. We will also only collect and process your personal information for specific stated purposes.  

Please see the relevant section below for detailed information about the types of personal information we are likely to collect and use about you in different circumstances.

Policyholder or beneficiary (or prospective policyholders or beneficiaries) under an insurance policy

This section will apply if you apply for or take out an insurance policy with us directly (e.g. a household policy) or if you are listed as an applicant or beneficiary under a policy that someone else applies for or has with us (e.g. a named driver on a motor policy). Where the provision of information is legally or contractually required, we will tell you this at the time of collection.

What personal information will we collect?

General information such as your name, address, contact details, date of birth, nationality, gender and relationship to the policyholder (where you are not the policyholder).

Identification information such as national insurance number, passport number, tax identifiers or driving licence number.

Information about your job including job title, your status as a director or partner, employment history, education history and professional accreditations.

Information which is relevant to your insurance policy including details of previous insurance policies and claims history. This will depend on the type of policy you hold with us. For example, if you hold a household policy, we may collect and use information which relates to your property or if you hold a travel policy, we may collect and use information which relates to your travel plans.

Information relevant to any claim you may make. This will depend on the type of claim you make. For example, if you make a claim following a road traffic accident, we may use personal information which relates to your vehicle and named drivers.

Financial information such as your bank details, payment details and information obtained as a result of our credit checks. This may include details of any bankruptcy orders, individual voluntary arrangements or county court judgements.

Information (including photographs) obtained as a result of carrying out checks of publicly available sources such as newspapers and social media sites in the event that we suspect fraudulent activity.

Information we obtain as a result of checking sanctions lists, such as those published by United Nations, European Union, UK Treasury, the U.S. Office of Foreign Assets Control (OFAC) and the U.S. Department of Commerce, Bureau of Industry and Security.

Information such as IP address and browsing history obtained through our use of cookies. You can find more information about this in our cookies policy which can be found at https://www.hiscox.co.uk/cookies-privacy/cookie-policy.

Information obtained during telephone recordings.

Your marketing preferences and details of your customer experience with us.

What sensitive personal information will we collect?

Information relating to criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).

If relevant, details of your current or former physical or mental health condition. For example, if you hold a travel policy, we may need details about any medical conditions that affect you, another member of your party or any other person upon whose health your trip depends. This may take the form of medical reports or underlying medical data such as x-rays or blood tests.

In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to your policy or claim. For example, we may process information relating to your trade union membership if you take out a policy with us via your trade union body and we may process information relating to your religious beliefs if relevant as part of your medical treatment. 

How will we collect your personal information?

We will collect information directly from you and from the following third parties:

  • the named policyholder (where you are a beneficiary);
  • third parties involved in the relevant insurance policy or claim (such as our business partners and representatives, brokers or other insurers, claimants, defendants or witnesses to an incident);
  • third parties who provide a service in relation to the relevant insurance policy or claim (such as loss adjusters, claims handlers, and medical experts);
  • publicly available sources such as internet search engines, the electoral roll, court judgments, insolvency registers, news articles and social media sites;
  • other companies within the Hiscox group;
  • credit reference agencies;
  • financial crime detection agencies and databases (such as for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as "CUE"), the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database;
  • third parties who provide sanctions checking services;
  • government agencies such as the police, the National Crime Agency, the DVLA or HMRC;
  • insurance industry bodies (including the Employers’ Liability Tracing Office and the Association of British Insurers);
  • third parties who provide us with details of individuals who have expressed an interest in hearing about insurance products;
  • in limited circumstances, private investigators;
  • third party data suppliers (for example in relation to flood modelling data and property surveys and valuations);
  • third party administrators and suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers;
  • our own websites; and
  • selected third parties in connection with any sale, transfer or disposal of our business.

What will we use your personal information for?

We may use your information for a number of different purposes. For each purpose we must have a “legal ground” to use your personal information in such a way.

When the information that we process is classed as “sensitive personal information”, we must have a specific, additional “legal ground” to process such information.

We need to use your personal information to enter into or perform a contract that we hold with you. For example, we need to use your personal information to provide you with a quote or to provide your insurance policy and other associated products (e.g. legal expenses cover). We will rely on this for activities such as assessing your application, managing your insurance policy, handling claims and providing other products to you.

We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.

We have a legitimate interest to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.

Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.

You have provided your consent to our use of your personal information (e.g. in relation to your marketing preferences).

When the information that we process is classed as “sensitive personal information", we must have an additional “legal ground". We will rely on the following legal grounds when we process your "sensitive personal information":

We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.

We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.

We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.

We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.

We need to safeguard your economic well-being. For example, to record information to flag that you have a vulnerability we should be aware of. 

Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.

You have provided your explicit consent to our use of your sensitive personal information.

You will find further details of our "legal grounds" for each of our processing purposes set out below.

Purpose for processingLegal grounds for using your personal informationLegal grounds for using your sensitive personal information
To carry out fraud, credit and anti-money laundering checks.

It is necessary to enter into or perform your insurance contract.

We have a relevant legal or regulatory obligation.

Legitimate interests (to prevent fraud and other financial crime).

Such use is necessary for insurance purposes.

It is necessary to prevent or detect crime.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to establish, exercise or defend legal rights.

You have given us your explicit consent.

To prevent fraud. 

To evaluate your insurance application or renewal and provide you with a quote.

It is necessary to enter into or perform your insurance contract.

We have a relevant legal or regulatory obligation.

Legitimate interests (to assess your insurance application and manage the application process).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To administer your insurance contract including taking payments and making changes where requested or necessary.

It is necessary to enter into or perform your insurance contract.

We have a relevant legal or regulatory obligation.

Legitimate interests (to administer your insurance contract).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To manage insurance claims.

It is necessary to perform your insurance contract.

We have a relevant legal or regulatory obligation.

Legitimate interests (to assess and pay your claim and manage the claims process).

Such use is necessary to protect your vital interests.

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

Such use is necessary to protect your vital interests.

You have given us your explicit consent.

To prevent and investigate fraud and other crime.

It is necessary to enter into or perform your insurance contract.

We have a relevant legal or regulatory obligation.

Legitimate interests (to prevent and detect fraud and other financial crime).

Such use is necessary for insurance purposes.

It is necessary to prevent or detect crime.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To prevent fraud. 

To communicate with you and resolve any complaints that you might have.

It is necessary to enter into or perform your insurance contract.

We have a relevant legal or regulatory obligation.

Legitimate interests (to send you communications, record and investigate complaints and ensure that future complaints are handled appropriately).

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To comply with our legal or regulatory obligations.We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to use your information in order to establish, exercise or defend our legal rights.

To prevent fraud.

You have given us your explicit consent.

To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers, or carrying out customer satisfaction surveys).Legitimate interests (to develop and improve the products and services we offer).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice).

Legitimate interests (to effectively manage our business).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

For insurance risk modelling and product and pricing refinement.Legitimate interests (to develop and improve the products and services we offer).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To apply for and claim on our insurance.Legitimate interests (to ensure that we have appropriate insurance in place).

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend legal rights.

You have given us your explicit consent.

To carry out marketing analysis, customer segmentation and campaign planning.

You have given us your explicit consent.

Legitimate interests (to plan our marketing activities).

Not applicable.
To provide marketing information to you in accordance with preferences you have expressed.

You have given us your explicit consent.

Legitimate interests (to send you selected communications about other products and services we offer).

Not applicable
To buy or sell group companies or to restructure our business.

Legitimate interests (to buy or sell group companies or to restructure our business).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To enable you to participate in a prize draw, competition or complete a survey.

 

 

It is necessary to enter into or perform a contract with you.

Legitimate interests (to offer and administer prize draws and competition and conduct surveys to better understand our customers needs). 

Not applicable. 

To identify and protect vulnerable customers.

 

 

It is necessary to enter into or perform your insurance contract.

Legitimate interests (to protect customers).  

 

Such use is necessary for insurance purposes.

To safeguard economic well-being. 

 

You have given us your explicit consent.

 

Who will we share your personal information with?

From time to time, we may share your personal information with the other companies in our group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes explained above. 

If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.

Where relevant, we will share your personal information with:

  • other companies in the Hiscox group, including where:
  • we are arranging our own insurance;
  • necessary for our business administration purposes;
  • we are using information for the prevention or detection of fraud or other crime; or
  • we need to report information within our group of companies.
  • our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
  • other third parties who assist in the administration of the insurance policy or claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;
  • our regulators;
  • other insurers;
  • fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
  • the police and other third parties (such as banks or other insurance companies);
  • other insurers who provide our own insurance;
  • industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
  • credit referencing agencies and third parties who carry out sanctions checks on our behalf;
  • our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers;
  • selected third parties in connection with any sale, transfer or disposal of our business; or
  •  

where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).
 

Third party claimant under a Hiscox Insurance policy

This section will apply if you are a broker doing business with us, an appointed representative or other business partner such as an introducer or supplier. Where the provision of information is legally or contractually required, we will tell you this at the time of collection.

What personal information will we collect?

General information such as your name, address, contact details, date of birth, nationality and gender.

Identification information such as your national insurance number, passport number, tax identifiers or driving licence number.

Information about your job including job title, your status as a director or partner, employment history, education history and professional accreditations.

Information relevant to your claim. This will depend on the type of claim you make. For example, if you make a claim following a road traffic accident, we may use personal information which relates to your vehicle and named drivers.

Information relating to previous insurance policies or claims.

Financial information such as your bank details and payment details.

Information (including photographs) obtained as a result of carrying out checks of publicly available sources such as newspapers and social media sites in the event that we suspect fraudulent activity.

Details of enquiries or complaints that you make with us and conversations and correspondence made or received with you. 

Information we obtain as a result of checking sanctions lists.

Information such as IP address and browsing history obtained through our use of cookies. You can find more information about this in our cookies policy which can be found at https://www.hiscox.co.uk/cookies-privacy/cookie-policy.

Information obtained during telephone recordings.

What sensitive personal information will we collect?

Information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).

If relevant, details of your current or former health condition. For example, if you are injured whilst at a property insured by Hiscox, and the owner of the property makes a claim under their insurance policy in relation to your injury.

In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to your claim. For example, we may process information relating to your religious beliefs if relevant as part of your medical treatment.

How will we collect your information?

We will collect information directly from you and from the following third parties:

the policyholder;

third parties involved in the relevant insurance policy or claim (such as our business partners and representatives, brokers or other insurers, claimants, defendants or witnesses to an incident);

third parties who provide a service in relation to the relevant insurance policy or claim (such as loss adjusters, claims handlers, and medical experts);

publicly available sources such as the electoral roll, court judgments, insolvency registers, internet search engines, news articles and social media sites;

other companies within the Hiscox group;

credit reference agencies;

financial crime detection agencies and databases (such as for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as "CUE") the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database;

third parties who provide sanctions checking services;

government agencies such as the police, the National Crime Agency, the DVLA or HMRC;

insurance industry bodies (including the Employers’ Liability Tracing Office and the Association of British Insurers);

in limited circumstances, private investigators;

third party data suppliers (for example in relation to flood modelling data and property surveys and valuations);

third party administrators and suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers;

our own websites; and

selected third parties in connection with any sale, transfer or disposal of our business.

What will we use your personal information for?

We may use your information for a number of different purposes. For each purpose we must have a “legal ground” to use your personal information in such a way.

When the information that we process is classed as “sensitive personal information”, we must have a specific, additional “legal ground” to process such information.

We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.

We have a legitimate interest to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.

You have provided your consent to our use of your personal information.

When the information that we process is classed as “sensitive personal information", we must have an additional “legal ground". We will rely on the following legal grounds when we process your "sensitive personal information":

We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.

We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves.

We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.

We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.

You will find further details of our "legal grounds" for each of our processing purposes set out below.

 

Purpose for processingLegal grounds for using your personal informationLegal grounds for using your sensitive personal information
To comply with our legal or regulatory obligations.

Legitimate interest (to comply with our legal and regulatory obligations).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

You have given us your explicit consent.

We need to use your information in order to establish, exercise or defend legal rights.

To write insurance policies and for claims handling.Legitimate interest (to effectively write policies and manage claims).Not applicable.
For relationship and business development purposes.Legitimate interest (relationship management and business analysis).Not applicable.
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers).Legitimate interest (to develop and improve the products and services we offer).Not applicable.
To manage and handle any queries you may have.Legitimate interest (to effectively manage our business and respond to queries).Not applicable.

To enable you to participate in a prize draw, competition or complete a survey.

 

 

Legitimate interests (to offer and administer prize draws and competition and conduct surveys to better understand our broker partner needs).Not applicable. 

Who will we share your personal information with?

We will keep your personal information confidential and only share it for the purposes outlined about where necessary with the following parties:

Other companies in the Hiscox group including where:

  • we are arranging our own insurance;
  • necessary for our business administration purposes;
  • we are using information for the prevention or detection of fraud or other crime; or
  • we need to report information within our group of companies.
  • our other insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;
  • our regulators;
  • fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;
  • the police and other third parties (such as banks or other insurance companies) where reasonably necessary for the prevention or detection of crime;
  • other insurers who provide our own insurance;
  • industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);
  • credit referencing agencies and third parties who carry out sanctions checks on our behalf;
  • our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers; or
  • third parties who handle our direct marketing on our behalf (this includes, for example, inclusion or suppression of your personal information from our contact lists, sending marketing communications, and analysis of responses to our marketing communications).

our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;

other third parties who assist in the administration of your insurance claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;

companies who provide you with certain services such as home emergency cover and legal expenses cover;

our regulators;

other insurers;

fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;

the police and other third parties (such as banks or other insurance companies);

other insurers who provide our own insurance;

industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);

credit referencing agencies and third parties who carry out sanctions checks on our behalf;

our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, outsource procurement service providers, our subcontractors and tax advisers;

selected third parties in connection with any sale, transfer or disposal of our business; or

where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).

Third party under a commercial insurance policy or an insurance policy we provide to another insurer

This section will apply if your information is processed in relation to a commercial insurance policy held by a third party (for example, if you are a member of the crew on a ship or aircraft which we insure) or if your information is processed in relation to an insurance policy that we provide to another insurer. Where the provision of information is legally or contractually required, we will tell you this at the time of collection.

What personal information will we collect?

General information such as your name, address, contact details, date of birth, nationality and gender.

Identification information such as your national insurance number, passport number, tax identifiers or driving licence number.

Information about your job including job title, your status as a director or partner, employment history, education history and professional accreditations.

Information relevant to any claim made.

Information relating to previous insurance policies or claims.

Financial information such as your bank details and payment details.

Details of enquiries or complaints that you make with us and conversations and correspondence made or received with you. 

Information (including photographs) obtained as a result of carrying out checks of publicly available sources such as newspapers and social media sites in the event that we suspect fraudulent activity.

Information we obtain as a result of checking sanctions lists.

Information such as IP address and browsing history obtained through our use of cookies. You can find more information about this in our cookies policy which can be found at https://www.hiscox.co.uk/cookies-privacy/cookie-policy.

Information obtained during telephone recordings.

What sensitive personal information will we collect?

Information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).

If relevant, details of your current or former health condition. For example, if you are injured whilst at a property insured by Hiscox, and the owner of the property makes a claim under their insurance policy in relation to your injury.

In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to the policy. For example, we may process information relating to your religious beliefs if relevant as part of your medical treatment.

How will we collect your information?

We will collect information directly from you and from the following third parties:

the policyholder;

third parties involved in the relevant insurance policy or claim (such as our business partners and representatives, brokers or other insurers, claimants, defendants or witnesses to an incident);

third parties who provide a service in relation to the relevant insurance policy or claim (such as loss adjusters, claims handlers, and medical experts);

publicly available sources such as the electoral roll, court judgments, insolvency registers, internet search engines, news articles and social media sites;

other companies within the Hiscox group;

credit reference agencies;

financial crime detection agencies and databases (such as for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as "CUE") the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database;

third parties who provide sanctions checking services;

government agencies such as the police, the National Crime Agency, the DVLA or HMRC;

insurance industry bodies (including the Employers’ Liability Tracing Office and the Association of British Insurers);

in limited circumstances, private investigators;

third party data suppliers (for example in relation to flood modelling data and property surveys and valuations);

third party administrators and suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers;

our own websites; and

selected third parties in connection with any sale, transfer or disposal of our business.

What will we use your personal information for?

We may use your information for a number of different purposes. For each purpose we must have a “legal ground” to use your personal information in such a way.

When the information that we process is classed as “sensitive personal information”, we must have a specific, additional “legal ground” to process such information.

We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.

We have a "legitimate interest" to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.

Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.

You have provided your consent to our use of your personal information.

When the information that we process is classed as “sensitive personal information", we must have an additional “legal ground". We will rely on the following legal grounds when we process your "sensitive personal information":

We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing the insurance application, managing claims and preventing and detecting fraud.

We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.

We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.

We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.

Such use is necessary to protect your vital interests. For example, in relation to a kidnap claim.

You have provided your explicit consent to our use of your sensitive personal information.

You will find further details of our "legal grounds" for each of our processing purposes set out below.

Purpose for processingLegal grounds for using your personal informationLegal grounds for using your sensitive personal information
To carry out fraud, credit and anti-money laundering checks.

We have a relevant legal or regulatory obligation.

Legitimate interests (to prevent fraud and other financial crime).

Such use is necessary for insurance purposes.

It is necessary to prevent or detect crime.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to establish, exercise or defend legal rights.

You have given us your explicit consent.

To prevent fraud.

To manage any claims you make under the relevant Hiscox insurance policy.

We have a relevant legal or regulatory obligation.

Legitimate interests (to assess and pay your claim and manage the claims process).

Such use is necessary for insurance purposes.

We need to establish, exercise or defend legal rights.

Such use is necessary to protect your vital interests.

You have given us your explicit consent.

To comply with our legal or regulatory obligations.We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To communicate with you and resolve any complaints that you might have.

We have a relevant legal or regulatory obligation.

Legitimate interests (to send you communications, record and investigate complaints and ensure that future complaints and handled appropriately).

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To prevent and investigate fraud and other crime.

We have a relevant legal or regulatory obligation.

Legitimate interests (to prevent and detect fraud and other financial crime).

Such use is necessary for insurance purposes.

It is necessary to prevent or detect crime.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To prevent fraud. 

To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers).Legitimate interests (to develop and improve the products and services we offer).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice).

Legitimate interests (to effectively manage our business).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

For insurance risk modelling and product and pricing refinement.Legitimate interests (to develop and improve the products and services we offer).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To buy or sell group companies or to restructure our business.

Legitimate interests (to buy or sell group companies or to restructure our business).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

You have given us your explicit consent.

Who will we share your personal information with?

From time to time, we may share your personal information with the other companies in our group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes explained above.

If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.

Where relevant, we will share your personal information with:

other companies in the Hiscox group, including where:

one of our group companies is placing the insurance policy with another group company;

one of our group companies is unable to provide the insurance policy but another might be able to assist;

we are arranging our own insurance;

necessary for our business administration purposes;

we are using information for the prevention or detection of fraud or other crime; or

we need to report information within our group of companies.

our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;

other third parties who assist in the administration of the insurance policy or claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;

our regulators;

other insurers;

fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;

the police and other third parties (such as banks or other insurance companies);

other insurers who provide our own insurance;

industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);

credit referencing agencies and third parties who carry out sanctions checks on our behalf;

our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, outsourced procurement services providers, our subcontractors and tax advisers;

selected third parties in connection with any sale, transfer or disposal of our business; or

where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).

Witnesses to an incident

This section will apply if you are a witness to an incident which is the subject of a claim. Where the provision of information is legally required, we will tell you this at the time of collection.

What personal information will we collect?

General information such as your name, address, contact details, date of birth, nationality and gender.

Identification information such as your national insurance number, passport number, tax identifiers or driving licence number.

Information relevant to the incident that you have witnessed.

Details of enquiries or complaints that you make with us and conversations and correspondence made or received with you.

What sensitive personal information will we collect?

Depending on the nature of the incident you have witnessed, and only if relevant, we may collect information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction) or details of your current or former physical or mental health condition.

In limited circumstances, we may process other sensitive personal information including details of your race; ethnicity; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric data; or data concerning your sex life or sexual orientation if relevant to your role as a witness.

How will we collect your information?

We will collection information directly from you and from the following third parties:

third parties involved in the incident you witnessed (such as brokers or other insurers, claimants, defendants or other witnesses);

other third parties who provide a service in relation to the claim which relates to the incident you witnessed (such as loss adjusters, claims handlers, and experts);

publicly available sources such as the electoral roll, court judgments, insolvency registers, insurance industry databases, internet search engines, news articles and social media sites; and

other companies within the Hiscox group.

What will we use your personal information for?

We may use your information for a number of different purposes. For each purpose we must have a “legal ground” to use your personal information in such a way.

When the information that we process is classed as “sensitive personal information”, we must have a specific, additional “legal ground” to process such information.

We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.

We have a legitimate interest to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.

You have provided your consent to our use of your personal information.

When the information that we process is classed as “sensitive personal information", we must have an additional “legal ground". We will rely on the following legal grounds when we process your "sensitive personal information":

We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.

We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves or when we are investigating a legal claim that a third party brings against you.

We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.

We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.

You have provided your explicit consent to our use of your sensitive personal information.

You will find further details of our "legal grounds" for each of our processing purposes set out below.

Purpose for processingYour personal informationLegal grounds for using your sensitive personal information
To investigate and manage claims made under an insurance policy.

We have a relevant legal or regulatory obligation.

Legitimate interest (to assess and pay claims and manage the claims process).

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To enable us to manage our business operations, such as by maintaining accounting records, carrying out analysis of financial results, using information to meet internal audit requirements, and receiving professional advice (e.g. tax or legal advice).Legitimate interest (to effectively manage our business).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To comply with our legal or regulatory obligations.

Legitimate interest (to comply with our legal and regulatory obligations).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

You have given us your explicit consent.

We need to use your information in order to establish, exercise or defend legal rights.

To prevent fraud. 

To prevent and investigate fraud and other crime.

We have a relevant legal or regulatory obligation.

Legitimate interest (to prevent and detect fraud and other financial crime).

Such use is necessary for insurance purposes.

It is necessary to prevent or detect crime.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To prevent fraud. 

To communicate with you (and resolve any complaints that you might have.

We have a relevant legal or regulatory obligation.

Legitimate interest (to send you communications, record and investigate complaints and ensure that future complaints and handled appropriately).

Such use is necessary for insurance purposes.

We need to use your information in order to establish, exercise or defend our legal rights.

You have given us your explicit consent.

To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers).Legitimate interest (to develop and improve the products and services we offer).

Such use is necessary for insurance purposes.

You have given us your explicit consent.

To buy or sell group companies or to restructure our business.

Legitimate interest (to buy or sell group companies or to restructure our business).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

You have given us your explicit consent

Who will we share your personal information with?

From time to time, we may share your personal information with the other companies in our group or with third parties. We will keep your personal information confidential and only share it with the third parties listed below for the purposes explained above. 

If you would like further information regarding the disclosures of your personal information, please contact us using the details set out in section 10 below.

Where relevant, we will share your personal information with:

other companies in the Hiscox group, including where:

we are arranging our own insurance;

necessary for our business administration purposes;

we are using information for the prevention or detection of fraud or other crime; or

we need to report information within our group of companies.

our insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;

other third parties who assist in the administration of the insurance policy or claim, such as loss adjusters, claims handlers, accountants, auditors, banks, lawyers and other experts including medical experts;

our regulators;

other insurers;

fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;

the police and other third parties (such as banks or other insurance companies);

other insurers who provide our own insurance;

industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);

credit referencing agencies and third parties who carry out sanctions checks on our behalf;

our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers;

selected third parties in connection with any sale, transfer or disposal of our business; or

where necessary, courts and other alternative dispute resolution providers (such as arbitrators, mediators and the Financial Ombudsman Service).

Brokers, appointed representatives and other business partners

This section will apply if you are a broker doing business with us, an appointed representative or other business partner such as an introducer or supplier. Where the provision of information is legally or contractually required, we will tell you this at the time of collection.

What personal information will we collect?

General information such as your name, address, contact details, date of birth, nationality and gender.

Information about your job such as job title, your status as a director or partner, employment history, education history and professional accreditations.

Information which we obtain as part of checking sanctions lists.

Details of enquiries or complaints that you make with us and conversations and correspondence made or received with you. 

Other information (including publicly available information) obtained as part of our due diligence checks.

What sensitive personal information will we collect?

Information relating to your criminal convictions (including offences and alleged offences and any court sentence or unspent criminal conviction).

How will we collect your information?

As well as obtaining information directly from you, we will collect information from:

Invoices, contracts, policies, correspondence and business cards.

Other Hiscox group companies.

Publicly available sources such as the electoral roll, court judgments, insolvency registers, internet search engines.

From service providers who carry out sanctions checks.

What will we use your personal information for?

We may use your information for a number of different purposes. For each purpose we must have a “legal ground” to use your personal information in such a way.

When the information that we process is classed as “sensitive personal information”, we must have a specific, additional “legal ground” to process such information.

We have a legal or regulatory obligation to use such personal information. For example, our regulators require us to hold certain records of our dealings with you.

We have a legitimate interest to use your personal information. We will rely on this for activities such as maintaining our business records, training and quality assurance, and developing and improving our products and services.

You have provided your consent to our use of your personal information.

When the information that we process is classed as “sensitive personal information", we must have an additional “legal ground". We will rely on the following legal grounds when we process your "sensitive personal information":

We need to use your sensitive personal information for an insurance purpose and there is a substantial public interest in such use. Such purposes include assessing your insurance application, managing claims and preventing and detecting fraud.

We need to use your sensitive personal information to establish, exercise or defend legal rights. This might happen when we are faced with legal proceedings or want to bring legal proceedings ourselves.

We need to use your sensitive personal information to prevent or detect crime and there is a substantial public interest in such use. This might happen when we are investigating allegations of insurance fraud.

We need to use your sensitive personal information to comply with or help someone else comply with a regulatory requirement relating to unlawful acts and dishonesty and there is a substantial public interest in such use.

You will find further details of our "legal grounds" for each of our processing purposes set out below.

Purpose for processingLegal grounds for using your personal informationLegal grounds for using your sensitive personal information
To comply with our legal or regulatory obligations.

Legitimate interest (to comply with our legal and regulatory obligations).

We have a relevant legal or regulatory obligation.

Such use is necessary for insurance purposes.

Such use is necessary to comply with regulatory requirements relating to unlawful acts and dishonesty.

You have given us your explicit consent.

We need to use your information in order to establish, exercise or defend legal rights.

To write insurance policies and for claims handling.Legitimate interest (to effectively write policies and manage claims).Not applicable.
For relationship and business development purposes.Legitimate interest (relationship management and business analysis).Not applicable.
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers).Legitimate interest (to develop and improve the products and services we offer).Not applicable.
To manage and handle any queries you may have.Legitimate interest (to effectively manage our business and respond to queries).Not applicable.

To enable you to participate in a prize draw, competition or complete a survey.

 

 

Legitimate interests (to offer and administer prize draws and competition and conduct surveys to better understand our broker partner needs).Not applicable. 

Who will we share your personal information with?

We will keep your personal information confidential and only share it for the purposes outlined about where necessary with the following parties:

Other companies in the Hiscox group including where:

we are arranging our own insurance;

necessary for our business administration purposes;

we are using information for the prevention or detection of fraud or other crime; or

we need to report information within our group of companies.

our other insurance and reinsurance partners such as brokers, other (re)insurers or other companies who act as (re)insurance distributors;

our regulators;

fraud detection agencies and other third parties who operate and maintain fraud detection registers (including the Insurance Fraud Register, the Insurance Fraud Intelligence Hub (IfiHUB) and the Motor Insurance Database) or undertake investigations in cases of suspected insurance fraud;

the police and other third parties (such as banks or other insurance companies) where reasonably necessary for the prevention or detection of crime;

other insurers who provide our own insurance;

industry bodies (such as the Association of British Insurers, Lloyd’s Market Association or Employers’ Liability Tracing Office);

credit referencing agencies and third parties who carry out sanctions checks on our behalf;

our third party services providers, such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers and tax advisers; or

third parties who handle our direct marketing on our behalf (this includes, for example, inclusion or suppression of your personal information from our contact lists, sending marketing communications, and analysis of responses to our marketing communications).

From time to time, we would like to keep you informed about products or services which may be of interest to you. We may do this by postal mail, email, telephone or other electronic methods such as text message. 

If you wish to opt out of marketing, you may do so at any time by clicking on the "unsubscribe" link that appears in all emails or telling us when we call you. Otherwise you can always contact us using the details set out in section 10 to update your marketing preferences.

Please note that, even if you opt out of receiving marketing messages, we may still send you service related or regulatory communications where necessary.

In order to help us understand the products and services which may interest you, we obtain information from other sources such as marketing partners, companies who provide consumer classification, market segmentation and lifestyle data for marketing purposes. We use this information to help us plan our marketing and advertising activities.

We will only keep your personal information for period required to fulfil the relevant purposes set out in this notice. We are also required to keep certain information in order to comply with our legal and regulatory obligations.

The exact time period will depend on your relationship with us the type of personal information we hold and our purpose for retention. For example, if you take out an insurance policy with us, we will typically keep your personal information for 7 years.

If you would like further information regarding the periods for which your personal information will be stored, please contact us using the details set out in section 10.

We (or third parties acting on our behalf) may store or process personal information that we collect about you in countries located outside of the United Kingdom ("UK"). Depending on our relationship and your particular circumstances, we may transfer personal information anywhere in the world.

Where we make a transfer of your personal information outside of the UK we will take the required steps to ensure that it is protected. We will do this using a number of different methods, such as putting in place appropriate contractual protections which have been approved by the data protection authorities.

If you would like further information regarding the steps we take to safeguard your personal information, please contact us using the details set out in section 10.

We are committed to implementing leading data protection standards. We are Cyber Essentials certified and use a range of organisational and technical security measures to protect your information, including:

  • physical security measures such as on-site security and CCTV;
  • network security measures such as intrusion detection systems;
  • access controls such as password protection and user logging; and
  • virus and malware controls on our systems.

We align to the Center for Internet Security (CIS) and National Institute of Standards and Technology (NIST) frameworks, as well as its own internal Information Security Policies and Standards.  All key controls are covered including network security, information classification and handling, identity and access management (including strict multi-factor authentication (MFA)), patch management, vulnerability identification and management (covering pen testing, red teaming, code reviews, configuration reviews etc) and incident response. As well as having a robust incident response procedure, we also have a cadence in place to exercise the procedure through several incident simulation exercises every year with leadership teams across the organisation.

We review our security measures periodically. We also ensure that our employees receive appropriate data security training.

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.

Profiling

The provision of insurance is often based on profiling the likelihood of the insured event occurring. For example, we will use the information you provide in conjunction with the information provided by third party sources to assess the likelihood of a claim being made and how much it might cost and use that assessment to decide whether or not to offer you insurance and at what price.

Insurance application and pricing

For certain policy types we use an automated underwriting engine to process the personal information you provide to us for your insurance application, together with information obtained from third party sources (such as flood risk information for home insurance policies) to determine your policy premium. Other information may also be used to calculate your premium, such as the use of any specialist devices we may have provided to you as a benefit of your policy, as well as any policy history you have with us. This information is required in order to provide you with an appropriate policy premium.

Fraud prevention

We may use profiling to assess the probability that claims may be fraudulent or inaccurate. We use your personal information to evaluate and predict risks and outcomes. 

Marketing

We may use profiling to determine which products and benefits may interest you most. We may also use your personal information and profile to help us to improve our marketing materials, targeting and customer journeys.

We analyse our customers to determine common characteristics and preferences. We do this by considering various types of information which may include: your location, demographic information (such as age or job title) alongside additional policy information. These characteristics and preferences enable us to understand our customers, as well as to send you appropriate communications, and information which is most relevant to you.

Automated decision making

Like many insurers, sometimes we make decisions using solely automated means. This automated process is often used in order to assist us predict the likelihood of events such a claim being made and its value or help us identify potential fraud. This helps us efficiently set premium prices which are appropriate for the insurance being provided. For example, an automated process may provide a home insurance policy price based on your postcode, risk of flooding and local crime rate.

The majority of automated decisions we make will be necessary to enter into or perform your insurance contract or necessary for insurance purposes. If not, we will ask for your consent before making any automated decisions which have a legal or substantially similar effect.

Where we make an automated decision which has a legal or substantially similar effect, you may request a review of that decision by a member of our team. We will take into account your comments and review the decision.

Data analysis and artificial intelligence

We constantly strive to improve our processes and insurance offering. We may use technologies driven by data analysis and artificial intelligence (an umbrella term for a range of technologies that replace manual processes and solve complex tasks by carrying out functions that previously required human action) driven tools to support our existing activities. We may also use the data that we hold in order to train these types of tools. 

These technologies help us to:

  • communicate with and support our customers more effectively;
  • ensure our business operates as efficiently as possible;
  • improve our data quality and accuracy;
  • better understand our customer's needs and target our advertising and marketing activities; 
  • automate certain business activities so that we can spend more time offering greater value; 
  • ensure that our underwriting, pricing and claims processes are as effective as possible; and
  • better identify insurance fraud.

We will only use these technologies for the data processing purposes set out in this notice. We will implement appropriate checks and balance to ensure that any such technology operates as intended and does not cause unfair or bias outcomes.

Under data protection law you have certain rights in relation to the personal information that we hold about you. There will not usually be a charge for dealing with these requests. You may exercise these rights at any time by contacting us using the details set out in section 10.

Please note:

the rights set out below do not apply in all circumstances;

in some cases we may not be able to comply with your request (for example, where there is a conflict with our own obligations to comply with other legal or regulatory requirements). However, we will always respond to any request you make and if we can't comply with your request, we will tell you why.

in some circumstances exercising some of these rights (such as the right to erasure or the right to restrict processing) will mean we are unable to continue providing you with insurance and may therefore result in its cancellation. You will therefore lose the right to bring any claim or receive any benefit, including in relation to any event that occurred before you exercised your right of erasure, if our ability to handle the claim has been prejudiced. Your policy terms and conditions set out what will happen in the event your policy is cancelled.

Your rights include:

  • The right to access your personal information

You are entitled to a copy of the personal information we hold about you and certain details of how we use it.

Your information will usually be provided to you in writing, unless otherwise requested, or where you have made the request by electronic means, in which case the information will be provided to you by electronic means where possible.

  • The right to rectification

We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you do not believe this is the case, you can ask us to update or amend it.

  • The right to erasure

In certain circumstances, you have the right to ask us to erase your personal information, for example where the personal information we collected is no longer necessary for the original purpose or, where we are relying on consent as our legal ground, you withdraw your consent. However, this will need to be balanced against other factors. For example, we may have legal and regulatory obligations which mean we cannot comply with your request.

  • The right to restriction of processing

In certain circumstances, you are entitled to ask us to stop using your personal information, for example where you think that the personal information we hold about you may be inaccurate or where you think that we no longer need to use your personal information.

  • The right to data portability

In certain circumstances, you have the right to ask that we transfer personal information that you have provided to us to another third party of your choice.

  • The right to object to marketing

You can ask us to stop sending you marketing messages at any time. You can do this either by clicking on the "unsubscribe" button in any email that we send to you or you can contact us using the details set out in section 10. Please note that even if you opt out of receiving marketing messages, we will still send you necessary service related communications.

  • Rights to object

You have a right to object to an automated decision in certain circumstances.

Where we process your personal information based on legitimate interests, you can object to such processing. In such cases, we will assess your objection against our legitimate interests.

  • The right to withdraw consent

For certain uses of your personal information, we will ask for your consent. Where we do this, you have the right to withdraw your consent to further use of your personal information.

Please note that for some purposes, we need your consent in order to provide your policy. If you withdraw your consent, we may need to cancel your policy or be unable to pay your claim. We will advise you of this at the point you seek to withdraw your consent.

Please note that withdrawing consent will not affect the lawfulness of our processing based on your consent that occurred before the withdrawal.

  • The right to lodge a complaint with the ICO

You have a right to complain to the Information Commissioner's Office (ICO) if you believe that any use of your personal information by us is in breach of applicable data protection laws and regulations. More information can be found on the Information Commissioner’s Office website: https://ico.org.uk/ (external link)
 

Making a complaint will not affect any other legal rights or remedies that you have.

If you would like further information about any of the matters in this notice or have any other questions about how we collect, store or use your personal information, you may contact us by telephoning 01904 681198 or by e-mailing us at [email protected] or writing to us at Data Protection Officer, Hiscox, 22 Bishopsgate, London, EC2N 4BQ.

From time to time we may need to make changes to this notice, for example, as the result of changes to law, technologies, or other developments. This privacy notice is also subject to compliance audits across our supply chain which may result in changes. Where we make substantial changes to this notice we will provide you with an updated copy in a timely manner. You can also check our website periodically to view the most up-to-date notice.

This notice was last updated on: 30 January 2024