Fair Processing Notice – at the time of collection

Personal information collected from the individual/or via a third party

Who controls my personal information? 

This notice tells you how, as data controller, will deal with your personal information. Where Cover-More introduces you to a company outside the group, that company will tell you how your personal information will be used. 

You can ask for further information about our use of your personal information, complain about its use or exercise your rights in the first instance, by contacting our Data Protection Officer at  Phone: 01245 272408 or The Data Protection Officer Cover-More Insurance Services UK PO Box 9180 Chelmsford Essex CM1 9AG

If you have any concerns regarding our processing of your personal information, or are not satisfied with our handling of any request by you in relation to your rights, you also have the right to make a complaint to the Information Commissioner's Office. Their address is: First Contact Team, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

What personal information will you collect about me? 

Cover-More collects personal information from and on behalf of policy holders, other insured persons (such as employees of corporate policy holders), claimants, business partners, suppliers, employers (relating to corporate policies), other insurers and third party service providers.

We will, if it is reasonable or practicable to do so, collect your personal data directly from you. This may happen when you fill out an application form for travel insurance, become one of our representatives, make a claim or request assistance. This may occur over the phone, via email, a website or through one of our agents or partners.

In certain cases we collect your personal data from third parties. For example, we may need to collect personal information from your representative (such as a legal guardian), your travel consultant, the primary policy holder or any of the other organisations referred to below. 

Where you provide data to a third party to pass onto us as part of the policy application or claims process, we will, to the extent that the data contains special categories of data such as information about your health, rely on you having provided them with your consent to pass this information to us. In addition, when you provide data, including sensitive data about other individuals on your travel insurance policy, we rely on you to inform them of the information you are providing, how we will use, hold, collect and disclose this data and on you obtaining their consent.

If you are an agent or authorised third party service provider we may obtain information from a credit reporting agency or your agency group head office.

Where your company is the applicant on a corporate policy we may receive your details from your employer.

In addition, we collect information when you visit our website, social media pages and other pages that we own and manage.

We may also collect information by other means and will take reasonable steps to inform you if and when we do.

Your Sensitive Data

Your health information, such as pre-existing medical conditions, is generally required to arrange travel insurance, to make a determination on a claim or to provide you with medical assistance.

Where you provide health information to a third party to pass onto us as part of the policy application or claims process, we rely on you having provided them with your consent to pass this information to us. In addition, when you provide information, including sensitive information about other individuals on your travel insurance policy, we rely on you to inform them of the information you are providing, how we will use, hold, collect and disclose this information and on you obtaining their consent.

Without your consent we will not collect your sensitive personal data. This is subject to some exceptions including where the collection, use and disclosure of the information:

• is necessary for the provision of emergency assistance in order to protect your vital interests, in circumstances where you are unable to give consent
• is necessary for public interest reasons, on the basis of UK law, such as the prevention of fraud
• is necessary for the establishment, exercise or defence of a legal claim.

What Personal Data Does Cover-More Collect

We will only collect personal data where it is necessary for us to perform one or more of our functions or activities. We collect the personal data we need to provide travel insurance and travel related products and services, including assistance when you are travelling.

The type of information Cover-More collects and holds varies depending on the type of product or service we provide to you. For example, Cover-More will hold different information about you if you have a travel insurance policy than if you make a claim on a policy or require assistance when travelling. This information may include information about a disability, or medical condition that you have or health information in general.

If you contact us by telephone, these calls may be recorded for training, quality and business purposes.

How do you use my personal information? 

We and our selected third party partners use your personal data to provide you with the travel insurance product or service you have requested including: assessing your travel insurance application; identifying you; managing and administering the product or service; assessing and paying a claim; or providing you with assistance when travelling.   

We also use the information of insured persons and claimants, to undertake analysis and actuarial processing which help us to deliver more accurate premiums, better assess claims, and improve the relevance of our products.

Lawful basis for processing

Everything we do with your personal data is underpinned by a "lawful basis".  These are: (i) where the processing is necessary in connection with providing you with a quotation and/or contract of insurance and/or provision of financial services that you have requested (for example, assessing your policy application, receiving payments or making payments on claims, and providing you with assistance which you are entitled to under your policy); (ii) to comply with our legal or regulatory obligations (for example, maintaining proper records, and complying with reporting requirements to our regulators); or (iii) for our "legitimate interests" (see below). 

Where use of your personal information is not necessary for your quotation or policy, or for compliance with a legal or regulatory obligation, that use will instead be in our legitimate interests, in order to provide our services to you more effectively, including providing you with information about our products and services, and to operate our business as an insurer and assistance provider. We will always ensure that we keep the amount of information collected and the extent of any processing to the minimum required to meet this legitimate interest. Examples of our legitimate interests are:

1. to identify you when you contact us;
2. to deal with policy administration 
3. to assess claims;
4. to reassess premiums at renewal;
5. to obtain feedback on the service we provide to you (including dealing with complaints or queries);
6. to administer our website and for internal operations including troubleshooting, data analysis, testing, research, statistical and survey purposes;
7. for fraud prevention and detection purposes;
8. to build actuarial models.

We will contact you to obtain consent prior to processing your personal information for any other unrelated or incompatible purpose, including for the purposes of direct marketing unless we already have consent to do so.

Who do you share my personal information with?

We will share your personal information with other members of the Cover More group for the purposes set out above, and in particular (if you are an insured person) with Cover-More Group Limited), our Australian parent company, which provides travel and medical assistance on our policies. 

Where necessary, we will also share your personal information for the purposes of providing you with the goods and services you requested with the types of third party organisations described below:

• Our Insurer, Europäische Reiseversicherung A.G (ERV),
• Other insurers, including your insurer if not Cover-More
• Reinsurers (where policies are reinsured, this means that the insurer will purchase its own insurance, from a reinsurer, to cover some of the risk the insurer has underwritten in your policy)
• The co-insured on any insurance policy, so we may confirm details of the insurance
• Your travel agent, broker or the consultant who sold you the travel insurance
• Your employer (if a corporate policy)
• Claims administrators
• Investigators, in relation to claims
• Translators, for claims and assistance
• Goods replacement suppliers to settle your claim
• Banks and foreign currency providers to settle your claim
• Transportation and accommodation providers
• Travel consultants and wholesale travel agencies
• Any company who we may claim against
• Medical practitioners and specialists
• Medical providers such as hospitals
• Emergency assistance providers
• Security providers and consultants
• Family members in the event of a medical emergency
• Witnesses, when making a claim
• Record management and storage businesses
• Companies who perform statistical analysis on our behalf
• Customer survey businesses and 
• Accreditation or certification organisations
• Our professional advisors including lawyers, accountants, tax advisors and auditors
• Debt collection agencies and other parties that assist with debt-recovery functions
• Police and law enforcement bodies to assist in their functions
• Courts of Law or as otherwise required or authorised by law
• Regulatory or government bodies for the purposes of resolving customer complaints or disputes both internally and externally or to comply with any investigation by one of those bodies (including the FCA, PRA and the ICO)
• Insurance reference bureaus
• Data retrieval agencies
• Credit providers or credit reporting agencies (if you are our representative or supplier)
• Printing, mail and distribution companies
• Telecommunication providers

Transferring Personal Information Overseas 

Where we transfer your personal information to countries that are outside of the UK and the European Union (EU) we will ensure that it is protected and that the transfer is lawful. 

By purchasing a policy through us, we may send your information to overseas parties if required to provide you with medical and non-medical assistance or to progress and assess your claim.

The countries we typically disclose your personal information to are generally located in the geographic regions you travelled during the duration of your policy or countries where Cover-More's offices are located, and in particular (but not limited to) Australia, New Zealand,  Malaysia, China, India or the USA.

The nature of our business means it is often necessary for us to send your personal information outside the European Economic Area or the UK. This occurs because our business and the third parties identified in ’ Entities Cover-More typically discloses to and/or collects from’ have operations in countries across the world. For example, where you are flying outside of the European Economic Area or the UK, and you require assistance, your personal information will be transferred to the medical provider responsible for your care.

In addition, we may transfer your data to parties in countries outside the country in which you are located to provide services to us.

This may involve sending your data to countries where under their local laws you may have fewer legal rights. However, we will only transfer your personal data to countries which are recognised as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights.  Where we transfer personal information to third parties, we rely on mechanisms including data transfer agreements, certification schemes (such as the EU-U.S. Privacy Shield Framework) or exemptions (such as where the transfer is necessary in the context of a legal claim). 

You have the right to ask us for more information about the safeguards we have put in place as mentioned above. 

How long do you retain my personal information for?

We will retain and process your personal information for as long as necessary to meet the purposes for which it was originally collected. These periods of time are subject to legal, tax and regulatory requirements or to enable us to manage our business. 

What are my data protection rights? 

You have a number of rights under the data protection laws, namely:

• to access your data (by way of a subject access request); 
• to have your data rectified if it is inaccurate or incomplete; 
• in certain circumstances, to have your data deleted or removed; 
• in certain circumstances, to restrict the processing of your data; 
• a right of data portability, namely to obtain and reuse your data for your own purposes across different services; 
• to object to any processing which is based on a 'legitimate interest' and to profiling (irrespective of whether it results in an automated decision being made about you);
• to prevent direct marketing; 
• not to be subject to automated decision making (including profiling), where it produces a legal effect or a similarly significant effect on you; 
• to claim compensation for damages caused by a breach of the data protection legislation. 
• if we are processing your personal information with your consent, you have the right to withdraw your consent at any time. 

We take the confidentiality of all records containing personal information seriously, and reserve the right to ask you for proof of your identity if you make a request in respect of such records.  We will not ask for a fee to exercise any of your rights in relation to your personal data, unless your request for access to information is unfounded, respective or excessive, in which case we will charge a reasonable amount in the circumstances.  We will let you know of any charges before completing your request.

We aim to respond to any valid requests within one month unless it is particularly complicated or you have made several requests, in which case we aim to respond within three months.  We will let you know if we are going to take longer than one month. We might ask you if you can tell us what exactly you want to receive or are concerned about.  This will help us to action your request more quickly.

Automated decision making and profiling

We undertake both profiling, and automated decision making (which may itself result from profiling). Profiling means using automated processes without human intervention (such as computer programmes) to analyse your personal data in order to evaluate your behaviour or to predict things about you which are relevant in an insurance context, such as your likely risk profile

'Automated decision making' refers to a decision which is made solely on the basis of automated processing of your personal data.  As profiling uses automated processing, it is sometimes connected with automated decision making. Not all profiling results in automated decision making, but it can do.

In order to provide you with a contract of insurance, where it is authorised by law, or where you have consented to this, we may make automated decisions about you which have a legal or significant effect, such as whether to offer you insurance or renew that coverage, or a decision about how your claim is determined.  You can obtain human intervention in the decision making, and we will ensure measures are in place to allow you to express your point of view, and/or contest the automated decision.

What happens if I fail to provide my personal information to you?

If you do not provide us with your personal information, we will not be able to provide you with an insurance policy or assess future claims for the service you have requested.