Privacy Policy

This Privacy Notice contains important information on who we are, how and why we collect, store, use and share personal information relating to individuals during our business relationship with clients, or through your use of our website, your rights in relation to your personal information and how to contact us and supervisory authorities in the event you have a complaint. “You” and “your” relates to the individuals whose personal data we process in connection with our businesses. Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). The terms insurance and insurance contract includes reinsurance, as well as contracts of insurance (i.e. individual policies) or contracts for insurance (e.g. insurance facilities which enable individual policies to be bound to those facilities).

Who we are

Ambris LLP, a UK domiciled firm, and Ambris Europe Srl, a Belgian domiciled firm with a registered UK branch office. See ‘Data controllers’ below for more information on other entities that may control and process your personal information.

The personal information we collect and use

In the course of our business and for the purpose of procuring an insurance contract and managing that contract or any claims made under that contract we collect the following personal information from you or our client (as applicable) and, where necessary, share such data between our group companies and those in which we have an investment whether directly or indirectly:

• Your name (including name prefix or title) and your title or position.
• Identification and background information provided by you or collected as part of our business acceptance processes or where required to comply with applicable law or regulation.
  Contact information, such as your postal address, email address and phone number(s).
• Technical information that is required in order to arrange or administer the specific insurance contract, including claims and accounting.
• Information which includes personal financial details, health details, previous insurance and claims experience and where relevant criminal records, for example but not limited to motoring convictions for procurement of motor insurance or for our anti-financial crime purposes etc.
• Information relating to your activities, interests or private life where you include them in any messages or conversations sent to our staff.
• Any other information relating to you which you may provide or make available to us, or we may request in connection with arranging or performing an insurance contract.

Information collected from other sources

Where we are providing services to you, or you correspond with us, we also obtain personal information from other sources as follows:

• Credit reference providers, sanction and legal screening providers, registries, Companies House or other organisations that help us and others to reduce the incidence of financial crime (e.g. money laundering, bribery and corruption, sanctions, fraud, data security) or in the course of carrying out identity, financial crime prevention or credit control checks.
• While monitoring our technology tools and services, including our websites and email communications sent to and from Ambris.
• Clients, such as other brokers or companies that may use us to procure an insurance contract for themselves, or on behalf of their clients.
• Third parties for which we provide services, such as compliance, human resources (HR), accounting, management etc.

The purposes for which we use your personal information

We use your personal information to:

• perform our contractual obligations to our clients, to undertake information management, compliance and regulatory reporting and to meet our obligations under applicable law and regulation;
• provide information requested by you including information on our services;
• manage and administer our relationship with you and our clients, including the arrangement and administration (e.g. claims and accounting) of an insurance contract;
• monitor compliance with applicable law and regulation in order to detect wrongful activity;
• fulfil our legal, regulatory and risk management obligations, including oversight of our services provision and the use of our services, establishing, exercising or defending legal claims and including statutory and other audits arranged by the firm, its group or any other stakeholder;
• make administrative arrangements relating to our services provision to you such as managing your access to certain systems and information;
  comply with health and safety obligations (where you attend any of our locations);
• enable us to comply with our internal policies and procedures aimed at preventing or detecting financial crime (e.g. money laundering, bribery and corruption, sanctions, fraud, data security), or where you exercise any of your rights in relation to your personal data;
• comply with your instructions to use your personal information, such as corresponding with your agents;
• take any necessary steps in relation to your conduct or our client’s relationship with us;
• promote our services, subject to you notifying us otherwise, where you have received services of a similar nature previously, or when the insurance product renews or we reasonably believe that they will be of interest to you, including sending research, publications and details of our services.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

Use of Ambris’ website

To enable our website to work, we use “Cookies”. A “Cookie” is a small text file sent by our web server to your browser. If your browser is set to accept cookies then this will be stored on your hard drive by your web browser. The Cookies used on this website are essential to the normal operation of the website and do not collect personally identifiable information.

The Cookies we use, their purpose, and the duration for which they are held, are set out in our Cookie Policy. The Cookie Policy forms part of this Privacy Policy and can be accessed here.

You may refuse the use of cookies at any time by selecting the appropriate settings on your browser which may affect your use and experience of our website and some features may be unavailable or not function as designed. By continuing to use our website without changing your privacy settings, you are agreeing to our use of cookies. To find out more about cookies, including how to manage and delete them, visit www.allaboutcookies.org

Who we share your personal information with

Any information that you provide to us may be shared with and processed by any entity in our group or in which we have an investment whether directly or indirectly, where they support us in the provision of our services. We may also share your personal information with certain trusted third parties in accordance with contractual arrangements in place with them, including:

• insurance companies and other brokers we use to procure the insurance contract for our clients – see also the section on Insurance Market Core Uses Information Notice below;
• loss adjusters, risk managers and other experts that assist with placement of risks or handling of claims;
• third parties and our affiliates which provide services to us including those which we use for the performance of our obligations under our agreements with clients, information management, to undertake compliance, risk, financial and regulatory reporting and to meet our obligations to our regulators. This may include markets, market and insurer or broker systems and portals and exchanges, our own systems and portals provided by third parties including via cloud technology, where necessary, to provide the services you have requested or where required by applicable law or regulation;
• credit provider where requested to do so by you or your principals;
• credit reference agencies or other organisations that help us and others reduce the incidence of financial crime (e.g. money laundering, bribery and corruption, sanctions, fraud, data security) or in the course of carrying out identity, sanction screening, legal screening, financial crime prevention or credit control checks;
• online payment service providers where card payments are made via phone;
• archiving providers for physical files, electronic files and emails;
• third parties which act on your behalf such as your agents or those who you request us to correspond with during our services provision to you;
• third parties to whom we transfer or propose to transfer any part of our business;
• regulatory agencies, courts, tribunals, law enforcement or other authorities if required by applicable law or regulation.

In some cases your personal information may be transferred to countries outside the UK or European Economic Area where such affiliates or third parties reside, perform their services or maintain any technical connection necessary for the provision of such services. In those cases, except where the relevant country has been determined to ensure an adequate level of data protection by the UK or European Commission, we will ensure that the transferred Personal information is protected by a data transfer agreement in the appropriate standard form approved for this purpose by the applicable regulator.

Insurance Market Core Uses Information Notice

Insurance involves the use and disclosure of your personal data by various insurance market participants such as intermediaries, insurers and reinsurers. The London Insurance Market Core Uses Information Notice which can be found on the following web page https://www.londonmarketgroup.co.uk/gdpr sets out those core necessary personal data uses and disclosures. Our core uses and disclosures are consistent with the London Market Core Uses Information Notice. We recommend you review this notice.

Where we transfer your personal information upon your request

You have certain rights relating to your personal information that are referred to below and one of them is your right to request that we transfer your personal information to a third party in certain circumstances. If we make such a transfer, we will not be responsible for that third party’s use and onward disclosure of your personal information nor will we provide any details to you as to that third party’s use or security measures. You will therefore need to contact the third party for such details.

Whether information has to be provided by you, and if so why

The provision of the types of personal information referred to above is necessary for the purposes of enabling us to provide services to our clients and to comply with applicable law and regulation.

How long your personal information will be kept

We will retain personal information for as long as necessary for the purpose for which it has been collected and is processed for or as required under applicable regulation and law. We believe that we are acting in your interest as claims or queries can often occur after an insurance contract has expired, so that our retention of the information will help us assist you in any queries you may have.

Reasons we can collect and use your personal information

Our use, disclosure and other processing of the Personal information obtained is permitted by applicable regulation and law because it is (i) necessary for the purposes of our legitimate interests in pursuing the purposes set out above; (ii) data protection legislation may provide that processing for insurance purposes is in the substantial public interest including for sensitive personal data (also known as special category data); (iii) you may have provided consent to our processing of your sensitive personal data in accordance with the purposes set out in our Terms of Business Agreement; (iv) it may be necessary for the performance of a contract to which the data subject is party; and/or, in some cases, (v), necessary so that we can comply with applicable law and regulation. In relation to marketing materials, the firm does not have large marketing campaigns and it is likely that you have a direct relationship with one of our brokers. Whilst we are able to process your personal data for the purposes of sending you such materials where you are an existing client and have been notified of your right to withdraw consent to receiving them or they relate to the same or similar services you have received from us unless you notify us otherwise. If you wish to unsubscribe from receiving marketing materials from us please email david.rowe@ambris.uk and the relevant broker(s) (where applicable).

Data controllers and joint controllers

Where any undertakings or entities are joint controllers, the arrangements between them include the details set out in this notice as to the purpose of their processing and who they share the personal information with, that they will each deal with requests from individuals that wish to exercise their rights to their personal information to the extent applicable to the receiving undertaking or entity and shall liaise with the other joint controllers in that regard where necessary and that they will each hold the personal data securely and protect its privacy by using a range of industry standard practices such as access control, encryption and monitoring.

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Your rights

Under certain circumstances, you have the right to:

• request access to your personal information (commonly known as a “data subject access request”). There may be cases where we are lawfully not able to provide access. In those cases, access will be provided to the extent with which we are lawfully able;
• request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
• request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. There may be cases where we need to retain your personal information and these include where we need to comply with legal or regulatory obligations, for the purposes of legal claims or for archiving. Where we are lawfully able to retain your personal information, we are not required to erase it on your request but our processing of it may be restricted;
• object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. There may be cases where we need to process your personal information and these include where we need to comply with legal or regulatory obligations, for the purposes of legal claims or where we have a legitimate interest that overrides your interests. Where we are lawfully able to continue to process your personal data, we are not required to stop if you object;
• request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for which we are processing;
• request the transfer of your personal information to another party in certain situations. This applies to personal data on which we have carried out automated processing. Our processing of personal data involves human involvement and is not purely automated;
• lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone: 0303 123 1113. The supervisory authority in Belgium is the Autorité de Protection des Données who may be contacted at https://www.autoriteprotectiondonnees.be/citoyen/agir/introduire-une-plainte or telephone: +32 (0)2 274 48 00 or +32 (0)2 274 48 35.

If you would like to exercise any of those rights, please:

• email us at david.rowe@ambris.uk
• let us have enough information to identify you and with who you trade;
• let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill or a copy of your authority where relevant); and
  let us know the information to which your request relates , including any account or reference numbers, if you have them.
• If you wish to unsubscribe from receiving marketing materials from us please email david.rowe@ambris.uk and the relevant broker(s) (where applicable).

Where appropriate, we will respond to your requests relating to your personal data in writing or by email. If you require our response in a different format, please let us know.

Keeping your personal information secure

We use current industry standard technology to maintain the confidentiality and accuracy of the information stored on our systems. As no data transmission over the internet can be entirely secure, we cannot guarantee that any information submitted electronically to us will be free from unauthorised third party use or intrusion. You should therefore satisfy yourself that your own information technology/equipment used to access our websites and electronic services is protected against such viruses and/or codes. We have security measures in place in respect of our systems and physical facilities to protect against loss, misuse or unauthorised alteration of the information stored on our premises. Further details of these measures can be requested by emailing david.rowe@ambris.uk

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Children

Individuals under the age of 18 should not send any information about themselves to us, including their name, address or e-mail address. We do not knowingly collect personal information from individuals under the age of 18 during the course of providing our services. In the event that we learn that we have collected such information in such circumstances from any individual under the age of 18, the information will be deleted as soon as reasonably possible.

Data Protection Officer

We have appointed a data protection officer (DPO), who is the Compliance Officer, to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO via david.rowe@ambris.uk

Changes to this privacy notice

We may change this privacy notice from time to time. You should check this notice occasionally to ensure you are aware of the most recent version.

How to contact us

Please contact us if you have any questions about this privacy notice or the information we hold about you david.rowe@ambris.uk