Howden Scotland Privacy Notice

1.     Introduction

This privacy notice tells you what you can expect Howden Scotland Limited ( “we", "us", "our"), formerly known as Bruce Stephenson Insurance Brokers Limited, to do with personal information we hold on you, what kinds of information we hold, how we receive it and who we receive it from. It also explains who else we may share your information with, and gives you details about your data rights and how you may use them.

This privacy notice is updated from time to time, to reflect any changes in how we use and handle personal information. If we make any significant changes, we will let you know directly.

This version of the privacy notice was published on 1 October 2023. It contains updates to better inform you how we collect and use personal data, as well as to let you know about changes to the names that both we and our wider group of companies are known by.               

2.     Definitions

To be clear on what we mean in this privacy notice:

• “personal data” is any information that can be used to identify a living individual;
• “sensitive personal data” is personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, health data, sex life or sexual orientation;
• “data controller” means an organisation that decides how and why to collect personal data;
• “the Howden Group” is Howden Group Holdings Limited and any company or organisation in which Howden Group Holdings Limited holds significant share capital. You can find out more information about the other companies in the Howden Group by visiting www.com;
• “Howden UK & Ireland” refers to a group of UK and Ireland companies within the Howden Group that provide non-specialty insurance (for example household or professional insurance), employee benefits & wellbeing, and mortgage broking services. This includes ourselves, and you can find a list detailing all the companies in this group by visiting here; and
• “third-party” is someone who isn’t you, us, or a company in the Howden Group.

3.     Who does this Privacy Notice relate to?

This privacy notice relates to the following types of individuals, where we hold your personal information:

• Individuals who have visited one of our websites;
• Individuals who are clients, including prospective clients who have received an insurance quotation, former clients who have previously held an insurance policy with us, and client representatives, for example those with power of attorney;
• Our business/corporate clients and their employees, including prospective and former clients and client representatives;
• Individuals who contact us with a query, concern or complaint;
• Individuals named on our insurance policies, such as named drivers, joint policy holders, or beneficiaries;
• Individuals who request information from us or permit us to contact them for marketing purposes; and
• Third parties who make a claim against, or are subject to a claim from one of our policyholders in relation to a collision, accident or other insured event.

There are other types of individuals who this privacy notice does not relate to, for example our employees and sub-contractors (including prospective and former employees and sub-contractors), employees of our current, former or prospective business partners and service suppliers, and members of the press. If you are one of these individuals and would like further information on how we collect, use and store your data, please contact us using the details below.

4.     A bit about us

In the UK we trade under a number of trading names, and where we do this we hold the appropriate approvals and permissions from the relevant authorities to do so. You can view a full list of all our current trading names at any time on the Financial Services Register which can be accessed by visiting https://register.fca.org.uk.

If you have any questions about this privacy notice or how we use your information, please feel free to contact your usual advisor directly in the event that you are an existing client. We have also appointed a Data Protection Officer (DPO) who can be contacted in the following ways:

By e-mail: dpo@howden-insurance.co.uk

By post: FAO The Data Protection Officer, Howden UK & Ireland, Ageas House, The Square, Gloucester Business Park, Brockworth, Gloucester, GL3 4ZP, UK.

5.     The lawful ways we use personal data

We use personal data for the following lawful reasons:

• To enter into or perform a contract: for example, to provide you (as applicable) with an insurance quotation, to start, change of cancel a product or service we offer you, to manage any claims which arise, to answer any queries you may have, action your requests or perform any debt recovery;
• To comply with a legal obligation: for example the rules set by our regulator the Financial Conduct Authority (FCA), to fulfil your data rights under data protection laws, handle complaints about data protection or our products and services, and to comply with other legal requirements;
• For our legitimate business interests: for example, to arrange and administer insurance where your employer is our client, to detect and prevent fraud, money laundering and other financial crimes, to monitor and improve our business and our products and services, to demonstrate compliance with applicable laws and regulations, handle legal claims, to respond to other types of complaint not previously mentioned, and to undertake some marketing activities. Where we rely on this lawful reason, we assess our business needs to ensure they are proportionate and do not affect your rights. In some instances, you also have the right to object to this kind of use Further information on this right is provided under Section 16;
• With your consent: for example, when you ask us to provide you with information or permit us to contact you for marketing purposes. You can withdraw your consent at any time (to the extent we are relying on it) by using the contact details set out under Section 4; and
• To protect vital interests: in extreme or unusual circumstances, we may need to use your information to protect your life or the lives of others.

6.     When we collect your personal data

We collect personal data from you if or when: 

• You request an insurance quotation from us, either directly or via a third-party when they have permission to share your information with us, for example as part of a price comparison service;
• When you are named as part of an insurance quotation for another individual, for example as a named driver on a vehicle insurance policy, a joint policy holder, or a beneficiary;
• You purchase, change or cancel one of our products;
• We need to assist our insurers and/or insurance brokers in managing a claim made against your policy or that you bring against one of our policyholders;
• You contact us to request information or to make a complaint;
• You visit our website and submit a query, or if our website deploys cookies onto your device (further information on what cookies we deploy and why can be found by accessing the cookie policy which is available on our website);
• You take part in a competition, prize draw or survey that we administer;
• You visit one of our stands, for example at a show or trade fair, and give us your information; and
• You have made your information publicly available, and we have a legitimate reason to review it.

We also collect personal data about you from other third-party sources where we have legal grounds to do so. These include anti-fraud and crime-prevention agencies, credit reference and vetting agencies, and other data providers.

7.     What personal data do we collect?

Depending on your relationship with us, we may hold the following types of information about you:

• Identity and contact data: for example, your name, gender, date of birth, postal address, job title, telephone number and e-mail address;
• Policy and claims information: for example, your policy number, details of your cover, premiums due, relationship to the policyholder (if applicable) and previous claims history;
• Payment and account data: for example, your bank account details, credit/debit card details where you are the payer of a premium, and information about your purchases with us, including any payment plans or arrears;
• Location data: for example, your residential, work or IP address, the location of an insured item or property, and in the event of a claim, where the incident occurred;
• Correspondence data: for example, copies of letters and e-mails we send you or you send to us, and notes or call recordings of any telephone conversations;
• Information we obtain from other sources: including credit agencies, antifraud and other financial crime prevention agencies, price comparison websites, and other data providers (who may provide us with demographic or internet-based data);
• Complaint data: for example, what the complaint was, how we investigated it and how we resolved it, including any contact with relevant authorities or third-party adjudicator services;
• Sensitive personal data: for example health-related data, your race and ethnicity, your political views, or your religious beliefs, but only in restricted circumstances as explained under Section 8.

8.     The lawful ways we use sensitive personal data

We only use these types of data with your explicit consent, or to protect your vital interests, or when:

• It is necessary to meet a legal, regulatory or contractual requirement arising from a contract of insurance;
• It is necessary to prevent and detect crimes, including financial crimes such as fraud, money laundering and terrorist financing;
• It is necessary to establish, exercise or defend a legal claim;
• It is necessary to safeguard vulnerable clients; or
• You have manifestly made this type of data public.

Whilst the above list is not exhaustive, it does outline the scenarios which apply more often to insurance-related matters. Exactly how we lawfully use your sensitive personal data will be determined first-and-foremost by what happens during the lifetime of your policy (if applicable).

9.     Who we share you personal data with

Below are the categories of third parties that we may share your personal data with, but only where we have a legitimate reason to do so:

• Other companies in the Howden Group;
• Business partners, brokers, intermediaries, suppliers and agents involved in delivering products and services to you;
• Price comparison websites and other similar companies who offer ways to research and apply for financial products and services;
• Credit reference, credit scoring and fraud prevention agencies;
• Debt collection agencies;
• Law enforcement, government bodies, regulatory organisations, courts and public authorities;
• Our panel of insurers and insurance brokers, and, where necessary, other insurers and those acting on their behalf, for example loss adjusters, solicitors and claims experts;
• Media agencies and other marketing organisations that we advertise with or conduct marketing activities through;
• A third party where disclosure is required to comply with legal or regulatory requirements;
• Personal representatives appointed by you to act on your behalf, or those appointed to represent a third-party claimant; and
• Potential purchasers of our business.

10.Sharing data within the Howden Group

As stated in Section 9, we may share personal data with other companies within the Howden Group for the following purposes:

• To receive administrative support from those companies, such as the receipt of IT, HR, Finance and Compliance services;
• So that these companies can provide market insight to insurers on a confidential basis, but only where personal data has been aggregated or anonymised; and
• So that we can offer you services that may be available from another company in the Howden Group, but only if permitted under electronic marketing laws.

We will only share the minimum amount of personal data required to achieve these purposes, ensuring that we have a lawful basis to share personal data and that any processing undertaken on our behalf is governed by a data processing agreement. 

11.More information about some of the third parties we work with

In relation to motor insurance policies, we work in partnership with the Motor Insurers’ Bureau (MIB) and associated not-for profit companies who provide several services on behalf of the insurance industry. At every stage of an applicable insurance journey, the MIB will need to process the personal information of vehicle owners and/or drivers. Set out below are brief details of the sorts of activity the MIB undertake:

• Checking your driving licence number against the DVLA driver database to obtain driving licence data (including driving conviction data) to help calculate your insurance quote and prevent fraud;
• Checking your ‘No Claims Bonus’ entitlement and claims history;
• Prevent, detect and investigate fraud and other crime, including, by carrying out fraud checks;
• Maintaining databases of:
  • Insured vehicles (Motor Insurance & Policy Data or Motor Insurance Database);
  • Vehicles which are stolen or not legally permitted on the road (Vehicle Salvage & Theft Data or MIAFTR);
  • Motor, personal injury and home claims (CUE), and;
  • Employers’ Liability Insurance Policies (Employers’ Liability Database).
• Managing insurance claims relating to untraced and uninsured drivers in the UK and abroad;
• Working with law enforcement to prevent uninsured vehicles being used on the roads; and
• Supporting insurance claims processes.

12. Transferring personal data internationally

Normally, we will only transfer your personal data internationally if the recipient is based in a country that has been deemed “adequate” by the UK Secretary of State. This means that the receiving country is considered to have data protection laws and remedies that are of an equivalent standard to those found within the UK.

If we have a genuine and valid business need to transfer your personal data to a country which is not, at the time of the transfer, considered “adequate”, we will ensure that the recipient enters into a formal and enforceable legal agreement that reflects the standards required by the relevant data protection laws.

You have the right to ask us for more information about the safeguards we use when sending your personal data overseas, and can do so by using the contact details provided under Section 4.

13. Retaining and destroying personal data

We retain information about you to provide the services that you purchase from us and to meet a number of legal and regulatory requirements, as well as our own legitimate business interests. For the period we retain your information, it is held securely by us or by third-party service suppliers contracted to store it on our behalf.

Most client data is retained for a period of seven years from when the policy concerned expires. This is to ensure that we can assist our clients and insurers with any late claims, complaints or disputes that may arise, including those raised by third parties, for the time such cases are allowed under current laws.

There are isolated instances where we may need to retain your data for longer, for example if we need to assist you, an insurer or an insurance broker in a matter relating to an occurrence-based policy, or if we are ordered by the police, a court of law or another authority to keep information relating to an official investigation. There are also times when we may keep your information for a shorter period, for example if we provide you with a quotation but you do not ultimately buy a policy.

You can request further information on these retention periods by using the contact details set out under Section 4.

14.Automated decision-making and profiling

We may use the information you provide to build a profile of you. For example if we have your permission to contact you for marketing purposes, we will use this information to help identify what products and services you may find useful or relevant. We do this to try and ensure that we do not waste your time by contacting you about services that you are unlikely to be interested in.

Much of your personal data will be processed by us using “automated means” (done by computer without significant intervention by human beings) and this may include some of the decisions we may make about you. As explained under Section 16, you have rights in relation to automated decision-making and profiling.

15.Your obligation to provide information to us

Where we collect information from you in relation to insurance, and your policy is subject to UK law, you are under a legal duty to give us information. The exact obligation which applies to you depends on what your insurance relates to:

Personal clients

If you are a personal client, in other words someone buying insurance which is wholly or largely unrelated to your profession, you are under a legal duty to answer all questions we ask fully and honestly, to the best of your knowledge. This is known as a “duty to take reasonable care not to make a misrepresentation”, and is a requirement of the UK Consumer Insurance (Disclosure & Representations) Act 2012.

Business & commercial clients

Business and commercial clients are under a similar duty, known as “fair presentation”. This means that, in addition to answering our questions fully and honestly, you must also make reasonable searches for and disclose any significant or material facts which are relevant to the insurance being arranged. This includes reasonable searches of information available to other interested parties, such as agents and other people or organisations covered by the insurance, and is a requirement of the UK Insurance Act 2015.

Consequences of providing incomplete or inaccurate information

Failing to comply with the relevant legal duty may lead to a higher premium being payable, special terms or a higher excess being imposed, or the policy being cancelled or voided.

16. Your data rights

Data protection law gives you rights relating to your personal data. This section gives you an overview of these rights and how they relate to the information you may have given to us. You can exercise any of your rights by contacting us using the details provided under Section 4 and telling us which right (or rights) you would like to exercise:

You can also raise concerns or complaints directly with the data protection supervisory authority in the event you are not satisfied with our response. In the UK, the supervisory authority is the Information Commissioner’s Office (ICO). You can find detailed information about their powers, your rights under UK law and the ICO’s contact details on their website: www.ico.org.uk.