Privacy Notice
In this Notice, when we refer to “TMK”, “we, us, or our”, we mean the entities set out below in the section ‘Who are we?’
This Notice will explain to you how we collect, use, and share your personal data for the purpose of operating our business, websites, and managing our relationships with suppliers. It will also inform you of your rights relating to your personal data.
Personal data is any information that relates to a living person and that identifies you either directly from that information or indirectly, by reference to other information that we have access to.
If you provide personal data about other persons to us, such as family, friends, or other associates, you confirm that you are providing such personal data to us compliantly. You should provide them with a copy of or link to this notice.
If you are a job applicant who has provided your personal data to us for recruitment purposes, please click here for our Candidate Privacy Notice. If you are a former employee, contractor or other individual who previously worked under a contracting arrangement with us, please contact us at dpo@tokiomarinekiln.com to obtain a copy of our Privacy Notice for Employees and Contractors.
1. Who are we?
We are part of the Tokio Marine Holdings, Inc. group of companies operating throughout the world.
This Notice covers:
Tokio Marine Kiln Group Limited and all its UK subsidiaries including:
- Tokio Marine Kiln Insurance Services Limited
- Tokio Marine Kiln Syndicates Limited
- Tokio Marine Kiln Regional Underwriting Limited
- Kiln Pension Guarantee Limited
- Tokio Marine Underwriting Limited
TMK is a data controller in respect of personal data which we receive in connection with the services that we provide to our clients. This means that we are responsible for deciding how we can use your personal data.
The specific company acting as controller of your personal data will be set out in the documentation you are provided as part of your engagement with us. If you are unclear or if you have any questions about the specific company acting as controller of your personal data then please contact us using the details set out in Section 12 below.
Where your personal data is processed by other subsidiaries of Tokio Marine Kiln Group Limited or other entities in the Tokio Marine group, you should refer to the privacy notices of those companies.
2. About the insurance market
Insurance requires the collection and sharing of your personal data by different participants in the insurance market, including intermediaries, insurers and reinsurers. The Data Protection Insurance Market Core Uses Information Notice explains the core ways in which this personal data is used and disclosed. Our practices align the uses set out in the notice. We encourage you to review the notice by clicking the link above.
3. Our processing of your personal data
The personal data that we collect, how we collect it, and how we use that personal data depends upon how you interact with us.
For example we will collect different personal data and use it for different purposes depending on whether you are a:
- Prospective policyholder or beneficiary (such as an employee or family member)
- Policyholder or beneficiary (such as an employee or family member) under an insurance policy
- Claimants, prospective claimants and other third parties under an insurance policy
- Witnesses or other individuals who provide us with information in relation to an event
- Brokers and other intermediaries any other third party we work with, for example claims handlers, professional advisors or other service providers
- Users of the TMK UK website
- Visitors to our UK offices
For each processing purpose we will identify a ‘lawful basis’ as required under data protection law. We typically rely on the following lawful bases when processing your personal data, ensuing that our processing is necessary:
- For performance of a contract with you
- To comply with a legal or regulatory obligation
- For the purposes of legitimate interests pursued by us
- For the recognised legitimate interest to detect, investigate or prevent crime
- For the recognised legitimate interests of safeguarding
Special categories of personal data
Certain categories of personal data are deemed particularly sensitive and subject to additional protections. These are known as "special categories of personal data" and include personal data relating to health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of unique identification and data relating to sex life or sexual orientation. In addition, personal data relating to criminal offences is subject to additional protections. We include such data when we reference "special categories of personal data" in this notice.
If we process special categories of personal data, data protection laws require us to have an additional legal ground.
The additional legal grounds that we rely on for processing of special categories of personal data are that:
- The processing is necessary:
- For an insurance purpose
- To prevent, investigate or detect an unlawful act
- To protect the public against dishonesty
- To comply with regulatory requirements relating to unlawful acts and dishonesty
- To prevent fraud
- On suspicion of terrorist financial or money laundering
- For the safeguarding of individuals at risk
- For the safeguarding of economic well-being of certain individuals
- For establishing, exercising or defending legal claims
- For statistical purposes
- We have your explicit consent
Prospective policyholder or beneficiary
What personal data do we collect?
Individual Details
Name, address (and proof of address), other contact details (e.g., email and telephone numbers), gender, marital status, family details, date and place of birth, nationality, employer, job title and employment history, educational and technical qualifications, family details and their relationship to you.
Identification information
Identification numbers issued by government bodies or agencies (e.g., depending on the country you are in, social security or national insurance number, passport number, identification number, tax number, driver's licence number).
Financial information
Payment card and bank account details, income, and other financial information.
Risk details
Information about you which we collect in order to assess the risk to be insured and provide a quote. This includes information relating to your health, criminal convictions, or other special categories of personal data. For certain types of policies, this includes telematics data.
Vulnerability data
Information relating to any health, life event, resilience or capability needs you may have in order to help us identify additional support requirements to ensure that we can best meet your needs.
Criminal offence data
Information relating to criminal convictions, alleged offences, investigations, or related security measures, where relevant to assessing risk or handling a claim.
Special categories of personal data
Depending on the nature of the insurance in question, we may process current or former physical or mental medical conditions, health status, injury or disability information, medical procedures performed, relevant personal habits (e.g., smoking or consumption of alcohol), prescription information and medical history.
Other special categories of personal data may also be processed including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data and information concerning an individual's sex life or sexual orientation.
Policy information
Information about the quotes you receive and policies you take out.
Credit and anti-fraud data
Credit history and credit score, sanctions and criminal offences information received from various anti-fraud databases relating to you.
Previous and current claims
Information about previous and current claims, which may include information relating to your health, criminal convictions, or other special categories of personal data and in some cases, surveillance reports.
Marketing information
Your individual details and marketing preferences.
Who do we obtain your personal data from?
We collect personal data from various sources, including but not limited to:
- you
- your family members, representative, employer or trade or professional associations
- other insurance market participants, such as insurance intermediaries (e.g., introducers, brokers, agents and coverholders), insurers and reinsurers
- credit reference agencies
- anti-fraud databases, sanction lists, court judgements and other databases
- government agencies such as vehicle registration authorities and tax authorities
- publicly available information, including but not limited to the open electoral register
- suppliers providing products and services to us
How do we obtain your personal data?
We collect personal data in the course of our business:
When you request a service from us
For example, if you ask us to obtain insurance quotes, or if you contact us to make an enquiry about a product or a service that we provide.
Call or online meeting recordings
We will inform you whenever we record your voice (e.g., in a telephone recording) or video images (e.g. online meetings). Specifically, if we record online meetings hosted on virtual platforms such as Microsoft Teams and Zoom, the fact of the recording will be prominently displayed on your screen.
You have a right to continue or decline to participate in the meetings, phone call or other recordings.
What does TMK use your personal data for and what is our legal basis for the use?
Quotation/inception
Purposes for processing personal data
- Setting you up as a client, e.g. possible fraud, sanctions, credit and anti-money laundering checks
- Evaluating the risks to be covered and matching to appropriate policy/premium
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- ensure that the client is within our acceptable risk profile
- determine the likely risk profile and appropriate insurance product and premium
- set you / your organisation up as a client
To enter into or performance of our contract with you
Recognised legitimate interest to detect, investigate or prevent crime
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
Necessary to comply with regulatory requirements relating to unlawful acts
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Supporting through the client onboarding process
Purposes for processing personal data
- Providing technical, customer service and other support
- Responding to your queries and requests for information
- Communicating with you in connection with providing a service/ product to our clients or prospective clients
- Collecting or refunding payments
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- provide the relevant support and services
- conduct the relevant business activities
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Supporting vulnerable customers
Purposes for processing personal data
-
Identifying and supporting vulnerable customers to ensure that we can best meet their needs.
-
Sharing information with other insurance partners to ensure that vulnerable customers are supporting throughout the insurance process.
Legal basis for processing your personal data
Compliance with legal obligations
To enter into or performance of our contract with you
Recognised legitimate interest of safeguarding
Additional legal grounds for processing your special categories of personal data
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Other business purposes
Conducting data analytics
Purposes for processing personal data
-
General risk modelling
-
Other data analytics: Our business relies on developing products and services by drawing on our experience from prior engagements
Legal basis for processing your personal data
Legitimate interests to:
- build risk models that allow accepting of risk with appropriate premiums
- pursue the commercial needs of our business
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
Necessary for statistical purposes
Testing purposes
Purposes for processing personal data
We may use your personal data in order to test our IT systems. Appropriate security precautions and permissions will be applied to the data and any copies used for testing.
Legal basis for processing your personal data
Legitimate interests to:
- to test our IT systems
- pursue the commercial needs of our business
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Contacting and marketing to our clients and prospective clients
Purposes for processing personal data
- Sending newsletters and other marketing communications to individual representatives of our corporate clients or prospective clients
- Inviting individual representatives of our corporate clients or prospective clients to events (and arrange and administer those events)
Legal basis for processing your personal data
Legitimate interests to:
- pursue the commercial needs of our business
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data for marketing purposes.
Conducting surveys and other evaluations
Purposes for processing personal data
- Customer satisfaction surveys and other surveys for research and analytical purposes
Legal basis for processing your personal data
Legitimate interests to:
- use personal data for improvement of our services and products
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data for the purposes of conducting surveys or other evaluations.
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
We share personal data within and outside the Tokio Marine group of companies. These persons may act as data controllers or data processors of your personal data. A data controller is responsible for deciding how to use your personal data, while a data processor only processes your personal data on behalf of a data controller that it provides services to.
Within the Tokio Marine group of companies
Your personal data is shared with our group entities for the purposes of conducting our business, for providing services to you or our clients, for our general business administration, and for reporting or regulatory/ compliance purposes. Our group entities may either act as data controllers or data processors of personal data. Where personal data is shared between any Tokio Marine group of companies, this will be facilitated through our intra-group data sharing agreement.
Other companies
We may disclose your personal data to or share it with:
- The relevant insurance market participants and other companies
The insurance lifecycle involves the sharing of your personal data between the various insurance market participants and other companies.
We may disclose your personal data to our insurance partners and other companies such as other insurers, reinsurers, coverholders, brokers and other companies who act as insurance intermediaries and medical service providers. These entities would usually operate as independent data controllers of personal data and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.
We may disclose your personal data to those who are involved in risk assessment, handling, investigation, defence or prosecution of claims, administration of insurance policies, loss adjustment and information providers such as screening, due diligence, and anti-fraud databases. These entities would usually process your personal data on our behalf.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
- Other authorised service providers
We may disclose your personal data to service providers we have retained to provide services to us.
Certain service providers such as banks, financial organisations and advisers, auditors, lawyers and tax advisers are independent data controllers of personal data which they receive from us and are responsible for their own compliance with data protection laws.
Other service providers such as our marketing agencies, document management providers and IT service providers who manage our IT and back office systems would usually act as data processors and process on our behalf, those personal data which they receive from us.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
Legal and regulatory obligations
We will make disclosures in order to meet our legal and regulatory obligations to law enforcement agencies, government, and regulatory bodies such as the Prudential Regulatory Authority, the Financial Conduct Authority, the Information Commissioner’s Office and other regulators as required by law, who act as independent data controllers of the personal data.
We may make disclosures of your personal data for the purposes of legal proceedings, obtaining legal advice and complying with our obligations under data protection and other laws.
Policyholder or beneficiary under an insurance policy
What personal data do we collect?
Individual Details
Name, address (and proof of address), other contact details (e.g., email and telephone numbers), gender, marital status, family details, date and place of birth, nationality, employer, job title and employment history, educational and technical qualifications, family details and their relationship to you.
Identification information
Identification numbers issued by government bodies or agencies (e.g., depending on the country you are in, social security or national insurance number, passport number, identification number, tax number, driver's licence number).
Financial information
Payment card and bank account details, income, and other financial information.
Risk details
Information about you which we collect in order to assess the risk to be insured and provide a quote. This includes information relating to your health, criminal offence data, or other special categories of personal data. For certain types of policies, this includes telematics data.
Vulnerability data
Information relating to any health, life event, resilience or capability needs you may have in order to help us identify additional support requirements to ensure that we can best meet your needs.
Criminal offence data
Information relating to criminal convictions, alleged offences, investigations, or related security measures, where relevant to assessing risk or handling a claim.
Special categories of personal data
Depending on the nature of the insurance in question, we may process current or former physical or mental medical conditions, health status, injury or disability information, medical procedures performed, relevant personal habits (e.g., smoking or consumption of alcohol), prescription information and medical history.
Other special categories of personal data may also be processed including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data and information concerning an individual's sex life or sexual orientation.
Policy information
Information about the quotes you receive and policies you take out.
Credit and anti-fraud data
Credit history and credit score, sanctions and criminal offences information received from various anti-fraud databases relating to you.
Previous and current claims
Information about previous and current claims, which may include information relating to your health, criminal offence data, or other special categories of personal data and in some cases, surveillance reports.
Marketing information
Your individual details and marketing preferences.
Who do we obtain your personal data from?
We collect personal data from various sources, including but not limited to:
- you
- your family members, representative, employer or trade or professional associations
- other insurance market participants, such as insurance intermediaries (e.g., introducers, brokers, agents and coverholders), insurers and reinsurers
- credit reference agencies
- anti-fraud databases, sanction lists, court judgements and other databases
- government agencies such as vehicle registration authorities and tax authorities
- publicly available information, including but not limited to the open electoral register
- in the event of a claim, third parties including the other party to the claim (claimant / defendant), witnesses, experts (e.g., medical experts), loss adjustors, legal advisors, and claims handlers.
suppliers providing products and services to us
How do we obtain your personal data?
We collect personal data in the course of our business:
Providing a service/ product to our clients
Our services and products include insurance products and services (e.g., underwriting, coverholder services and insurance administration). In these cases, your personal data will normally be provided to us by our clients (or intermediaries acting on behalf of our clients), or sometimes our clients may ask us to contact you directly. We will also obtain information from other third parties.
Call or online meeting recordings
We will inform you whenever we record your voice (e.g., in a telephone recording) or video images (e.g. online meetings). Specifically, if we record online meetings hosted on virtual platforms such as Microsoft Teams and Zoom, the fact of the recording will be prominently displayed on your screen.
You have a right to continue or decline to participate in the meetings, phone call or other recordings.
What does TMK use your personal data for and what is our legal basis for the use?
Providing a service/product to our clients
Policy administration
Purposes for processing personal data
Client care, e.g., communicating with you and sending you updates
To prevent or detect fraud
Legal basis for processing your personal data
- Compliance with legal obligations
Legitimate interests to: - set you/your organisation up as a client
- correspond with you in order to facilitate the placing of and claims under insurance policies
- manage client relationships
Recognised legitimate interest to detect, investigate or prevent crime
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
Necessary to comply with regulatory requirements relating to unlawful acts
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Renewals
Purposes for processing personal data
Evaluating the risks to be covered and matching to appropriate policy/ premium
Legal basis for processing your personal data
Legitimate interests to:
- correspond with you in order to facilitate the placing of and claims under insurance policies
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
Necessary to comply with regulatory requirements relating to unlawful acts
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Supporting through the insurance lifecycle
Purposes for processing personal data
- Providing technical, customer service and other support
- Responding to your queries and requests for information
- Communicating with you in connection with providing a service/ product to our clients or prospective clients
- Collecting or refunding payments
Legal basis for processing your personal data
Legitimate interests to:
- provide the relevant support and services
- conduct the relevant business activities
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Supporting vulnerable customers
Purposes for processing personal data
- Identifying and supporting vulnerable customers to ensure that we can best meet their needs.
- Sharing information with other insurance partners to ensure that vulnerable customers are supporting throughout the insurance process.
Legal basis for processing your personal data
Compliance with legal obligations
To enter into or performance of our contract with you
Recognised legitimate interest of safeguarding
Additional legal grounds for processing your special categories of personal data
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Other business purposes
Conducting data analytics
Purposes for processing personal data
-
General risk modelling
-
Other data analytics: Our business relies on developing products and services by drawing on our experience from prior engagements
Legal basis for processing your personal data
Legitimate interests to:
- build risk models that allow accepting of risk with appropriate premiums
- pursue the commercial needs of our business
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
Necessary for statistical purposes
Testing purposes
Purposes for processing personal data
We may use your personal data in order to test our IT systems. Appropriate security precautions and permissions will be applied to the data and any copies used for testing.
Legal basis for processing your personal data
Legitimate interests to:
- to test our IT systems
- pursue the commercial needs of our business
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Contacting and marketing to our clients and prospective clients
Purposes for processing personal data
- Sending newsletters and other marketing communications to individual representatives of our corporate clients or prospective clients
- Inviting individual representatives of our corporate clients or prospective clients to events (and arrange and administer those events)
Legal basis for processing your personal data
Legitimate interests to:
- pursue the commercial needs of our business
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data for marketing purposes.
Conducting surveys and other evaluations
Purposes for processing personal data
- Customer satisfaction surveys and other surveys for research and analytical purposes
Legal basis for processing your personal data
Legitimate interests to:
- use personal data for improvement of our services and products
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data for the purposes of conducting surveys or other evaluations.
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
We share personal data within and outside the Tokio Marine group of companies. These persons may act as data controllers or data processors of your personal data. A data controller is responsible for deciding how to use your personal data, while a data processor only processes your personal data on behalf of a data controller that it provides services to.
Within the Tokio Marine group of companies
Your personal data is shared with our group entities for the purposes of conducting our business, for providing services to you or our clients, for our general business administration, and for reporting or regulatory/ compliance purposes. Our group entities may either act as data controllers or data processors of personal data. Where personal data is shared between any Tokio Marine group of companies, this will be facilitated through our intra-group data sharing agreement.
Other companies
We may disclose your personal data to or share it with:
- The relevant insurance market participants and other companies
The insurance lifecycle involves the sharing of your personal data between the various insurance market participants and other companies.
We may disclose your personal data to our insurance partners and other companies such as other insurers, reinsurers, coverholders, brokers and other companies who act as insurance intermediaries and medical service providers. These entities would usually operate as independent data controllers of personal data and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.
We may disclose your personal data to those who are involved in risk assessment, handling, investigation, defence or prosecution of claims, administration of insurance policies, loss adjustment and information providers such as screening, due diligence, and anti-fraud databases. These entities would usually process your personal data on our behalf.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
- Other authorised service providers
We may disclose your personal data to service providers we have retained to provide services to us.
Certain service providers such as banks, financial organisations and advisers, auditors, lawyers and tax advisers are independent data controllers of personal data which they receive from us and are responsible for their own compliance with data protection laws.
Other service providers such as our marketing agencies, document management providers and IT service providers who manage our IT and back office systems would usually act as data processors and process on our behalf, those personal data which they receive from us.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
Legal and regulatory obligations
We will make disclosures in order to meet our legal and regulatory obligations to law enforcement agencies, government, and regulatory bodies such as the Prudential Regulatory Authority, the Financial Conduct Authority, the Information Commissioner’s Office and other regulators as required by law, who act as independent data controllers of the personal data.
We may make disclosures of your personal data for the purposes of legal proceedings, obtaining legal advice and complying with our obligations under data protection and other laws.
Claimants, prospective claimants and other third parties under an insurance policy
What personal data do we collect?
Individual Details
Name, address (and proof of address), other contact details (e.g., email and telephone numbers), gender, marital status, family details, date and place of birth, nationality, employer, job title and employment history, educational and technical qualifications, family details and their relationship to you, and your images/videos/photographs.
Identification information
Identification numbers issued by government bodies or agencies (e.g., depending on the country you are in, social security or national insurance number, passport number, identification number, tax number, driver's licence number).
Financial information
Payment card and bank account details, income, and other financial information.
Risk details
Information about you which we collect in order to assess the risk to be insured and provide a quote. This includes information relating to your health, criminal offence data, or other special categories of personal data. For certain types of policies, this includes telematics data.
Loss Details
Information we collect to investigate, validate and manage your claim. This may include factual accounts of the loss, details of affected property or operations, information about individuals involved, and any documents or evidence you provide. For certain claims, this may involve processing health data, criminal offence data, or other special categories of personal data where relevant.
Vulnerability data
Information relating to any health, life event, resilience or capability needs you may have in order to help us identify additional support requirements to ensure that we can best meet your needs.
Criminal offence data
Information relating to criminal convictions, alleged offences, investigations, or related security measures, where relevant to assessing risk or handling a claim.
Special categories of personal data
Depending on the nature of the insurance in question, we may process current or former physical or mental medical conditions, health status, injury or disability information, medical procedures performed, relevant personal habits (e.g., smoking or consumption of alcohol), prescription information and medical history.
Other special categories of personal data may also be processed including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data and information concerning an individual's sex life or sexual orientation.
Policy information
Information about the quotes you receive and policies you take out.
Credit and anti-fraud data
Credit history and credit score, sanctions and criminal offences information received from various anti-fraud databases relating to you.
Previous and current claims
Information about previous and current claims, which may include information relating to your health, criminal offences data, or other special categories of personal data and in some cases, surveillance reports.
Who do we obtain your personal data from?
We collect personal data from various sources, including but not limited to:
- you
- your family members, representative, employer or trade or professional associations
- other insurance market participants, such as insurance intermediaries (e.g., introducers, brokers, agents and coverholders), insurers and reinsurers
- anti-fraud databases, sanction lists, court judgements and other databases
- government agencies such as vehicle registration authorities and tax authorities
- publicly available information, including but not limited to the open electoral register
- in the event of a claim, third parties including the other party to the claim (claimant / defendant), witnesses, experts (e.g., medical experts), loss adjustors, legal advisors, and claims handlers.
suppliers providing products and services to us
How do we obtain your personal data?
We collect personal data in the course of our business:
Call or online meeting recordings
We will inform you whenever we record your voice (e.g., in a telephone recording) or video images (e.g. online meetings). Specifically, if we record online meetings hosted on virtual platforms such as Microsoft Teams and Zoom, the fact of the recording will be prominently displayed on your screen.
You have a right to continue or decline to participate in the meetings, phone call or other recordings.
When you communicate with us
We may collect information from you when you make a claim under an insurance policy or when you otherwise communicated with us n respect of an insurance policy.
What does TMK use your personal data for and what is our legal basis for the use?
Providing a service/product to our clients
Claims processing
Purposes for processing personal data
Managing insurance and reinsurance claimsd
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- assess the veracity and quantum of claims
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Purposes for processing personal data
Defending or prosecuting legal claims
Legal basis for processing your personal data
Legitimate interests to:
- defend and make claims
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
Necessary for establishing, exercising and defending legal claims
Purposes for processing personal data
Investigating or prosecuting fraud
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- assist with the prevention and detection of fraud
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
Necessary for an insurance purpose
To prevent, investigate or detect an unlawful act
To establish, exercise or defend legal claims
Supporting vulnerable customers
Purposes for processing personal data
- Identifying and supporting vulnerable customers to ensure that we can best meet their needs.
- Sharing information with other insurance partners to ensure that vulnerable customers are supporting throughout the insurance process.
Legal basis for processing your personal data
Compliance with legal obligations
To enter into or performance of our contract with you
Recognised legitimate interest of safeguarding
Additional legal grounds for processing your special categories of personal data
For the safeguarding of individuals at risk
For the safeguarding of economic well-being of certain individuals
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
We share personal data within and outside the Tokio Marine group of companies. These persons may act as data controllers or data processors of your personal data. A data controller is responsible for deciding how to use your personal data, while a data processor only processes your personal data on behalf of a data controller that it provides services to.
Within the Tokio Marine group of companies
Your personal data is shared with our group entities for the purposes of conducting our business, for providing services to you or our clients, for our general business administration, and for reporting or regulatory/ compliance purposes. Our group entities may either act as data controllers or data processors of personal data. Where personal data is shared between any Tokio Marine group of companies, this will be facilitated through our intra-group data sharing agreement.
Other companies
We may disclose your personal data to or share it with:
- The relevant insurance market participants and other companies
The insurance lifecycle involves the sharing of your personal data between the various insurance market participants and other companies.
We may disclose your personal data to our insurance partners and other companies such as other insurers, reinsurers, coverholders, brokers and other companies who act as insurance intermediaries and medical service providers. These entities would usually operate as independent data controllers of personal data and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.
We may disclose your personal data to those who are involved in risk assessment, handling, investigation, defence or prosecution of claims, administration of insurance policies, loss adjustment and information providers such as screening, due diligence, and anti-fraud databases. These entities would usually process your personal data on our behalf.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
- Other authorised service providers
We may disclose your personal data to service providers we have retained to provide services to us.
Certain service providers such as banks, financial organisations and advisers, auditors, lawyers and tax advisers are independent data controllers of personal data which they receive from us and are responsible for their own compliance with data protection laws.
Other service providers such as our marketing agencies, document management providers and IT service providers who manage our IT and back office systems would usually act as data processors and process on our behalf, those personal data which they receive from us.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
Legal and regulatory obligations
We will make disclosures in order to meet our legal and regulatory obligations to law enforcement agencies, government, and regulatory bodies such as the Prudential Regulatory Authority, the Financial Conduct Authority, the Information Commissioner’s Office and other regulators as required by law, who act as independent data controllers of the personal data.
We may make disclosures of your personal data for the purposes of legal proceedings, obtaining legal advice and complying with our obligations under data protection and other laws.
Witnesses or other individuals who provide us with information in relation to an event
What personal data do we collect?
Individual Details
Name, address (and proof of address), other contact details (e.g., email and telephone numbers), gender, marital status, family details, date and place of birth, nationality, employer, job title and employment history, educational and technical qualifications, family details and their relationship to you, and your images/videos/photographs.
Identification information
Identification numbers issued by government bodies or agencies (e.g., depending on the country you are in, social security or national insurance number, passport number, identification number, tax number, driver's licence number).
Who do we obtain your personal data from?
We collect personal data from various sources, including but not limited to:
- you
- your family members
- your representatives
other insurance market participants, such as insurance intermediaries (e.g., introducers, brokers, agents and coverholders), insurers and reinsurers
How do we obtain your personal data?
We collect personal data in the course of our business:
Call or online meeting recordings
We will inform you whenever we record your voice (e.g., in a telephone recording) or video images (e.g. online meetings). Specifically, if we record online meetings hosted on virtual platforms such as Microsoft Teams and Zoom, the fact of the recording will be prominently displayed on your screen.
You have a right to continue or decline to participate in the meetings, phone call or other recordings.
When you contact us or we otherwise communicate with you
We will collect information when we engage with you regarding an event you have witnessed which relates to a risk we insure.
What does TMK use your personal data for and what is our legal basis for the use?
Providing a service/product to our clients
Purposes for processing personal data
Communicating with you regarding events you have witnessed
Legal basis for processing your personal data
Legitimate interests to:
- Collect information relating to an event
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data unless it is necessary for an insurance purpose.
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
We share personal data within and outside the Tokio Marine group of companies. These persons may act as data controllers or data processors of your personal data. A data controller is responsible for deciding how to use your personal data, while a data processor only processes your personal data on behalf of a data controller that it provides services to.
Within the Tokio Marine group of companies
Your personal data is shared with our group entities for the purposes of conducting our business, for providing services to you or our clients, for our general business administration, and for reporting or regulatory/ compliance purposes. Our group entities may either act as data controllers or data processors of personal data. Where personal data is shared between any Tokio Marine group of companies, this will be facilitated through our intra-group data sharing agreement.
Other companies
We may disclose your personal data to or share it with:
- The relevant insurance market participants and other companies
The insurance lifecycle involves the sharing of your personal data between the various insurance market participants and other companies.
We may disclose your personal data to our insurance partners and other companies such as other insurers, reinsurers, coverholders, brokers and other companies who act as insurance intermediaries and medical service providers. These entities would usually operate as independent data controllers of personal data and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.
We may disclose your personal data to those who are involved in risk assessment, handling, investigation, defence or prosecution of claims, administration of insurance policies, loss adjustment and information providers such as screening, due diligence, and anti-fraud databases. These entities would usually process your personal data on our behalf.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
- Other authorised service providers
We may disclose your personal data to service providers we have retained to provide services to us.
Certain service providers such as banks, financial organisations and advisers, auditors, lawyers and tax advisers are independent data controllers of personal data which they receive from us and are responsible for their own compliance with data protection laws.
Other service providers such as our marketing agencies, document management providers and IT service providers who manage our IT and back office systems would usually act as data processors and process on our behalf, those personal data which they receive from us.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
Legal and regulatory obligations
We will make disclosures in order to meet our legal and regulatory obligations to law enforcement agencies, government, and regulatory bodies such as the Prudential Regulatory Authority, the Financial Conduct Authority, the Information Commissioner’s Office and other regulators as required by law, who act as independent data controllers of the personal data.
We may make disclosures of your personal data for the purposes of legal proceedings, obtaining legal advice and complying with our obligations under data protection and other laws.
Third parties we work with (suppliers, insurance partners and other companies such as other insurers, reinsurers, coverholders, brokers and other intermediaries)
What personal data do we collect?
Individual Details
Name, business contact details (e.g. email and telephone numbers), employer and job title.
Who do we obtain your personal data from?
We collect personal data in the course of our business:
When we engage with an insurance partner such as other insurers, reinsurers, coverholders, brokers and other intermediaries
We collect information necessary to administer our relationship with our insurance partners
When we engage or are proposing to engage the services or purchase products from a supplier
We collect information necessary to administer our relationship with a supplier, e.g. a review of our supplier’s capabilities and qualifications, communicate with our suppliers or proposed suppliers, make payments and recover money owed to us, and perform any ongoing monitoring and investigations where required.
Audio, online meeting and webinar recordings
We will inform you whenever we record your voice (e.g., in a telephone recording) or video images (e.g. online meetings and webinars). Specifically, if we record online meetings and webinars hosted on virtual platforms such as Microsoft Teams and Zoom, the fact of the recording will be prominently displayed on your screen.
You have a right to continue or decline to participate in the meetings, webinars, phone call or other recordings.
What does TMK use your personal data for and what is our legal basis for the use?
Business communications
Purposes for processing personal data
Communicating with staff of our suppliers, our insurance partners, such as other insurers, reinsurers, coverholders, brokers and other companies who act as insurance intermediaries
Legal basis for processing your personal data
Legitimate interests to:
- Collect information relating to an event
Performance of our contract with you
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data unless it is necessary for an insurance purpose.
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
We share personal data within and outside the Tokio Marine group of companies. These persons may act as data controllers or data processors of your personal data. A data controller is responsible for deciding how to use your personal data, while a data processor only processes your personal data on behalf of a data controller that it provides services to.
Within the Tokio Marine group of companies
Your personal data is shared with our group entities for the purposes of conducting our business, for providing services to you or our clients, for our general business administration, and for reporting or regulatory/ compliance purposes. Our group entities may either act as data controllers or data processors of personal data. Where personal data is shared between any Tokio Marine group of companies, this will be facilitated through our intra-group data sharing agreement.
Other companies
We may disclose your personal data to or share it with:
- The relevant insurance market participants and other companies
The insurance lifecycle involves the sharing of your personal data between the various insurance market participants and other companies.
We may disclose your personal data to our insurance partners and other companies such as other insurers, reinsurers, coverholders, brokers and other companies who act as insurance intermediaries and medical service providers. These entities would usually operate as independent data controllers of personal data and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.
We may disclose your personal data to those who are involved in risk assessment, handling, investigation, defence or prosecution of claims, administration of insurance policies, loss adjustment and information providers such as screening, due diligence, and anti-fraud databases. These entities would usually process your personal data on our behalf.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
- Other authorised service providers
We may disclose your personal data to service providers we have retained to provide services to us.
Certain service providers such as banks, financial organisations and advisers, auditors, lawyers and tax advisers are independent data controllers of personal data which they receive from us and are responsible for their own compliance with data protection laws.
Other service providers such as our marketing agencies, document management providers and IT service providers who manage our IT and back office systems would usually act as data processors and process on our behalf, those personal data which they receive from us.
If you are not sure whether our service provider, with whom we share your personal data, is a data controller or processor of your data, please contact us to find out.
Legal and regulatory obligations
We will make disclosures in order to meet our legal and regulatory obligations to law enforcement agencies, government, and regulatory bodies such as the Prudential Regulatory Authority, the Financial Conduct Authority, the Information Commissioner’s Office and other regulators as required by law, who act as independent data controllers of the personal data.
We may make disclosures of your personal data for the purposes of legal proceedings, obtaining legal advice and complying with our obligations under data protection and other laws.
Users of the TMK UK website
What personal data do we collect?
Individual Details
Name, contact details and social medial profile
Website and communication usage
Details of your visits to our websites and information collected through cookies and other tracking technologies, e.g., your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, and the resources that you access. For information about how we use cookies and the choices you may have, please see the cookies policies which are available on our websites that your visit.
Who do we obtain your personal data from?
We collect this personal data directly from you.
How do we obtain your personal data?
We collect personal data in the course of our business:
When you use our website or one of our online services
We collect information about your visit and how you interact with our website. We use various technologies to collect and store information when you visit our websites. For information about how we use cookies and the choices you may have, please see our cookies policies available on our websites that you visit.
Whenever you contact us or engage us on social media
We retain a copy of your email or other correspondence as a record of your communication with us. This will include occasions when you contact us for a general enquiry, a complaint or to exercise your rights in relation to your personal data.
What does TMK use your personal data for and what is our legal basis for the use?
Operation and use of our websites
Purposes for processing personal data
- Better understand how users access and use our services and websites
- Evaluate and improve our websites, services, and business operations, and to develop new features, offerings, and services
- Facilitating your participation in interactive features you may choose to use on our websites and personalising your experience on the websites by presenting content tailored to you
Legal basis for processing your personal data
Your consent to use your personal data for the purposes (where captured e.g. where we collect consent for cookies that process personal data and our use is not strictly necessary)
Legitimate interests to:
- ensure and improve the safety, security, and performance of our websites.
- provide you with a better experience when visiting our websites
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data unless it is necessary for an insurance purpose.
Social media
Purposes for processing personal data
To respond to your communications sent through social media
Legal basis for processing your personal data
Legitimate interests to:
- respond to communications sent through social media
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data unless it is necessary for an insurance purpose.
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
Other authorised service providers
We may disclose your personal data to service providers we have retained to provide services to us such as our marketing agencies and IT service providers who manage our IT and back office systems.
Visitors to our UK offices
What personal data do we collect?
Individual Details
Name and contact details (e.g., email and telephone numbers).
CCTV images
Your images are captured by CCTV cameras operated by us. No voice is recorded by our CCTV system.
Visitor accommodations
Details you provide to help us support your visit, including information about accessibility requirements, dietary needs, allergies, or other health‑related accommodations, some of which may constitute special category data.
Who do we obtain your personal data from?
We collect personal data from various sources, including but not limited to:
- you
- CCTV systems
Third parties operating premises in which we have offices
How do we obtain your personal data?
We collect personal data in the course of our business:
When you visit our business premises or attend our events
We collect information that we need in order to identify you and complete any necessary security checks. We also collect your images on our CCTV cameras which are installed at the entrances and exits of our premises and within our premises.
We may also collect dietary, allergies and disability information for catering and your health purposes.
When you attend any meetings or any of our events, we may collect your images and voice via video recordings or still photography for marketing and promotional purposes. If we take videos or photos at any events or meetings, we will let you know either in our invitations, confirmations of the events/ meetings or at the entrance of the events/meetings
What does TMK use your personal data for and what is our legal basis for the use?
Phone calls to our office, visitors to our premises and attendees of our events
Purposes for processing personal data
To establish your identity
Legal basis for processing your personal data
Your consent to use your personal data for the purposes (where captured e.g. where we collect consent for cookies that process personal data and our use is not strictly necessary)
Legitimate interests to:
- inform the relevant TMK staff of your call or arrival and to direct you to the designated room for the meetings or events
Additional legal grounds for processing your special categories of personal data
We do not anticipate processing special categories of personal data unless it is necessary for an insurance purpose.
Purposes for processing personal data
Processing of your dietary, allergy and accessibility information for catering and your health purposes.
Legal basis for processing your personal data
Your consent to use your personal data for the purposes
Legitimate interests to:
- Facilitate catering and protect your health
Additional legal grounds for processing your special categories of personal data
Explicit consent
(where you do not wish to provide your consent we may not be able to accommodate any specific requirements)
Use of CCTV
Purposes for processing personal data
- To protect the safety of our visitors, employees and contractors, as well as property and information located or stored on the premises
- To prevent, deter, and if necessary, investigate unauthorised physical access to our premises
- To prevent, detect and investigate any crime within our premises or threats to the safety of individuals within our premises (e.g. fire, physical assault)
- The CCTV system is not used for any other purpose, such as to monitor the work of employees or their attendance
Legal basis for processing your personal data
Legitimate interests to:
- protect the security of our premises
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
To establish, exercise or defend legal claims
Legal, compliance and corporate governance
Purposes for processing personal data
Manage queries, complaints and respond to data subject right requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- investigate and respond to queries, complaints and respond to data subject right requests
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Complying with our legal and regulatory obligations, and law enforcement requests
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- comply with regulatory requirements
- protect our business
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Necessary for regulatory requirements relating to unlawful acts and dishonesty
To prevent fraud
On suspicion of terrorist financing or money laundering
Purposes for processing personal data
Performing financial, tax and accounting audits, audits and assessments of our operations, privacy, security and financial controls, our general business, accounting, record keeping and legal functions
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- understand our business
- monitor our performance
- maintain appropriate records
- protect and secure our systems
- defend and make legal claims
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Purposes for processing personal data
Purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, dissolution or restructuring of all or part of our business
Legal basis for processing your personal data
Compliance with legal obligations
Legitimate interests to:
- structure our business appropriately
Additional legal grounds for processing your special categories of personal data
To establish, exercise or defend legal rights
Necessary for an insurance purpose
Securing and protecting our business
Purposes for processing personal data
Protecting and securing our business operations, assets, services, network and information and technology resources
Legal basis for processing your personal data
Legitimate interests to:
- protect and secure our business and systems appropriately
Additional legal grounds for processing your special categories of personal data
To prevent, investigate or detect an unlawful act
Who do we share your personal data with?
Third parties operating premises in which we have offices
We share relevant visitor details with the third‑party operators of the premises where our offices are located so they can provide reception services, manage building security, and arrange access to the facilities.
We may disclose your personal data to service providers we have retained to provide services to us such as IT or information security service providers.
In limited circumstances, we may share your data with the police and other law enforcement agencies.
4. Marketing
We undertake marketing activities including sending newsletters and other marketing communications to individual representatives of our existing or prospective corporate clients and inviting individual representatives of our existing or prospective corporate clients to events.
In all cases you can opt out of or withdraw your consent for receiving marketing communications by letting us know using the contact details set out in Section 11 below or by clicking on the “unsubscribe” link which will be provided in every email communication we send.
5. Automated Decision Making
Automated decision making is commonly employed across the insurance industry for underwriting, pricing, fraud detection and claims handlings
Automated decision making refers to a situation where a significant decision is taken using personal data that is processed entirely or partly by automated means rather than a decision that is made with meaningful human involvement.
You have certain rights in relation to automated decision making which are set out at the section “What are your rights” below.
We do not currently utilise solely automated decision making. We will update this notice in the future if our practices change.
6. Artificial Intelligence
We make use of artificial intelligence (AI) within our business, primarily for streamlining, automating and enhancing our internal processes, supporting us in the delivery of our services, as well as research and knowledge support.
Whilst on occasion such use of AI may mean that your personal data is processed using AI, and it may be used to support our interactions with you, no decisions about you will be taken solely using AI.
We have in place policies, processes and training to ensure safe and appropriate use of AI and to ensure protection of any personal data processed using AI.
7. How long will TMK retain your data
We will retain your personal data in accordance with our Data Retention Schedule which is for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. Our retention periods for personal data are determined based on our business needs and legal requirements. For example, we retain certain transaction details and correspondence until the time limit for claims, or to comply with regulatory requirements regarding the retention of such data. Please note that personal data that has been deleted from our systems may persist in our backups but will not be readily accessible.
8. Your rights and complaints
Under data protection law you have a number of rights in relation to the personal data we process. Please note that some of the rights set out below only apply in specific circumstances. In addition, where you seek to exercise one of your rights, certain exemptions may apply (for example, where we also need to balance protecting the data protection rights of third parties).
|
|
|
|
Right of access |
You have the right of access to a copy of the personal data that we hold about you and certain information about our processing activities. |
|
Right of rectification |
If you feel that any information that we hold about you is inaccurate you have the right to ask us to correct or rectify it. |
|
Right of erasure |
You have a right to ask us to erase information about you where the information is no longer needed by us, where you believe that we are unlawfully processing your personal data, or where our processing of your personal data is based on your consent. Please note that there may be circumstances where you ask us to erase your personal data but we are legally entitled or required to retain it. |
|
Right to restrict processing |
You have a right to request that we restrict processing your personal data while we consider your request to rectify or erase the personal data. |
|
Right to object |
You have a right to object to our processing of your personal data where our processing is based on legitimate interests. In such circumstances, we will consider your objection and reconsider whether we can appropriately rely on our legitimate interests. You also have the right to object to any processing for the purposes of direct marketing and to any automated decisions based on profiling which we may carry out. |
|
Right to portability |
You have a right to request that we provide any personal data that you have provided to us in a commonly used, machine readable format to another data controller. |
|
Right to withdraw consent |
You have the right to withdraw your consent for the processing of your personal data where the processing is based on consent. |
|
Rights in relation to automated decision making |
You have the right not to be subject to a significant decision based entirely or partly on automated processing, including profiling, using special categories of personal data unless certain conditions are met. In all cases, where a significant decision is based entirely or partly on personal data and is based solely on automated processing we must:
A decision is a ‘significant decision’ if it produces a legal, or similarly significant, effect for you. |
|
Complaints |
You have the right to make a complaint to us at any time if you have any concerns about our handling of personal data. In addition, you have a right to lodge a complaint at any time in respect of our handling of personal data with the Information Commissioner’s Office in the UK (ICO) which can be contacted at www.ico.org.uk. However, we hope that before you do so, you will first contact us on the details below. We wish to assure you that we are committed to working with you to settle any concern or complaint your may have about how we handle your personal data. |
In addition, you may raise a complaint with us at any time if you have any concerns about our handling of personal data. We wish to assure you that we are committed to working with you to settle any concern or complaint you may have about how we handle your personal data.
You may also raise a complaint directly with the Information Commissioner’s Office in the UK (ICO) which can be contacted at www.ico.org.uk. However, we would encourage you to allow us the opportunity to resolve your concerns before doing so.
If you would like to exercise any of your rights above or raise a complaint, please contact us using the details set out in Section 11 below.
9. Where will your personal data be processed?
We may transfer certain personal data outside the UK to other Tokio Marine group entities, insurance market participants and authorised service providers (see the section Who do we share your personal data with?).
If we transfer personal data outside of the UK, we will ensure that the transfers comply with UK data protection laws including by carrying out assessments of the transfer and/or putting in place relevant additional protections.
Examples of countries where we may transfer personal data to (other than those recognised by the ICO as having adequate levels of data protection) include, but are not limited to, Australia, India, Singapore and the United States of America.
You may contact us for more information about our transfers and the safeguards we have put in place (e.g. where relevant, a copy of relevant contractual commitments, which may be redacted for reasons of commercial confidentiality). Please contact us using the details set out in Section 11 below.
10. How does TMK secure your personal data?
The security of your personal data is important to us and we have implemented reasonable physical, technical and administrative security standards to protect personal data from loss, misuse, alteration or destruction. We protect your personal data against unauthorised access, use or disclosure, using appropriate security technologies and procedures, such as encryption and limited access.
We use that only authorised individuals access your personal data. We provide role based training to our staff on a regular basis which includes a testing element to ensure that they understand the importance of and steps required to ensure that your personal data is protected.
We carry out due diligence on all third party service providers and agents and take reasonable steps to ensure that any personal data we share is protected to the same standards we provide. Our service providers and agents are contractually bound to maintain the confidentiality of personal data and may not use the personal data for any unauthorised purpose.
11. Contact us
If you have any queries, concerns or complaints or require further information as to how your personal data is processed, or if you wish to exercise any of your rights in relation to your personal data, you can contact us by post or email at:
Data Protection Officer
Tokio Marine Kiln, 20 Fenchurch Street, London EC3M 3BY
If you are not satisfied with the way in which your personal data has been handled by TMK, you may also complain to the Information Commission’s Office at:
Information Commission’s Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL
Helpline number: 0303 123 1113
12. How often is this Notice updated?
We regularly review and revise this Notice. We will ensure that the most up to date version is published here. This Notice is last updated on 12 June 2026.