Lloyd's CCPA Privacy Policy¹

UNDERWRITERS AT LLOYD'S, LONDON

This California Consumer Privacy Act (CCPA) Privacy Policy explains how Certain Underwriters at Lloyd's, London (“we” or “us”) collect, use, and disclose personal information subject to the California Consumer Privacy Act (“CCPA”). “Personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident (“consumer”) or household. This CCPA Privacy Policy also describes the privacy rights of California consumers and how they can exercise those rights.

The CCPA does not apply to certain types of information, such as information subject to the Gramm-Leach-Bliley Act (“GLBA”) or the Fair Credit Reporting Act (“FCRA”). This means that this CCPA Privacy Policy may not apply to personal information that we collect about individuals who seek, apply for, or obtain insurance products or services for personal, family, or household purposes. The CCPA also has limited application to personal information we collect in connection with providing a product or service to a business.

PERSONAL INFORMATION WE COLLECT

We collect, and in the past 12 months have collected, the categories of personal information described below from the sources described below. Some of this personal information may be subject to GLBA or FCRA.

Directly From You

We collect, and in the past 12 months have collected, the following categories of personal information about you that you include in your application or other forms that you submit, or that you otherwise provide to us:

• [Personal identifiers, such as name, postal address, email address, Social Security number, policy number, account number, driver’s license number, or passport number
• Customer records information, such as bank account number, credit or debit card number, other financial information, phone number, health insurance information, or medical history
• Protected information, such as race, religion, sexual orientation, gender, age, or marital status
• Commercial information, such as records of personal property and insurance products or services purchased or obtained, purchasing or consuming histories, or transaction or account information
• Professional or employment related information, such as work history
• Education information, such as school and date of graduation]²

From Our Affiliates and Third Parties

We collect the following categories of personal information about you from our affiliates and other third parties, such as agents, brokers, consumer reporting agencies, or loss adjusters:

• [Personal identifiers, such as name, postal address, email address, Social Security number, policy number, account number, driver’s license number, or passport number
• Customer records information, such as bank account number, credit or debit card number, other financial information, phone number, health insurance information, or medical history
• Protected information, such as race, religion, sexual orientation, gender, age, or marital status
• Commercial information, such as information about your transactions with our affiliates or other parties (e.g., balances and payment history), records of personal property and insurance products or services purchased or obtained, purchasing or consuming histories, transaction or account information, credit-worthiness, claims history, or credit history
• Professional or employment related information, such as work history
• Education information, such as school and date of graduation]³

We may also draw inferences from the personal information we collect directly from you or from our affiliates and third parties.

HOW WE USE PERSONAL INFORMATION

The purposes for which we use personal information depend on our relationship or interaction with a specific California consumer. We may use, and in the past 12 months have used, personal information to underwrite your insurance policy and evaluate claims under your policy; to operate and manage our business; to provide and maintain our insurance products and services; to verify your identity; to detect and prevent fraud; for vendor management purposes; to operate, manage, and maintain our business, such as developing and marketing our products and services; to conduct research and data analysis; to comply with applicable laws; to respond to civil, criminal, or regulatory lawsuits or investigations; to exercise our rights or defend against legal claims; to resolve complaints and disputes; to perform compliance activities; and to perform institutional risk control.

PERSONAL INFORMATION WE DISCLOSE

We disclose, and in the past 12 months have disclosed, the categories of personal information described in “Personal Information We Collect” for the purposes described in “How We Use Personal Information” to the following categories of third parties:⁴

• Affiliates
• Agents
• Brokers
• Service providers, such as loss adjusters, fraud prevention services, and software providers
• Regulatory and law enforcement agencies
• Attorneys, auditors, and other business partners

In the past 12 months, we did not sell personal information, as the term “sell” is defined under the CCPA.

YOUR RIGHTS

You may have certain rights under the CCPA. These rights are subject to certain conditions and exceptions. Your rights under the CCPA may include:⁵

• Right to Request to Know. You have the right to request to know the following information about our practices over the past 12 months: (i) the categories of personal information we collected about you; (ii) the categories of sources from which we collected the personal information about you; (iii) the categories of third parties with whom we shared personal information, (iv) the categories of personal information we sold or disclosed about you and the categories of third parties to whom we sold or disclosed that particular category of personal information; (v) our business or commercial purpose for collecting or selling your personal information; and (vi) the specific pieces of personal information we collected about you.
  
  You may exercise your right to request to know twice a year, free of charge. If we are unable to fulfill your request to know, we will let you know the reason why. Please note, in response to a request to know, we are prohibited from disclosing your Social Security number; driver’s license number or other government-issued identification number; financial account number; any health insurance or medical identification number; an account password, security questions, or answers; and unique biometric data generated from measurements or technical analysis of human characteristics.
• Right to Request to Delete. You have the right to request that we delete the personal information that we have collected from you. We may deny your request under certain circumstances, such as if we need to retain your personal information to comply with our legal obligations or if retaining the information is necessary to complete a transaction for which your personal information was collected. If we deny your request to delete, we will let you know the reason why.
• Right to Non-Discrimination. If you choose to exercise any of these rights, we will not discriminate against you in any way.

If you, or your authorized agent, would like to make a request to know or request to delete, contact us at [toll-free number]⁶ or [email your agent or broker who handled this insurance at the email address under “Contact Us” below].

We will take steps to verify your identity before processing your request to know or request to delete. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify that you are the individual about whom we collected personal information. We may request additional information about you so that we can verify your identity.  We will only use additional personal information you provide to verify your identity and to process your request.

You may use an authorized agent to submit a request to know or a request to delete. When we verify your agent’s request, we may verify both your and your agent’s identity and request a signed document from you that authorizes your agent to make the request on your behalf. To protect your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf. You may also make a consumer request on behalf of your minor child.

UPDATES TO PRIVACY NOTICE

We may change or update this CCPA Privacy Policy from time to time. If we make material changes to this CCPA Privacy Policy, we will provide you with an updated copy of the policy.

CONTACTING US

If you have any questions or concerns about this CCPA Privacy Policy or would like to learn more about how we protect your privacy, please contact the agent or broker through whom you purchased this insurance policy at [response].

Effective Date: [response]

LMA9191 18 September 2020

¹ This privacy policy does not cover agents of the Underwriters or visitors to the Underwriters’ websites. If the Underwriters are selling personal information of agents and coverholders, or they have a website, they will need a separate policy for these individuals.

² The categories of personal information under the CCPA that are most likely being collected have been listed. The categories of personal information we did not include are biometric information; geolocation information; internet or other electronic network activity; or audio, electronic, visual, or olfactory information since it seemed unlikely that the Underwriters are collecting this information. This section should be customized so that categories or types of personal information not being collected are deleted. If a specific type of personal information is collected that is not included, that specific piece of personal information should be added to the relevant category.

³ The categories of personal information under the CCPA that are most likely being collected have been listed. The categories of personal information we did not include are biometric information; geolocation information; internet or other electronic network activity; or audio, electronic, visual, or olfactory information since it seemed unlikely that the Underwriters are collecting this information from affiliates or third parties. This section should be customized so that categories or types of personal information not being collected are deleted. If a specific type of personal information is collected that is not included, that specific piece of personal information should be added to the relevant category.

⁴Underwriters should confirm this section is accurate as to the parties with whom personal information is shared.

⁵ It has been assumed that the Underwriters are not selling consumers’ personal information and the right to opt-out of the sale of personal information has therefore not been included. If personal information is being sold, this notice will need to be amended/updated.

⁶ CCPA requires that insurers provide a toll free contact number, for consumers to make requests. This is an obligation that Underwriters will need to rely on their coverholders for, so this should be provided /completed by the coverholder. It is not required that the toll-free number be answered by a live individual.