Privacy & Data Subject Requests

Aspen adheres to all relevant Data Privacy regulations in the jurisdictions in which we operate. Under these regulations you may have the right to access personal data we hold about you and to request correction, rectification or erasure of such personal data, or to request a digital copy for transfer purposes. You may also object to the processing of your personal data or request the restriction of processing of your personal data. You have the right to opt out of the sale of your personal information. However, since Aspen does not sell personal information, the ability to opt out is not applicable. Aspen has implemented a number of internal policies and processes to support these rights and to ensure that we can meet valid requests in line with the requirements of the GDPR, UK GDPR, CCPA or other applicable local laws. Aspen does not discriminate on the basis of having exercised these rights. These rights are not absolute and we will let you know if we determine that there is a legal basis preventing us from honouring your request or if a specific right does not apply under the laws relevant to the particular jurisdiction in which you are based. Please see the separate jurisdiction specific sections of this Notice for key information related to the relevant laws.

The personal data we collect (also known as PII or NPI), how we collect it, how we will use it and who we will share it with will depend upon a number of factors including, but not limited to:

• whether you are a prospective policyholder who then declines to take up the offer of insurance
  if you are a current or former policyholder
  whether you have made a claim; and the complexity of any claim(s) made

The sections below describe this in more detail.

We may collect information from you or your representative, including agents and brokers, that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you. We may also share this information with Third Party Suppliers for a legal business purpose. The type of personal information we collect depends on the context in which your information is collected, as well as the product or service (if any) that you have with us. In particular, we may collect some of all of the following categories of personal information:

• Identifiers (PII) such as name, alias, address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license or state identification card number, passport number, signature, physical characteristics or description, insurance policy information, financial information, medical information or other similar identifiers or personal information categories.
• Protected classification characteristics (SPII) such as age, race, ethnicity, ancestry, national origin, citizenship, political opinions, religious or philosophical beliefs, trade union membership, marital status, medical condition, disability, sex (including gender, gender identity, gender expression, pregnancy/childbirth and related medical conditions), sexual orientation, veteran or military status, biometric or genetic information and criminal convictions.
• Commercial information, including records of products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.
• Biometric information.
• Internet or other electronic network activity regarding your interaction with our Internet Web site, application or advertisement.
• Geolocation data.
• Audio, electronic, visual, thermal, olfactory or similar information.
• Professional or employment-related information.
• Educational information.
• Inferences drawn from any of the information identified above.

We collect PII about you through our underwriting and claims processes, either directly from you or via:

your family members, employer or representative such as an insurance broker
other insurance companies;
credit reference agencies
anti-fraud databases, sanctions lists, court judgements and other publicly available databases;
government agencies such as the DVLA and HMRC
auditors
open electoral register; or
in the event of a claim, third parties including the other party to the claim (claimant / defendant), witnesses, experts (including medical experts), loss adjustors, solicitors, and claim handlers.
Where you provide personal information to us about other individuals (for example, family members who are a named beneficiary under your policy) you should refer them to this Notice before supplying us with their data on their behalf.

All of the information you provide during the policy administration process will only be used for the purpose of enabling us to provide insurance services to you, including providing you with a quote and then insurance, and dealing with any claims or complaints that might arise, or to fulfil legal or regulatory requirements, if necessary.

In the event that we quote for a policy, you become a policyholder, have a claim or complaint, the information we collect about you will be used for the following purposes:

• quotation and inception purposes;
• to set you up as a client, including fraud, credit and anti-money laundering and sanctions checks;
• evaluating the risks to be covered and matching to appropriate policy / premium;
• policy administration;
• collection and refund of premiums;
• general client care, including communicating with you regarding administration and requested changes to your policy;
• sending you your policy documentation;
• claims processing;
• managing insurance claims;
• defending or prosecuting claims on behalf of our insureds, or Aspen Group;
• investigating and prosecuting fraud;
• contacting you in order to renew your insurance policy;
• Insurance lifecycle;
• general risk modelling and underwriting;
• complying with our legal or regulatory obligations; and
• transferring books of business, company sales and reorganisations

Aspen may collect, store, transfer and process data under a number of different bases as summarised in the table below.

We will only use your personal data (PII) for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your PII for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.

Please note that other locally permissible legal bases of processing are available, but which are not required to be detailed in the table, with some specific details included in the jurisdiction-specific sections below.

If you have any queries in relation to the legal basis of processing for specific purposes, please contact the Group Data Protection Officer via email at [email protected] or the local representatives detailed in the jurisdiction-specific sections.

The length of time for which your data will be retained will depend on a number of factors, including but not limited to:

• legislative requirements;
• Aspen reporting requirements; and
• operational requirements (e.g. claim or pension payment processing).

Aspen seeks to minimize the time it retains data in line with the requirements of the GDPR or any local laws that apply in your jurisdiction, and maintains a comprehensive Group Records Retention Policy in order to achieve this aim. This policy and associated data retention Schedules pertaining to each type of information can be obtained from Aspen’s Group Data Privacy Officer at [email protected].

We do not make any decisions about you using automated means (without human review), however we will update our Privacy notice if this position changes.

Aspen does not sell any data to third parties for commercial purposes.

Insurance involves the use and disclosure of your personal data by various insurance market participants such as intermediaries, insurers and reinsurers. The London Insurance Market Core Uses Information Notice sets out those core necessary personal data uses and disclosures. Our core uses and disclosures are consistent with the London Market Core Uses Information Notice (irrespective if you have a Lloyd’s or non-Lloyd’s policy), except as identified below, and we recommend that you review this notice.

In the course of providing services to you Aspen may engage, and disclose your data to, a number of Third Party Suppliers, e.g. Claims Handlers, Employment Services, or recruiting partners, in connection with services provided by them. At all times, Aspen will require that the personal data is processed in accordance with our instructions and in circumstances which require the recipient to observe industry standard security measures in respect of personal data. We do not allow our Third Party Suppliers to use your personal data for their own purpose.

Aspen may also be under a duty to disclose or share your personal data in order to comply with a legal or regulatory obligation, where such disclosure is required by applicable tax or social security authorities, the U.S. Securities and Exchange Commission (SEC), the Financial Conduct Authority (FCA), the Prudential Regulation Authority (PRA), the Bermuda Monetary Authority (BMA) or similar Regulatory body, the police or a court of competent jurisdiction.

We may share your personal information with other entities within the Aspen Group as part of delivering services to you, our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, or for system maintenance support and hosting of data.

We may also share your personal information with other third parties, for example, in the context of a possible sale or restructuring of the business or a part of the business. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes, subject to any legal or regulatory obligation where such data cannot be anonymised. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

Please also refer to the jurisdiction specific sections of this Notice for further information regarding your rights regarding the sale of your data.

Due to the nature of our business, Aspen is unable to contact all of its policyholders, beneficiaries or claimants as we do not always know who they are, particularly in the case of reinsurance policies. This means that we cannot ensure that all data subjects will be aware when our Privacy Notice changes. However, we will always ensure that it is updated to reflect any changes in legislation, our own policies or best market practices.

Any changes we may make to this Notice in the future will be posted on Aspen’s web site and you are advised to regularly check and review the Notice to ensure you understand how we may be processing your personal data. Any changes Aspen may make to this Notice (which will, unless otherwise indicated, apply to any personal data already obtained by Aspen before the changes were made) will be effective from the date on which those changes have been posted on this page.

This Notice was last updated on 7 Sep 2021.

It is important that the personal information we hold about you is accurate and current. Please keep us informed of any changes to your personal information during your relationship with us.

For the purposes of the data protection legislation, the company responsible for your PII (i.e. the data controller) is the Aspen Group company stated in your contract of insurance or employment. If you have any questions on this Policy, please contact Aspen’s Group Data Protection Officer at

30 Fenchurch Street,
London  EC3M 3BD

or via email at: [email protected].

Where you are dissatisfied with any aspect of our handling of your personal data, you have a right to lodge a complaint with the relevant authority responsible for data protection in your jurisdiction. For details of relevant authorities, please see the jurisdiction-specific sections of this Notice.

The personal data we collect (also known as PII or NPI), how we collect it, how we will use it and who we will share it with will depend upon a number of factors including, but not limited to:

• whether you are a prospective, current or former employee, contractor, worker, director or officer;
• if you have opted to take an international secondment within the Aspen Group; and
• if an employee of Aspen group, which optional reward benefits you have selected connected with your employment

The sections below describe this in more detail.

We may collect information from you or your representative, including recruitment agents, that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you.  In particular, we may collect some or all of the following categories of personal information:

• Identifiers such as name, alias, address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license or state identification card number, passport number, signature, physical characteristics or description, medical information or other similar identifiers or personal information categories.
• Protected classification characteristics (SPII) such as age, race, ethnicity, ancestry, national origin, citizenship, political opinions, religious or philosophical beliefs, trade union membership, marital status, medical condition, disability, sex (including gender, gender identity, gender expression, pregnancy/childbirth and related medical conditions), sexual orientation, veteran or military status, biometric or genetic information and criminal convictions.
• Biometric information.
• Internet or other electronic network activity regarding your interaction with our Internet Web site, application or advertisement.
• Professional or employment-related information.
• Educational information.
• Attendance records, including. attendance at Aspen offices for hybrid, office-based and remote workers.
• Inferences drawn from any of the information identified above.

We collect PII about you through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties, including former employers, referees, and other background check agencies or through information that is available in the public domain. In the US, please note that, in addition to this Statement, you may receive additional notices relating to background and credit check processes.

We will collect additional personal information in the course of job-related activities throughout the period of you working for us (including, in the case of office attendance, through swipe card records), and occasionally following the termination of your relationship with us.

Should you provide personal information to us about other individuals (for example, family members who are benefits recipients or beneficiaries) you should refer them to this Notice before supplying us with their data on their behalf.

All of the information you provide during the recruitment process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements, if necessary. We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role for which you have applied.

In the event that you are offered and accept a role with Aspen, the information we collect about you will be used for the following purposes:

• administering and maintaining HR records (including but not limited to information relevant to induction, on-boarding and leaver processes);
• planning, paying and reviewing your salary or fees, other remuneration and benefits
• assessments of your performance or conduct including performance appraisals and reviews and for the purposes of disciplinary, grievance, whistleblowing and other internal procedures
• planning, delivering or arranging training courses related to your role and/or continued professional development, including providing information to external training providers
• maintaining sickness and other absence records
• maintaining health and safety records and ensuring a safe working environment
• taking decisions on your fitness to work and complying with our obligations under applicable laws and regulations, including employment equality or fair employment legislation in your jurisdiction; providing references and information to future employers
• alumni relations
• providing information to relevant external authorities for tax, social security and other purposes as legally required
• equal opportunities monitoring
• monitoring IT usage, including in connection with an investigation or employment disciplinary action, monitoring building access and office attendance to review office capacity, working arrangements for our staff (including those in hybrid, office and home-working arrangements); allowing and removing access to data systems
• providing information to any future purchasers of Aspen or parts of its business, including but not limited to due diligence purposes
• planning or reviewing options, in relation to the operation or management of Aspen

For the avoidance of doubt, PII (including Special Category Data) will be processed in a manner consistent with any Aspen Group equal opportunities policy in place from time to time.

Where appropriate, and subject to applicable local law, we may collect information about criminal convictions as part of the recruitment process and subsequently as part of periodic background screening checks commensurate with your duties and responsibilities, or we may be notified of such information directly by you in the course of you working for us. Therefore, we envisage that we may hold information about unspent criminal convictions. We will use information about criminal convictions and offences for the following purposes, subject to applicable local law:

• to make decisions about your recruitment and/or continued employment
• in determining your ability to perform a role and the department or environment in which you work; or
• in complying with our regulatory reporting obligations or with our professional obligations to clients.
• less commonly, subject to applicable local law, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

We do not need your consent if we use your PII (including Special Category Data) to carry out our legal obligations or to exercise specific rights in the field of employment law. In very limited circumstances, and where applicable, we may approach you for your written consent to allow us to process Special Category Data.  Please see the “Explicit Consent” category above for further details.

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).