Customer Privacy Notice

• GENERAL INFORMATION
  • Person responsible
  • Data Protection Officer
  • Information security & data protection-friendly default settings
    • Information security
    • Data Protection-friendly default settings
• YOUR DATA PROTECTION RIGHTS
  • Information & Access, Art. 15 UK GDPR
  • Correction, Art. 16 UK GDPR
  • Deletion, Art. 17 GDPR
  • Restriction, Art. 18 GDPR
  • Transfer, Art. 20 GDPR
  • Objection, Art. 21 GDPR
  • Revocation, Art. 7 GDPR
  • Complaint, Art. 57 GDPR
• PROCESSED DATA
• DATA PROCESSING BASED ON YOUR CONSENT
• DATA PROCESSING FOR CONTRACT EXECUTION
  • Data Protection in context of the account
    • Account for the provision of our services
    • Identification and Insurance support
  • Data protection for needs
    • Conclusion of Insurance Contracts
    • Communication
    • Management of policies
  • Data protection for notifications and personal recommendationst
    • A. Personal recommendations
    • B. Transactional emails
  • General information about our Co-operation partners and data transfer
• USES OF PERSONAL DATA
• LAWFUL BASIS FOR USES OF PERSONAL INFORMATION
• DURATION OF DATA STORAGE IN GENERAL
• RECIPIENTS OF THE DATA
• TRANSFER TO THIRD COUNTRIES
• OBLIGATION TO PROVIDE DATA
• AUTOMATED DECISION MAKING

A. GENERAL INFORMATION

In this section, you will learn who is responsible for processing your data, who you can contact with questions and complaints about data protection, how to contact our data protection officer, how We protect your data, and how you can generally protect your data.

I. Person responsible

The Controller responsible for the collection and use of your personal data on our online platform and when using our service within the meaning of data protection laws is:

Candid Insurance Services Ltd (“the Company/We/Us/Our”) is a Company of which ”Tom” is a trading style. The Company is registered at 920 Hempton Court, Aztec West, Almondsbury Bristol BS32 4SR with company registration number 7279489. We can be contacted at this address, via email at hello.uk@tom.io or via this Website.

We are a policy distributor and broker supporting people to purchase long term insurance products including life insurance, serious illness cover and income protection. We are also a broker for private medical insurance. We are authorised and regulated by the Financial Conduct Authority (FCA).

We also provide services via the wallet section of the Tom app to provide insights and suggestions upon your uploaded insurance policies (if you have agreed to this service).

If you have any questions about the collection and use of data, you can contact Us at any time.

II. Data Protection Officer

If you have any questions or suggestions regarding data protection, please feel free to contact Us directly by email at hello.uk@tom.io.

You can reach our group data protection officer directly at clark@isico.de.

III. Information security & data protection-friendly default settings

B. YOUR DATA PROTECTION RIGHTS

This section explains your data protection rights in relation to your data. These rights include the right to access the data stored about you, the right to rectify it and, provided the legal requirements are met, the right to have your data deleted. Whenever We ask for your consent to process your data, you also have the right to withdraw your consent at any time without giving reasons.

C. PROCESSED DATA

In order to perform our duties, We process your personal data. This includes information that allows Us to identify you personally, such as your name, telephone number, address, or email address. Statistical data that cannot be linked to you personally does not fall under the definition of personal data.

As a broker, We need to process certain information about you:

First, We need your Contact details:

• Name, address, date of birth, age
• Telephone number, e-mail address
• Bank details

You will provide Us with this information when you register.

We also process the following personal data:

• Gender
• Marital status
• Profession, status (FT, PT), address of employer and salary
• Special categories of data (e.g. health data)
• Smoking status
• Current insurance situation
• Family situation (partner, children)
• Living situation (current and planned)
• Hobbies and interests
• Pets
• Other personal/financial circumstances, care requirements

You will provide Us with this information as part of our needs, requirements and identification check.

In addition, We process your Insurance details:

• Application data (data you provide when applying for insurance)
• Contract data for a specific contract (such as insurance policy number, insured amount, term, premium, risk, investment amounts, loan amounts)
• Benefit data (insurance claims, data at the time of occurrence of the claim or benefit event)
• When you upload other insurance policies in the wallet section of the Tom app (if you have agreed to this service) including any personal data extracted from those policies, to enable Us to provide insights and suggestions to you regarding those policies.

This data you share with us in the course of taking over or managing a brokerage mandate. If we take over an existing brokerage mandate, we will receive the data with your consent also from the insurers.

We also collect your usage data:

• Interactions on the website and app or with emails (clicks, etc.)
• Visits to the Websites and apps (which ones were accessed?)
• Time spent on Websites and apps (how long did you view a page)
• Source page (ref URL)
• Time and date, e.g. of accessing our Website or emails

We collect this data when you use our Website and app.

Finally, we collect the following of your Device, browser and location data:

• Operating system of your device (e.g. Windows, Android or iOS)
• Model of your device (e.g. iPhone, Samsung Galaxy)
• Settings of your device, e.g. screen resolution
• Browser settings e.g. language setting, time zone, installed plugins and fonts
• IP addresses
• Your location (we do not use GPS data, but only the information derived from the IP address).

We collect this data when you use our website and app.

D. DATA PROCESSING BASED ON YOUR CONSENT

I. We require your consent if We process special categories of personal data as defined in Art. 9 UK GDPR. This includes, for example, information about your health status. We need this information if We advise you on insurance products, particularly when processing claims for health and liability insurance.

Therefore, We ask for your consent if you decide to purchase a corresponding product. You can revoke your consent at any time in the future by sending a message to hello.uk@tom.io.

II. Consent for advertising and newsletters We may also require your consent in order to send you advertising information and to personalise it. This applies in particular to the sending of newsletters to provide you with information about our products, special offers, discounts or other relevant 12 news and events from the world of insurance that may be of interest to you. If you confirm your email address, We will store your email address, the time of registration and the IP address used for registration. We process this data in order to send you the newsletters and to be able to verify your registration. In addition, We process your usage data in order to understand your interaction with our newsletters. A corresponding unsubscribe link can be found in every newsletter.

III. Consent for tracking technologies In addition, We require your consent for the use of tracking technologies to analyse the usage behaviour of our Websites and apps and for marketing purposes. This also involves reading and storing information on your device. Detailed information on this, in particular on the individual providers, data protection information, privacy settings and explanations of any joint responsibility, can be found in this privacy policy under section G and in our consent banner.

IV. Data processing within the framework of our partnerships We cooperate with various partners in order to provide you with additional benefits. In doing so, certain data must be passed on so that our partners can check whether you meet the relevant requirements. In this context, upon your request – with which you give your consent – your number of insurance policies and a corresponding identifier will be sent. This allows Us to check whether you meet the requirements for the respective benefit.

V. Information on revocation These consents are voluntary. It is also possible to use our services without giving these consents. Furthermore, you can revoke your consent at any time with effect for the future. This does not affect the lawfulness of the processing until the time of revocation.

VI. Wallet services
We also provide value-added services via the wallet section of the App (if you have agreed to this service) to provide insights and suggestions upon your uploaded UK insurance documents

E. DATA PROCESSING FOR CONTRACT EXECUTION

In this section, We provide you with information about the processing of your data in connection with the initiation and/or execution of a contract with Us in insurance matters. In particular, you will learn which categories of data We process for the creation of your account, for carrying out needs assessments, for concluding an insurance policy and for managing your data, e.g., to service providers who provide Us with technical support, or to insurers. Finally, you will also learn how long We store your data and what determines this period. We also inform you there about data processing for sending marketing communications, insurance-related recommendations and transactional messages.

I. Data processing in the context of the account

II. Data processing for the conclusion of insurance contracts and customer service

III. Data processing for notifications and personalised recommendations

IV. General information about our cooperation partners and data transfer

In connection with the purposes set out above, We will sometimes share Personal data with companies within the Clark Group and third parties, including:

• Insurance brokers, financial advisers and business partners who help Us arrange, manage and underwrite our products and who provide insurance services;
• Other insurers (either directly or via those acting for the insurer);
• Our insurers or reinsurers (either directly or through insurance brokers), who provide reinsurance services to Us and each other in respect of risks underwritten by the Company, or insurers who cover the Company under our group insurance policies. We can supply on request further details of the insurers and reinsurers We provide your Personal Information to and how this may be used. If you require further details, please contact Us;
• Third parties who provide you with certain services including assistance providers;
• Third party in relation to the relevant insurance policy or claim e.g. experts and in limited circumstances, private investigators;
• Legal advisers, accountants, auditors, financial institutions and professional service firms who act on our or your behalf;
• Data analysts and providers of data services who support Us with developing our products and prices and measuring the effectiveness of marketing;
• Third parties that help Us maintain the accuracy of our data e.g. identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide Us with updated payment card details;
• Financial crime detection agencies, sanctions checking providers and third parties who maintain fraud detection databases or provide assistance with investigation in cases of suspected fraud;
• Regulators who regulate how We operate, including the FCA, PRA, FOS, HMRC, ICO and the Advertising Standards Agency;
• Government agencies and regulatory bodies including the police, courts and DWP;
• Debt advisors where breathing space is requested on outstanding debts;
• Insurance industry bodies, including the Association of British Insurers;
• Service providers, including those who help operate our IT and back office systems, underwriting and claims processes and our information security controls;
• Third party payment service providers, who process card and other payments for Us.
• Medical professionals, if We need to access health records or assessments for the purposes of arranging and underwriting certain products or facilitating and handling claims;
• Clinicians, including hospitals and third party case managers from whom you and others covered under the policy receive insured treatment or who manage your care or treatment pathway;
• Research agencies and providers of market research services, including customer feedback surveys;
• Providers of marketing and advertising services, including delivering and administering marketing, ensuring you receive marketing content that’s relevant to you and in accordance with your preferences and analysing marketing campaigns. These may include media agencies, fulfilment partners, social media and other online platforms and advertising technology companies.
• Third parties in connection with any sale, transfer or disposal of our business.

The information you will be asked for will include details about your medical history, which is essential to enable a broker to provide you with an accurate life insurance quote. Tom.co.uk and any trusted third parties who wish to provide a quote to you will then need to process the personal data provided by you for administration purposes, to enable quotes to be provided to you and, if you decide to proceed with the purchase of a policy, as reasonably required to provide life insurance to you.

F. USES OF PERSONAL DATA

The main purposes for which We use Personal data are to:

• Communicate with you and other individuals;
• Make assessments and take decisions, including whether to provide you with our products and services
• Provide our products and services, including insurance administration, taking payment, making changes where requested or necessary, claims assessment, settlement and dispute resolution and the provision of our apps and other technologies e.g. Tom app
• Manage relationships with third parties, e.g. advisers and service providers;
• Prevent, detect and investigate fraud and other crime, including by carrying out fraud, sanctions and anti-money laundering checks.
• Improve our products and services, provide staff training and maintain information security, including by recording and monitoring telephone and online calls and screen sharing sessions;
• Provide marketing information and run promotions in accordance with preferences you have expressed.
• Help Us better understand our customers and improve our customer engagement, including noting your interest in our Website, understanding your customer journey, and use of profiled data (which is not actual information about you but predictions about you, e.g. assumptions about your interests based on the preferred leisure pursuits of households in your area). This allows Us to make correlations about our customers to improve and promote our products and to suggest other products, services and information which may be relevant or of interest to customers;
• Carry out data analysis, including to ensure data accuracy and quality and for insurance risk modelling and product and pricing refinement.
• Manage complaints, including to allow Us to respond to any current complaints, or challenges you or others might raise later, for internal training and monitoring purposes and to help Us to improve our complaints handling processes. We may be obliged to forward details about your complaints, including your Personal data to the appropriate authorities, e.g. Financial Ombudsman Service
• Manage feedback and queries, and handle requests to exercise data subject rights.
• Manage our business operations, including by carrying out internal audits, quality assurance and training, financial analysis and accounting, producing management information and performing administrative activities in connection with the services We provide;
• Manage commercial risk, including by taking out and maintaining appropriate insurance and reinsurance;
• Comply with applicable legal, regulatory and professional obligations, including cooperating with regulatory bodies e.g. the FCA, PRA, ICO and government authorities, to comply with law enforcement and to manage legal claims;
• Identify and support customers requiring additional support, to help Us better meet your needs and to comply with regulatory guidance about how We meet your needs. Sometimes you or a third party may tell Us that you have additional support requirements, and in other cases We may infer this from your Personal Information and our interactions with you;
• Establish, enforce and defend our legal rights or those of third parties, including enforcing our terms and conditions, pursuing available remedies and limiting our damages;
• Carry out activities that are in the public interest, e.g. We may need to use Personal data to carry out anti-money laundering checks;
• Buy, sell, transfer or dispose of any part of our business;
• Archiving, scientific or historical research or statistical purposes.
• In the wallet section of the App to provide (if you have agreed to this service), following analysis through an artificial intelligence tool, We will provide insights and suggestions relating to insurance policies uploaded within the Wallet. For this purpose We process personal data contained in the uploaded insurance policies.

G. LAWFUL BASIS FOR USES OF PERSONAL INFORMATION

We are committed to collecting and using Personal data in accordance with applicable data protection laws. By law, We must have a legal justification, known as a lawful basis, in order to use your Personal Information for the purposes described in this Privacy Policy. Depending upon the purpose, our lawful basis will be one of the following:

• Performance of a contract – to arrange, underwrite or manage our products, or handle claims in accordance with their terms;
• Compliance with a legal obligation – to meet responsibilities We have to our regulators, tax officials, law enforcement, or other legal responsibilities;
• Legitimate interests – to operate and improve our products and services and keep people informed about our products and services or for any other purposes We identify as appropriate to our business needs, or those business needs of a third party;
• Consent – where We have obtained appropriate consents to collect or use your Personal Information for a particular purpose.
• Where We rely on legitimate interests as our lawful basis, We are required to carry out a balancing test to ensure that our interests, or those of a third party, do not override the rights and freedoms that you have as an individual. The outcome of this balancing test will determine whether We can use your Personal Information for the purposes described in this Privacy Policy. Where We rely on the lawful basis of legitimate interests, the interests being relied upon will usually be:
  • To further our business and commercial activities and objectives, or those of a third party, e.g., to provide our products and services and produce management information on our performance and the performance of third parties;
  • To help Us better understand our customers and improve our customer engagement and marketing campaigns including by carrying out analysis and profiling, e.g. by making certain predictions and assumptions about your interests;
  • To send you marketing information in accordance with your preferences, e.g. about other products and services We offer, and to administer promotions that you enter;
  • To provide you with helpful information relating to your products and about useful tools for managing and engaging with your products, e.g. the Tom app. These are not marketing communications;
  • To comply with our legal and regulatory obligations, guidelines, standards and codes of conduct, e.g., background checks or the prevention, detection and investigation of financial crime or fraud;
  • To improve and develop our business, products and services, or those of a third party, e.g. to ensure the accuracy of customer data and to develop our pricing and risk methods and models;
  • To retain your policy record for a period of time in order to ensure We have appropriate records in place in respect of any future claims that may be insured by Us;
  • To safeguard our business, shareholders, employees and customers, or a third party, e.g. maintaining the security of our IT network and information, enforcing claims, including debt collection;
  • To facilitate the purchase, sale, transfer or disposal of any part of our business; and
  • To analyse and assess competition in the market for our products services, e.g., by carrying out market research.

Content Delivery Networks – We have a legitimate interest in providing our online services in a secure, fast and efficient manner. For this reason, We work with service providers who store and provide our services, infrastructure and data. These may include, in particular, services such as content delivery networks (CDN).

Communication
– Apart from communication within the scope of your contractual relationship), We have a legitimate interest in communicating with you and answering your questions about Us, our services or data protection. For this purpose, We process the contact details of your chosen contact channel and the communication data, including communication content.

Social Networks
– We operate company pages on the LinkedIn social network to keep you up to date about Us and our services and to communicate with customers and interested parties.
– user data is generally processed by the social network for market research and advertising purposes. This allows usage profiles to be created based on users’ interests. For this purpose, cookies and other identifiers are stored on the end devices of the persons concerned. Based on these usage profiles, advertisements are then placed within the social network, and also on third-party Websites.
– The legal basis for data processing carried out by social network on their own responsibility can be found in the data protection information of the respective social network. The links below also provide further information on the respective data processing and the options for objection.
– As part of the operation of our company pages, We may be able to access information such as statistics on the use of our company pages provided by the social network. These statistics are aggregated and may include, in particular, usage data such as demographic information and interactions with our company pages and the posts and content distributed on them.

These may also provide information about the interests of users and which content and topics are particularly relevant to them. We may also use this information to tailor the design, activities and content of our company page and optimise it for our audience. The legal basis is our legitimate interest in effective information and communication with users of social networks.

– If you have an account with a social network, We may be able to see your publicly available information (e.g. username) and media (e.g. images and videos) when We visit your profile. In addition, the social network may allow Us to contact you. This can be done, for example, via direct messages or posted contributions.

– The content of communication via the social network and the processing of communication data is the responsibility of the social network as a messenger and platform service. For this processing, We refer to the privacy policy of the respective social network.

– As soon as We transfer your data to our own systems or process it further, We are independently responsible for it. In this case, the legal basis depends on the type of processing listed in this privacy policy.

– We would like to point out that data protection requests can be most efficiently made to the respective social network provider, as only these providers have access to the data and can take appropriate measures directly. You can, of course, also contact Us with your request. In this case, We will process your request and forward it to the social network provider.

Our Company Pages

Below We list the social networks where We operate company pages:

– LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
– Privacy policy: https://www.linkedin.com/legal/privacy-policy
– Privacy settings: https://www.linkedin.com/mypreferences/g/guestretargeting-opt-out
– Information on the joint responsibility agreement: https://www.linkedin.com/legal/l/page-joint-controller-addendum.

H. DURATION OF DATA STORAGE IN GENERAL

Information on the storage of information when using the Tom Website/app

The period of time for which We store the data We collect varies and depends on what data it is and for what purpose We use it.

Some data you can delete yourself. Some data is automatically deleted after a certain period of time or anonymised. In some cases, your data will only be deleted when your account is deleted or your contract with Us ends.

We keep records, which may include your personal data – to meet legal, regulatory, tax or accounting needs. For example, We are required to retain an accurate record of your dealings with Us, so We can respond to any complaints or challenges you or others might raise later. We’ll also retain files if We reasonably believe there is a prospect of litigation. The specific retention period for your Personal Information will depend on your relationship with Us and the reasons We hold your Personal Information and We have carefully considered different retention periods that apply to each data category.

Our third parties are also subject to these regulations but We recommend that you check their privacy policies separately. This is to ensure that you do not inadvertently agree to authorise the use of your personal data in a manner you would not wish to have done, as your arrangements with these third parties are separate from your arrangements with Us.

To support Us in managing how long We hold your data and our record management, We maintain a data retention policy which includes clear guidelines on data retention and deletion.

If you would like more information about our data retention policy, please contact Us.

I. RECIPIENTS OF THE DATA

The data We collect is only passed on if there is a legal basis for this in a specific case. This may be via your consent, but it may also be necessary for the transmission within the framework of your contractual relationship, due to legal obligations or to protect our legitimate interests. In this section, you will find further details about recipients.

Legal basis for disclosure

Your data will only be passed on if one of the following legal bases applies:

• Your consent;
• Your contractual relationship with Us, including for the performance of the contract and for the implementation of pre-contractual measures;
• Legal obligation, including due to binding requirements, official requests, court orders and legal proceedings for legal prosecution and enforcement;
• Necessity to safeguard our legitimate interests, including to ensure secure and stable Website and app operation and to assert, exercise or defend legal claims.
  

1. Insurers

If you apply for insurance with Us, We will forward the personal data relevant to the conclusion of the insurance policy contract to the respective insurer. This transfer is carried out in order to fulfil our obligations to the insurer. As an insurance broker, We transfer information between you and the insurers.

2. Technical service providers & infrastructure providers

We use technical service providers for the operation, maintenance and further development of our digital infrastructure. These providers support Us in particular with the secure storage, processing and transmission of data, as well as with ensuring stability, performance and protection against unauthorised access. These technical service providers act exclusively on our instructions and are bound by corresponding contracts to comply with data protection regulations in accordance with Art. 28 UK GDPR. This includes services such as payments and billing, document and contract management and consulting.

3. Regulatory, legal and judicial enquiries

In addition, data may be disclosed in individual cases in connection with official requests, our regulatory obligations, court orders and legal proceedings if We believe in good faith that We are legally obliged to do so.

We may also disclose data if We believe in good faith that it is necessary to: detect, prevent and prosecute fraud, unauthorised use of our product, and other harmful or illegal activities. In this case, the legal basis is our legitimate interest in investigating these matters.

J. TRANSFER TO THIRD COUNTRIES

We may use services whose providers are located in so-called third countries (outside the UK) or transfer personal data to such countries, i.e. countries whose level of data protection does not correspond to that of the UK. In such cases, We implement appropriate measures to protect your data during transmission, as explained below.

Pursuant to an ongoing adequacy decision by the European Commission (Art. 45 UK GDPR) regarding the UK, We will base our exchange of data to countries within the EU on this.

We will take appropriate measures to ensure an adequate level of data protection for any data transfers.

K. OBLIGATION TO PROVIDE DATA

There is generally no obligation to provide your data. In this section, you will learn in which cases you would need to provide your data in order to make full use of our services.

If the provision of your data is necessary for the conclusion of a contract (e.g. to register an account or use services), to fulfil legal obligations (e.g. for registration forms), to establish contact or to use other services and functions (e.g. to subscribe to a newsletter), without this data, a contract cannot be concluded, the specific service cannot be provided or the function cannot be used.

Other information not marked as mandatory fields is voluntary. The entry of such data is then not necessary for the conclusion of a possible contract, for the provision of the service or for the use of the function and has no influence on the execution of the contract.

L. AUTOMATED DECISION-MAKING

When using technologies to personalise our services, automated decisions may be made about the personalised content and advertising that is displayed or sent. These decisions are then based on the usage data previously collected automatically or the data you have provided yourself, for example in form fields. We use this data to create a profile that helps Us select the appropriate content and advertising.