Private Clients Privacy Policy

This Privacy Policy explains how we use Personal Information which we collect about individuals in relation to our private client insurance policies.

We take the security of your Personal Information very seriously. We use a combination of technical, organisational and physical security measures to protect your Personal Information in line with our obligations under data protection law. Our employees receive training to help us comply with data protection law and safeguard your privacy.

This Privacy Policy is issued on behalf of the Aviva group companies in the United Kingdom and Ireland. When we mention "Aviva", "we", "us" or "our", what we mean is the relevant company in the Aviva group that processes your Personal Information.

The Aviva group company that underwrites your insurance policy will be the main company responsible for your Personal Information, known as the controller. Risks situated in the United Kingdom or another non-EEA country (not including the Principality of Monaco) are underwritten by Aviva Insurance Limited. Risks situated in the EEA and the Principality of Monaco are underwritten by Aviva Insurance Ireland Designated Activity Company.

We may share your Personal Information in accordance with this Privacy Policy with other companies in the Aviva group. Each Aviva group company that processes your Personal Information is responsible for looking after it in accordance with this Privacy Policy. For information about Aviva please visit the Aviva website.

A third party company (or companies) may underwrite aspects of your insurance policy and will also be acting as controller(s) of your Personal Information. Please check the documentation that we provide to you for details of the other company(ies). If you want to know more about the controller(s) of your Personal Information, please contact us using the details below.

We have separate privacy policies for our different types of products, so if you have a number of Aviva products you may need to review more than one privacy policy. We may also supplement this Privacy Policy with additional privacy notices tailored to our specific relationships with you where this is useful to provide you with a full picture of how we collect and use your Personal Information. This Privacy Policy supplements – but doesn’t override – them.

Most of the Personal Information we collect relates to the individual who is taking out a policy (or other individuals, where it’s taken out jointly or otherwise for the benefit of others). We may also ask for Personal Information about other individuals if we need it. For example, if you ask us to provide insurance for someone other than you, such as family members or employees. If you provide us with Personal Information about someone else, we’ll assume that you have their permission, where required. We’ll process their Personal Information according to this Privacy Policy so please encourage them to read it if they want to find out more.

In connection with the purposes set out above, we will sometimes share Personal Information with Aviva group companies and third parties, including:

• Insurance brokers, financial advisers and business partners who help us arrange, manage and underwrite our products and who provide insurance services;
• The relevant third party if they are making a claim against you;
• Other insurers (either directly or via those acting for the insurer);
• Our insurers or reinsurers (either directly or through insurance brokers), who provide reinsurance services to us and each other in respect of risks underwritten by Aviva, or insurers who cover Aviva under our group insurance policies. We can supply on request further details of the insurers and reinsurers we provide your Personal Information to and how this may be used. If you require further details, contact us;
  
• Third parties who provide you with services relating to your product, e.g. roadside assistance providers, travel assistance providers and healthcare providers;
• Third parties who provide us, or a third party insurer relevant to your product or claim, with services, e.g. loss adjusters, claims handlers, assistance providers, third-party case managers handling your care or treatment pathway, experts and, in limited circumstances, private investigators; 
• Medical professionals, if we need to access health records or assessments for the purposes of handling claims;
• Legal advisers, accountants, financial institutions, auditors and professional service firms who act on our or your behalf, or who represent a third-party claimant;
• Data analysts and providers of data services who support us with developing our products and prices;
• Third parties that help us maintain the accuracy of our data, e.g. by identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details;
• Financial crime detection agencies, financial services organisations, sanctions checking providers and third parties who maintain fraud detection databases or provide assistance with investigation in cases of suspected fraud;
• Regulators who regulate how we operate, including the FCA, PRA, FOS, HMRC, ICO, the Advertising Standards Authority, CBI and any other applicable regulators in your country of domicile;
• Government agencies and regulatory bodies including the police, courts, DVLA, DVA, DVSA and the DWP;
• Debt advisers, including where breathing space is requested on outstanding debts;
• Insurance industry bodies, including the Association of British Insurers and the MIB; 
• Credit reference agencies;
• Service providers, including those who help operate our IT and back office systems, underwriting and claims processes and our information security controls;
• Third party payment service providers, including Adyen NV, who process card and other payments for us. For full details of how Adyen use your Personal Information when completing a transaction please refer to their privacy policy;
• Medical professionals, if we need to access health records or assessments for the purposes of arranging and underwriting certain products or facilitating and handling claims;
• Clinicians, including hospitals and third party case managers from whom you and others covered under the policy receive insured treatment or who manage your care or treatment pathway;
• Research agencies and providers of market research services, including customer feedback surveys; and
• Third parties in connection with any sale, transfer or disposal of our business. 

Some of the organisations we share information with may be located outside of the UK and the EEA. For further information, please see the section on International Data Transfers.

We use your Personal Information and Personal Information about other individuals associated with your policy, to detect and prevent fraud and other financial crime, including to meet our statutory and regulatory responsibilities in relation to fraud and financial crime.

If you’re making an application or a claim, we may use profiling and other forms of automated processing to assess the probability that your application or claim may be fraudulent. This assessment may involve the use of Sensitive Personal Information or criminal data. For example, we may use your past motoring convictions for motoring insurance or details of any convictions relating to fraud or dishonesty. See Automated Decision Making for further details.

We may also use your Personal Information including details of our interactions with you to help us detect fraud committed by brokers or financial advisers or to identify where you or a third party may be at risk of fraud or other financial crime.

To prevent, detect and investigate fraud and other financial crime, we:

• check public registers (e.g. the electoral roll or registers of county court judgments, bankruptcy orders or repossessions);
• conduct online searches from websites, social media and other information-sharing platforms;
• use databases managed by credit reference agencies, insurance industry bodies, fraud detection agencies and other reputable organisations. This includes National Sira administered by Synectics Solutions Limited (as joint data controller together with contributing companies, including Aviva), Experian whose Privacy Policy can be viewed here and the IFB whose Privacy Policy can be viewed here; and
• share Personal Information and undertake searches with other third parties, including other insurers, fraud prevention agencies, law enforcement agencies, public bodies and our regulators (which include the FCA, PRA, ELTO, CBI, MIB and ICO).

This will help us verify your identity, make decisions about providing you with our products and related services, e.g. paying claims and trace debtors or beneficiaries. 

If you give us false or inaccurate information and we suspect fraud, we’ll record this to prevent further fraud and money laundering. This may be shared between insurers and with fraud prevention agencies and databases.

We can supply on request further details of the agencies and databases we access or contribute to and how this information may be used. If you require further details, please contact us using the details below.

For details relating to information held about you by the DVLA please visit https://dvla.gov.uk/ (in relation to motor insurance, UK domiciled customers only).

How your Personal Information is used and shared by insurers and databases in relation to motor and home insurance (UK domiciled customers only)

The Personal Information you provide will be used by us and shared with other insurers as well as certain statutory and other authorised bodies for:

• Insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:
  • consider whether to accept the relevant risk;
  • make decisions about the provision and administration of insurance and related services for you (and members of your household);
  • validate your (or any person or property likely to be involved in the policy or claim) claims history (at any time including upon application for insurance, in the event of an accident, incident or a claim, or a mid-term adjustment, or at a time of renewal).
• Management information purposes. To analyse insurance and other markets for the purposes of:
  • portfolio assessment;
  • risk assessment;
  • performance reporting;
  • management reporting.
• Anti-Fraud purposes. To detect and prevent fraudulent claims and/or activities by:
  • sharing information about you with other organisations and public bodies including the police;
  • tracing debtors or beneficiaries, recovering debt, managing your accounts and/or insurance policies;
  • undertaking fraud searches. Insurers pass information to fraud prevention agencies and databases including National Sira, the CUE Register and where appropriate the Motor Insurance Anti-Fraud and Theft Register by MIB. This helps insurers check information and prevent fraudulent claims. When we deal with your request for insurance we may search these registers. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
• Compliance with legal obligations and responsibilities, including:
  • claims management – In the event of a claim we may need to disclose information with any other party involved in that claim, e.g. third parties involved in the incident, their insurer, solicitor or representative and medical teams, the police or other investigators. We also may have to investigate your claims and conviction history;
  • complaints management – If you make a complaint about the service we have provided, we may be obliged to forward details about your complaint, including your Personal Information, to the relevant ombudsman.
  • in relation to motor insurance, information about your insurance policy will be added to the MID managed by the MIB. MID and the data stored on it may be used by certain statutory and/or authorised bodies including the police, the DVLA, the DVA, the IFB and other bodies permitted by law. This information may be used for purposes permitted by law, which include:
    • electronic licensing;
    • continuous insurance enforcement;
    • law enforcement (prevention, detection, apprehension and/or prosecution of offenders);
    • the provision of government services and/or other services aimed at reducing the level and incidence of uninsured driving.

If you are involved in a road traffic accident (either in the UK, the European Economic Area or certain other territories), insurers and/or the MIB may search the MID to obtain relevant information.

Individuals who may be citizens of other countries or their appointed representatives making a claim in respect of a road traffic accident may also obtain relevant information which is held on the MID. It is vital that the MID holds your current registration number. If it is incorrectly shown on the MID you are at risk of having your vehicle seized by the police and/or a fixed penalty notice.

You can check that your current registration number details are shown on the MID at https://www.askmid.com/

How your Personal Information will be processed (in relation to motor insurance, UK domiciled customers only)

• Information which is supplied to fraud prevention agencies and databases, e.g. National Sira, MIB and MID can include details like your name, address and date of birth.
• Your data may be supplied to databases in order to facilitate automatic no claim discount validation checks.
• Your data may be transferred to any country, including countries outside of the UK and European Economic Area, for any of the purposes mentioned above.
• Under your policy you must tell us about any incident (e.g. an accident or theft) which may or may not give rise to a claim. When you tell us about an incident, we will pass information relating to it to the fraud prevention agencies and databases, e.g. MIB.

You can ask for more information about this. If you require such information, please contact us using the details below.

How we use your Driving Licence Number (in relation to motor insurance, UK domiciled customers only)

We collect your Driving Licence Number (DLN) for insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:

• Provide your (or any person included on the proposal) DLN to the DVLA to confirm your (or the relevant person included on the proposal) licence status, entitlement and relevant restriction information and endorsement/conviction data. Searches may be carried out prior to the date of the insurance policy and at any point throughout the duration of your insurance policy including at the mid-term adjustment and renewal stage. A search of the DLN with the DVLA should not show a footprint against your (or another relevant person included on the proposal) driving licence.
• Searches may be carried out at point of quote and, if an insurance policy is incepted, if any changes are made mid-term, and at renewal stage.

Please note that if you give us false or inaccurate information it may invalidate your insurance policy/prospective insurance policy or it could affect the amount we pay to settle any claims you make under the policy.

To ensure we have the necessary facts to assess your insurance risk, verify your identity, help prevent fraud and provide you with our best premium and payment options, we may need to obtain information relating to you at quotation, renewal and in certain circumstances where policy amendments are requested. We or our agents may undertake checks against publicly available information (e.g. the electoral roll, county court judgments, bankruptcy orders or repossession(s)). Similar checks may be made when assessing claims.

Information about the credit reference agency we use and the ways in which they use and share Personal Information, are explained in more detail on the TransUnion website.

We may use automated processes to make decisions. These automated processes use data provided by you, other records we hold about you in our systems and data sourced from third parties to make predictions, including the likelihood that a claim will be made and its value, the likelihood a product will be purchased and the likelihood that a claim might be fraudulent. This helps us to determine eligibility for a policy, the terms of the policy, the price, and whether we can provide you with a monthly credit payment option.

In relation to home insurance only, in order to provide you with a price for your policy, the following steps may be taken:

• Information about you: The first step is that we know who you are and what you are looking to have insured, e.g. details about your property. 
• We enrich the information: We carry out checks to validate your information (e.g. confirming your identity) and enrich it with data from third party sources. Information on the third party data sources we use is set out above in Types of Personal Information collected. For example, we use your address to source additional information on the area you live in, such as the distance of your property from a fire station.
• We calculate your insurance risk: We use statistical modelling techniques to assess the information in order to predict the likelihood that a claim will be made and the likely severity of a claim. This assessment is based on various factors including information about the area you live in such as the likelihood of crime. For example, if you live in an area with high property crime this may lead to a higher premium. All insurers will use different weightings to price insurance and this is confidential to each insurer.
• Provision of the final price: Once we have a view of your insurance risk we can provide you with a final price, which will include any commission payments and applicable tax.

We may also make automated decisions throughout the life of your policy, e.g. before offering you a renewal or when dealing with a claim.

Where we make an automated decision using Personal Information which has a legal or substantially similar effect, you have certain rights in relation to that decision. In particular, you have the right to receive meaningful information about the logic involved in relation to the decision, the right to human intervention and the right to obtain an explanation of the decision and challenge it. For more information about this right and how to exercise it please see the section on Data Rights below.

We use profiling and other data analysis to build, train and audit insurance models and algorithms (including those used in our Automated Decision Making) and our machine-learning tools. The models, algorithms and tools we use help us do a number of things including:

• understanding our customers and potential customers better, e.g. how they feel about Aviva, what kind of content or products would be of most use and interest to them, whether they might be displaying characteristics meaning that they may require additional support from us;
• managing claims e.g. determining liability, valuing claims;
• monitoring and improving our services e.g. looking at how to prevent complaints; and
• predicting the likelihood of events arising to assess insurance risk, the likelihood a product will be purchased or to predict if a claim might be fraudulent.

We use a number of data items as described in this Privacy Policy for these purposes. Before we use any such data, we carry out checks, including ensuring there are no legal restrictions on using the data under data protection laws, the Equality Act 2010 or under FCA rules, and we consider whether use of the data might cause outcomes that are unfairly or unlawfully biased. We then use statistical modelling techniques to assess the data to ensure that the data tells us something meaningful. From time to time, we may share your Personal Information with third parties who provide us with new data which we will test to understand if such new data provides additional understanding.

One technique we may use is natural language processing. Natural language processing is a machine learning tool that involves reading, understanding and analysing speech and text. We may use this tool to help us with the purposes listed above e.g. we may use it to assess how you are feeling about Aviva based on the words that you use to communicate with us.

We may also use profiling and data analysis for other reasons, e.g.to ensure data quality and accuracy and to help us improve our business. 

The purpose of this analysis is not to make decisions about you directly, but your Personal Information, in combination with Personal Information relating to other customers, potential customers and/or data provided by third parties, will be used to conduct data analysis so that we can improve our processes, our products and services and check the way our models, algorithms and machine-learning tools work. The Personal Information you submitted to obtain a quote from us may be used for this analysis whether or not you decided to purchase the product.

Where possible, we pseudonymise the Personal Information in order to perform this analysis. This means that we remove information from which you can be directly identified, e.g. your name, and replace it with a pseudonym or unique identifier. We do this to maximise the security of your information.

We keep Personal Information for as long as is reasonably required for the purposes explained in this Privacy Policy. We also keep records – which may include Personal Information – to meet legal, regulatory, tax or accounting needs. For example, we are required to retain an accurate record of your dealings with us, so we can respond to any complaints or challenges you or others might raise later. We’ll also retain files if we reasonably believe there is a prospect of litigation. The specific retention period for your Personal Information will depend on your relationship with us and the reasons we hold your Personal Information.

To support us in managing how long we hold your data and our record management, we maintain a data retention policy which includes clear guidelines on data retention and deletion.

If you would like more information about our data retention policy, please contact us.

Sometimes we, or third parties acting on our behalf, may need to transfer Personal Information outside of the UK or European Economic Area (EEA). We’ll always take steps to ensure that any transfer of Personal Information outside the UK or EEA is carefully managed to protect your privacy rights and ensure that adequate safeguards are in place. This might include transfers to countries that the UK or EEA considers will provide adequate levels of data protection for your Personal Information or putting contractual obligations in place with the party we are sending information to. Transfers within the Aviva group will be covered by an agreement entered into by members of the Aviva group (an intra-group agreement) which contractually obliges each group company to ensure that your Personal Information receives an adequate and consistent level of protection wherever it is transferred within the group.

For more information about data transfers and the safeguards we have put in place, please contact us using the details below.

You have legal rights under data protection laws in relation to your Personal Information. Read below to learn more about each right you may have.

We may ask you for proof of identity when you make a request to exercise any of these rights. We do this to ensure we only disclose information to the right individual.

We aim to respond to all valid requests within one month. It may take us longer if the request is particularly complicated or you have made several requests. We’ll always let you know if we think a response will take longer than one month. We may also ask you to provide more detail about what you want to receive or are concerned about.

We may not always be able to do what you have asked. This is because your rights will not always apply, e.g. if it would impact the duty of confidentiality we owe to others, or if the law allows us to deal with the request in a different way. We will always explain to you how we are dealing with your request. In some circumstances (such as the right to erasure or withdrawal of consent), exercising a right might mean that we can no longer provide our product to you.

For further information about or to exercise any of your rights, please contact us using the details below.

Your rights are as follows:

If you have any questions about this Privacy Policy or how to exercise your rights, please contact our Data Protection Officer: 

Write to: The Data Protection Team, Aviva, PO Box 7684, Pitheavlis, Perth PH2 1JR

Email us: DATAPRT@aviva.com

If you'd like to submit a subject access request, please fill out this form or write to us at the above address.

If you’re not happy with the way we’re handling your Personal Information, you have a right to make a complaint with your local data protection supervisory authority at any time.

• UK: Information Commissioner's Office (ICO);
• Ireland: Office of the Data Protection Commissioner (DPC);
• France: Commission Nationale de l’Informatique et des Libertés (CNIL);
• Italy: Garante per la Protezione dei Dati Personali (GPDP);
• Spain: Agencia Española de Protección de Datos (AEPD);
• Principality of Monaco: Commission de Contrôle des Informations Nominatives (CCINN);

We ask that you please attempt to resolve any issues with us before contacting your data supervisory authority.

This Privacy Policy is updated from time to time to take account of changes in our business activities, legal requirements and to make sure it’s as transparent as possible, so please check back here for the current version. You can see when this Privacy Policy was last updated by checking at the top of this page.