Other Parties Privacy Policy

We obtain Personal Information directly from you, including, if you are a broker or other service provider, from application forms you complete, and if you are a claimant from claims forms you complete, communications between us, your participation in promotions and market research, your use of our apps and websites and details from the devices you use to interact with our apps and websites. 

We may also receive your information from our policyholders e.g. when:

• you are witness to an incident;
• you are a claiming against one of our policyholders;
• one of our policyholders is claiming against you;
• you are providing your professional services to any of these parties, e.g. as a medical expert.

We also may obtain Personal Information from third parties, including the following:

• Third parties involved in the relevant insurance policy or claim, including any relevant overseas insurance partner, other insurers, brokers, financial advisers, banks, assistance providers, claimants, defendants and witnesses to an incident; 
• Third parties who provide us, a third party insurer relevant to your product or claim or a relevant overseas insurance partner, with services, e.g. loss adjusters, claims handlers, legal advisers, assistance providers, experts and, in limited circumstances, private investigators; 
• Healthcare providers;
• Aviva group companies;
• Financial crime detection agencies, databases and sanctions lists, including the Claims Underwriting Exchange (CUE), Motor Insurance Database (MID) and Insurance Fraud Bureau (IFB);
• Government agencies and regulatory bodies, including the police, the courts, Driver and Vehicle Licensing Agency (DVLA), Driver and Vehicle Standards Agency (DVSA), Department for Work and Pensions (DWP), Companies House and HM Revenue & Customs (HMRC);
• Regulators who regulate how we operate including the Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), Information Commissioner’s Office (ICO) and the Financial Ombudsman Service (FOS);
• Regulators who regulate how you operate including the General Medical Council and the Solicitors Regulation Authority;
• Industry bodies, including the Association of British Insurers and the Motor Insurers’ Bureau (MIB); 
• Third parties that help us maintain the accuracy of our data e.g. by identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details; 
• Other third party suppliers, actuaries, auditors, legal advisers and other professional service firms and sanctions-checking service providers;
• Data suppliers, e.g. Experian and LexisNexis;
• Publicly available sources including the Office for National Statistics (e.g. census data) and other data made available under the Open Government Licence internet searches, news articles, online marketplaces and social media sites, apps and networks (e.g. Twitter, Facebook and Instagram);
• Third parties in connection with any acquisition of a business by us.

The Personal Information we hold and process will depend on our relationship with you. If you are a claimant claiming against one of our policyholders or claiming against one of our overseas insurance partners, we may collect detailed information about you and your claim. However, if you are an individual at a company who is providing services to us, e.g. a broker or a medical expert, the Personal Information we hold about you will be a lot more limited. We have set out some examples of the Personal Information we may hold, depending on our relationship with you below.

Information provided by you or third parties, including:

• General data – includes your name, date of birth, marital status, country of residence/citizenship and your relationships to other people, e.g. family members if relevant to our relationship with you;
• Contact data – includes your address, telephone number and e-mail address;
• Identification data – includes government issued identification numbers e.g. your national insurance number, passport number, driving licence number and other identifiers e.g. usernames and social media identifiers;
• Appearance and behavioural data – includes your gender, age, general interests, dietary preferences, descriptive data e.g. your height, images, demographic data and behavioural data;
• Fraud and sanctions related data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources such as newspapers and social media sites and information obtained from checks of fraud databases and sanctions lists such as relationships/close associations with politically exposed persons;
• Education and employment-related data – includes your education, vocational and professional qualifications, employment status, job title and employment and educational history;
• Financial data – includes credit and payment card numbers (including updated card information provided by card issuers when changes are made), bank account details, payment information, tax information and details of income and assets;
• Vulnerability data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that we can better meet your needs;
• Authentication data – includes account log-in information, passwords and memorable data for accessing your Aviva accounts;
• Telephone recordings and live chat transcripts – information obtained during recordings of telephone calls or live chats with our representatives and call centres;
• Marketing and communication preferences, promotion entries and customer feedback – includes marketing and communication preferences, information relating to promotions and prize draws, responses to surveys, complaints and details of your customer experience;
• Accurate contact data, e.g. where you have moved address, changed your telephone number or started using a new email address and not yet advised Aviva. This data may be used to ensure that we have a complete understanding of your product holding and to provide you with communications about your products. It will not be used for direct marketing purposes unless it was collected by the third party expressly for that purpose and always in accordance with data protection law.

If you are a witness, third party claimant, claiming against an Aviva policyholder or against one of our overseas insurance partners, or have otherwise caused the policyholder a loss, we may also collect:

• Detailed information about your claim from you, the policyholder, any witnesses, experts and third party service providers; 
• Vehicle and driving-related data - includes driving licence entitlement and restrictions or endorsements, driving convictions, third party insurance details, vehicle details including registration number and MOT details, vehicle ID number and digital location ID and dashcam footage if relevant to your claim.

Information collected from your devices, including:

• Mobile device number, device type, operating system, browser, serial number, MAC address, IP address, location and account activity obtained through our use of cookies. You can find more about our use of cookies in our Cookie Policy.

Information already held by Aviva, including:

• Data relating to previous Aviva interactions – e.g. policy and claim histories relating to existing Aviva policies or products or those you may have held in the past.

Information inferred from your Personal Information, including:

• Appearance and behavioural data – includes your general interests, descriptive data and behavioural data e.g. to allow us to make certain predictions and assumptions about your interests, which allows us to personalise your experience with us;
• Vulnerability data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that we can better meet your needs;
• Fraud and sanctions-related data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources, such as newspapers and social media sites and checks of fraud databases and sanctions lists.

Children’s data:

• We collect data about children in some circumstances e.g. where a child is a claimant.

Sensitive Personal Information

Sometimes we will request or receive Personal Information that is sensitive and we call this “Sensitive Personal Information”. This is information relating to your health, genetic or biometric data, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership. It also covers criminal offence data, including information about criminal activity, allegations (including those unproven), investigations, proceedings and penalties. For example, to investigate a bodily injury claim, we’ll need to ask you to provide details of the injury. We know how sensitive this data is, so protecting it is a top priority. The types of Sensitive Personal Information we hold and process where relevant include:

• Health data – includes details of existing and previous physical or mental health conditions, health status, test results, medical diagnoses and treatment;
• Criminal data – includes details of convictions, e.g. in relation to detecting and preventing fraud;
• Other sensitive data – in limited circumstances we may process other Sensitive Personal Information. For example, we may process information relating to your religious beliefs where relevant to your preferences regarding medical treatment.

The main purposes for which we use Personal Information are to:

• Communicate with you and other individuals;
• Make assessments and take decisions, including whether to pay your claim or pursue any losses against you or a third party;
• Provide our products and services, including insurance administration, claims assessment, settlement and dispute resolution and the provision of our apps and other technologies;
• Manage relationships with third parties, e.g. brokers and service providers, including, if you are a corporate client, broker or a service provider, we may use your Personal Information to organise conferences and entertainment;
• Prevent, detect and investigate fraud and other crime, including by carrying out fraud, sanctions and anti-money laundering checks. For further information see Fraud and Other Financial Crime;
• Improve our products and services, provide staff training and maintain information security, including by recording and monitoring telephone and online calls and screen sharing sessions;
• Provide marketing information and run promotions in accordance with preferences you have expressed. For further information see the section on Marketing;
• Conduct customer insight analysis, market research and focus groups, including customer segmentation, campaign planning, creating promotional materials, gathering customer feedback and customer satisfaction surveys;
• Help us better understand our customers and improve our customer engagement, including noting your interest in our website, profiling and analytics which allows us to make certain predictions and assumptions about your interests, improve our products and to suggest other products which may be relevant or of interest to you where applicable;
• Carry out data analysis, including to ensure data accuracy and quality and for insurance risk modelling and product and pricing refinement. For further information see Profiling and Data Analysis;
• Manage complaints, including to allow us to respond to any current complaints, or challenges you or others might raise later, for internal training and monitoring purposes and to help us to improve our complaints handling processes. We may be obliged to forward details about your complaints, including your Personal Information, to the appropriate authorities, e.g. the relevant ombudsman;
• Manage feedback and queries, and handle requests to exercise data subject rights. For further information see Data Rights;
• Manage our business operations, including by carrying out internal audits, quality assurance and training, financial analysis and accounting, producing management information and performing administrative activities in connection with the services we provide;
• Manage commercial risk, including by taking out and maintaining appropriate insurance and reinsurance;
• Comply with applicable legal, regulatory and professional obligations, including cooperating with regulatory bodies, e.g. the FCA, PRA, ICO and government authorities, to comply with law enforcement and to manage legal claims;
• Identify and support individuals requiring additional support, to help us better meet your needs and to comply with regulatory guidance about how we meet your needs. Sometimes you or a third party may tell us that you have additional support requirements, and in other cases we may infer this from your Personal Information and our interactions with you;
• Establish, enforce and defend our legal rights or those of third parties, including enforcing our terms and conditions, pursuing available remedies and limiting our damages; 
• Carry out activities that are in the public interest, e.g. we may need to use Personal Information to carry out anti-money laundering checks;
• Buy, sell, transfer or dispose of any part of our business;
• Archiving, scientific or historical research or statistical purposes.

We are committed to collecting and using Personal Information in accordance with applicable data protection laws. By law, we must have a legal justification, known as a lawful basis, in order to use your Personal Information for the purposes described in this Privacy Policy. Depending upon the purpose, our lawful basis will be one of the following:

• Performance of a contract – to arrange, underwrite or manage our products, or handle claims in accordance with their terms;
• Compliance with a legal obligation – to meet responsibilities we have to our regulators, tax officials, law enforcement, or other legal responsibilities;
• Legitimate interests – to operate and improve our products and services and keep people informed about our products and services or for any other purposes we identify as appropriate to our business needs, or those business needs of a third party;
• Consent – where we have obtained appropriate consents to collect or use your Personal Information for a particular purpose.

Where we rely on legitimate interests as our lawful basis, we are required to carry out a balancing test to ensure that our interests, or those of a third party, do not override the rights and freedoms that you have as an individual. The outcome of this balancing test will determine whether we can use your Personal Information for the purposes described in this Privacy Policy. Where we rely on the lawful basis of legitimate interests, the interests being relied upon will usually be:

• To further our business and commercial activities and objectives, or those of a third party, e.g., to provide our products and services and produce management information on our performance and the performance of third parties;
• To send you marketing information in accordance with your preferences, e.g. about products and services we offer, and to administer promotions that you enter;
• To comply with our legal and regulatory obligations, guidelines, standards and codes of conduct, e.g., background checks or the prevention, detection and investigation of financial crime or fraud;
• To improve and develop our business, products and services, or those of a third party, e.g. to ensure the accuracy of customer data and develop our pricing and risk methods and models;
• To retain records for a period of time in order to ensure we have appropriate records in place in respect of any future claims that may be made against us;
• To safeguard our business, shareholders, employees and customers, or those of a third party, e.g., maintaining the security of our IT network and information, enforcing claims, including debt collection;
• To facilitate the purchase, sale, transfer or disposal of any part of our business; and
• To analyse and assess competition in the market for our products services, e.g., by carrying out market research.

We can only collect and use Sensitive Personal Information where we have an additional, specific lawful basis to process such information. We usually rely upon one of the following lawful bases where we process Sensitive Personal Information:

• Reasons of substantial public interest:
  • insurance purposes – including advising on, arranging, underwriting and administering contracts of insurance, administering claims under a contract of insurance and exercising rights, or complying with obligations that arise in connection with contracts of insurance;
  • complying, or helping someone else comply with, a regulatory requirement relating to unlawful acts and dishonesty - including regulatory requirements to carry out money laundering checks;
  • preventing or detecting unlawful acts – including disclosures to competent authorities;
  • preventing fraud – including investigating alleged fraud;
  • safeguarding the economic well-being of certain individuals – including where we identify additional support required by our customers;
  • equality of opportunity or treatment – including where we need to keep under review the equality of treatment of individuals with additional support needs.
• Necessary to establish, exercise or defend a legal claim – including where we are faced with legal proceedings, we bring legal proceedings ourselves or where we are investigating legal proceedings that a third party has brought against you;
• Necessary to protect your vital interests or those of another individual;
• Information has been clearly or obviously made public by you.

Where we cannot rely on one of the above lawful bases to process your Sensitive Personal Information for a particular purpose, we will seek your explicit consent.

If you would like to know more about the lawful bases we rely upon, or how the lawful basis of legitimate interests applies to a particular purpose, you can contact us.

The Personal Information you provide will be used by us and shared with other insurers as well as certain statutory and other authorised bodies for:

• Insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:
  • Consider whether to accept the relevant risk,
  • Make decisions about the provision and administration of insurance and related services for you (and members of your household),
  • Validate your (or any person or property likely to be involved in the policy or claim) claims history (at any time including upon application for insurance, in the event of an accident or a claim, or mid-term adjustment, or at a time of renewal).
• Management Information purposes. To analyse insurance and other markets for the purposes of: 
  • Portfolio assessment,
  • Risk assessment,
  • Performance reporting,
  • Management reporting.
• Anti-fraud purposes. To detect and prevent fraudulent claims and/or activities by:
  • Sharing information about you with other organisations and public bodies including the police;
  • Tracing debtors or beneficiaries, recovering debt, managing your accounts and/or insurance policies;
  • Undertaking fraud searches. Insurers pass information to fraud prevention agencies and databases including the Claims Underwriting and Exchange Register and where appropriate the Motor Insurance anti-Fraud and Theft Register by MIB. This helps insurers check information and prevent fraudulent claims. When we deal with your request for insurance we may search these registers.
• Compliance with legal obligations and responsibilities, including:
  • Claims management – In the event of a claim we may need to disclose information with any other party involved in that claim, e.g. third parties involved in the incident, their insurer, solicitor or representative and medical teams, the police or other investigators. We also may have to investigate your claims and conviction history;
  • Complaints management – If you make a complaint about the service we have provided, we may be obliged to forward details about your complaints, including your Personal Information, to the relevant ombudsman;
  • Information about your insurance policy will be added to the Motor Insurance Database (MID) managed by the MIB. MID and the data stored on it may be used by certain statutory and/or authorised bodies including the police, the DVLA, the DVA, the IFB and other bodies permitted by law. This information may be used for purposes permitted by law, which include:
    • Electronic Licensing;
    • Continuous insurance enforcement;
    • Law enforcement (prevention, detection, apprehension and/or prosecution of offenders);
    • The provision of government services and/or other services aimed at reducing the level and incidence of uninsured driving.

If you are involved in a road traffic accident (either in the UK, the European Economic Area or certain other territories), insurers and/or the MIB may search the MID to obtain relevant information.

Individuals who may be citizens of other countries or their appointed representatives making a claim in respect of a road traffic accident may also obtain relevant information which is held on the MID. It is vital that the MID holds your current registration number. If it is incorrectly shown on the MID you are at risk of having your vehicle seized by the police and/or a fixed penalty notice.

You can check that your current registration number with the MID.

How your Personal Information will be processed

• Information which is supplied to fraud prevention agencies and databases, e.g. MIB and MID can include details like your name, address and date of birth.
• Your data may be supplied to databases in order to facilitate automatic no claim discount validation checks.
• Your data may be transferred to any country, including countries outside of the European Economic Area, for any of the purposes mentioned above.
• Under your policy you must tell us about any incident (e.g. an accident or theft) which may or may not give rise to a claim. When you tell us about an incident, we will pass information relating to it to the fraud prevention agencies and databases, e.g. MIB.

You can ask for more information about this. If you require such information, please contact us.

How we use your Driving Licence Number

Insurance underwriting purposes i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:

• Provide your (or any person included on the proposal) Driving Licence Number (DLN) to the DVLA to confirm your (or the relevant person included on the proposal) licence status, entitlement and relevant restriction information and endorsement/conviction data. Searches may be carried out prior to the date of the insurance policy and at any point throughout the duration of your insurance policy including at the mid-term adjustment and renewal stage. A search of the DLN with the DVLA should not show a footprint against your (or another relevant person included on the proposal) driving licence;
• Searches may be carried out at point of quote and, if an insurance policy is incepted, if any changes are made mid-term, and at renewal stage.

Please note that if you give us false or inaccurate information it may invalidate your insurance policy/prospective insurance policy or it could affect the amount we pay to settle any claims you make.

The data you provide will be used by us and shared with other insurers as well as certain statutory and other authorised bodies for:

• Insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:
  • consider whether to accept the relevant risk;
  • make decisions about the provision and administration of insurance and related services for you and members of your household;
  • validate your (or any person or property likely to be involved in the policy or claim) claims history (at any time, including upon application for insurance, in the event of an incident or a claim, or mid-term adjustment, or at a time of renewal).
• Management information purposes, i.e. to analyse insurance and other markets for the purposes of:
  • portfolio assessment;
  • risk assessment;
  • performance reporting;
  • management reporting.
• Anti-fraud purposes i.e. to detect and prevent fraudulent claims and/or activities by:
  • sharing information about you with other organisations and public bodies including the police;
  • tracing debtors or beneficiaries, recovering debt, managing your accounts and/or insurance policies;
  • undertaking fraud searches. Insurers pass information to the Claims Underwriting and Exchange Register administered by Motor Insurers’ Bureau (MIB). This helps insurers check information and prevent fraudulent claims. When we deal with your request for insurance we may search these registers.
• Compliance with legal obligations and responsibilities, including:
  • Claims management – In the event of a claim we may need to disclose information with any other party involved in that claim, e.g. third parties involved in the incident, their insurer, solicitor or representative and medical teams, the police or other investigators. We also may have to investigate your claims history;
  • Complaints management - If you make a complaint about the service we have provided, we may be obliged to forward details about your complaint, including your Personal Information, to the relevant ombudsman.

You may ask us for a copy of your Personal Information together with specified details about how we use your information. This is commonly known as a ‘subject access request’.

If you wish to make a subject access request, please fill out this form or write to us using the details in Contacting Aviva.

If your request is made electronically, we will, where possible, respond to you electronically. Otherwise, we will normally respond in writing unless you request otherwise.

We do our best to ensure that your Personal Information is accurate and kept up to date. If you believe your information is inaccurate or incomplete, then please contact us to request that we amend or update it.

You may ask us to erase your Personal Information, but this right only applies in certain circumstances, e.g. where:

• it is no longer necessary for us to use your Personal Information for the original purpose; 
• our lawful basis for using your Personal Information is consent and you withdraw your consent; or
• our lawful basis is legitimate interests and there is no overriding legitimate interest to continue using your Personal Information if you object.

This isn’t an absolute right and we have to balance your request against other factors such as legal or regulatory requirements, which may mean we cannot erase your Personal Information.

You may ask us to stop using your Personal Information in certain circumstances such as:

• where you have contacted us about the accuracy of your Personal Information and we are checking the accuracy;
• if you have objected to your Personal Information being used based on legitimate interests.

This isn’t an absolute right and we may not be able to comply with your request.

In some cases, you can ask us to transfer Personal Information that you have provided to us to another third party of your choice. This right only applies where:

• we have justified our use of your Personal Information based on your consent or the performance of a contract with you; and
• our use of your Personal Information is by electronic means.

You can object if you no longer wish to receive direct marketing from us.

You may also object where you have grounds relating to your particular situation and the lawful basis we rely on for using your Personal Information is our (or a third party's) legitimate interests. However, we may continue to use your Personal Information where there are compelling legitimate grounds to do so.

You have the right not to be subject to a decision using your Personal Information which is based solely on automated processing (without human involvement) where that decision produces a legal effect or otherwise significantly affects you. This right does not apply if the decision is:

• necessary for the purposes of a contract between us and you;
• authorised by law (e.g. to prevent fraud); or
• based on your explicit consent.

You do however have a right to request human intervention, express your view and challenge the decision.

In some circumstances we ask for your consent to use your Personal Information. You are free to withdraw your consent at any time.

If it is the case that we need your consent to provide you with a particular product and you wish to withdraw your consent, we may no longer be able to provide our product to you. Where that is the case, we will inform you before taking any action.