Privacy Notice

This section shows what personal information we collect and use about you if you're:

• A prospective customer and have submitted your personal information so we can provide you with an insurance quote^*
• Somebody named on a quote^*
• An existing customer, either as the policy holder or covered by the policy
• Responsible for paying for someone else's policy.
• Acting on behalf of a policyholder.

* Both of these include any quotes obtained from price comparison websites (PCWs). Please note that when you use a PCW to obtain a quote, not only do they retain your personal information, they also pass that information to us so we can offer you Insurance. In many cases, the PCW may also automatically offer you a new quotation on the anniversary of the existing one (see their privacy notice for more details).

3.1.1 The personal information we'll collect and where we'll collect it from

The following information will be collected from you (or anyone applying for a policy on your behalf) online or by phone if relevant to the insurance policy:

• Individual details: Your name, address, former address(es), contact details (e.g. email/telephone), gender, marital status, date of birth, length of time as a UK resident.
• Employment information: Your job title and the nature of the industry you work in.
• Identification details: For example, your driving licence number.
• Previous and current claims: Any previous insurance policies you've held and claims made against those policies.
• Other risk details: Details about the car to be insured, along with these special categories of information relating to each driver:
  • Health data: Physical or mental health information relevant to the insurance application, e.g. DVLA notifiable conditions.
  • Criminal convictions: Any which are unspent under the Rehabilitation of Offenders Act, including any motoring and non-motoring offences/alleged offences committed or any court sentences you're subject to.
• Marketing preferences: This includes whether you've given your consent to receive marketing information.
• Website use, app use including cookies and use of our web chat service: See section 4 below for details.
• Other information: This will be captured during recordings of any telephone calls, other contact with us or if you make a complaint. This may include special categories of information you provide when talking with us. We may capture this information (e.g. your contact details and recordings of the phone call) even if you're not a Hastings Direct customer (for example, if you're calling on behalf of a Hastings Direct policyholder).
• Financial information: Bank and payment information.
• Driving information: Some price comparison websites allow you to share your driving data. If we receive this data, it will be used to offer you a quote, and help us develop and improve our pricing models. If the Hastimgs insurance policy chosen allows for the tracking of your driving as part of the policy, the device used collects a wide range of driving data, when the car is both moving and stationary, such as:
  • Date/time: This helps us to understand what time of day the car is driven.
  • Locational data: To understand what roads are driven and the location of the vehicle when it's moving or stationary including latitude, longitude, heading and direction. It also supports the theft tracking service.
  • Speed, acceleration, cornering and braking data: To understand how smooth the driving style is.
  • Accident detection: This helps us to operate the accident alert service and to understand the circumstances relating to any accident.
  • Mobile phone use: If the driving data is collected by an app on your mobile, the app will record that the mobile is being used in another way, but it will not record any of the specific data or details of the other use.
• Additional identification details: In some situations, we may ask you for further information and/or copies of documents so that we can validate your identity. This may include details about your residency, marital status, address, driving licence details or details of your car. It could also include special categories of information (e.g. driving licence, convictions etc.).
• Claims information: This will be in relation to any incident or alleged incident involving the insured car. This includes special categories of information you give us when talking or writing to us about your claim (we'll only process this to the extent necessary in connection with your claim or in connection with legal proceedings).

We use external sources to supplement and verify the information above. We also use them to provide the following new information, to help us understand you as a customer:

• Credit and anti-fraud data: Credit history and credit score (for example, before we offer the option of monthly payments by direct debit, we will run a credit check). We also collect sanctions and criminal offences, bankruptcy orders, individual voluntary arrangements (IVAs) or county court judgments, and information received from various anti-fraud databases. Some of this information (e.g. criminal offences) may include special categories of information about you.
• Demographic data: Lifestyle indicators such as income, education and the size of your household.
• Open source data: Different types of data which is in the public domain. When proportionate to do so, this will include social media about you or the circumstances of any accident.
• Photo or video data: Includes photos taken of the damage or footage recorded relating to a claim (including accident circumstances and interviews).
• Claims assessment reports: This could be from engineers, medical experts, claims investigators and, in limited circumstances, private investigators. Some assessment reports may include special categories of information about you.
• Other Hastings Group Companies: We may also use information that you provided to other Hastings Group companies.

Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud, money laundering and to verify your identity. We use external sources to supplement and verify the information above, and to provide the following new information:

• Credit and anti-fraud data: Credit history, credit score, sanctions and criminal offences, bankruptcy orders, individual voluntary arrangements (IVAs) or county court judgements, and information received from various anti-fraud databases. Some of this information (e.g. criminal offences) may include special categories of information relating to you.
• Demographic data: Lifestyle indicators such as income, education, and size of your household.
• Open source data: Other information about you that is publicly available.
• Driving data: In relation to previously held policies with any insurer.

The external sources that provide us with information about you include:

• The person applying for the policy (where you're an individual named under a quote) or anyone authorised to act on your or their behalf.
• Other insurance companies.
• Other third parties involved in the insurance application process, such as the price comparison website used or other insurers.
• Credit reference agencies.
• Providers of demographic data and vehicle data.
• Financial crime detection agencies and insurance industry financial crime databases (such as for fraud prevention and checking against international sanctions) including the Claims and Underwriting Exchange (known as 'CUE'), CIFAS and the Insurance Fraud Bureau (IFB). The IFB website can be accessed at www.insurancefraudbureau.org.
• Insurance industry bodies and databases (including but not limited to the Motor Insurance Anti-Fraud and Theft register and the No Claims History database).
• Other Hastings Group companies
• In the event of a claim:
  • Other parties involved in any claim, including passengers, witnesses and any third party claimants or their insurers.
  • Third party suppliers who help us provide services when a claim is made (such as external claims handlers, our repair network, medical experts, claims investigators and private investigators).
• Third party suppliers we use to help us to carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, debt collection agencies, document management providers, outsourced business process management providers, our subcontractors and tax advisors.
• Government agencies and bodies such as the DVLA or regulators where required (e.g. the Financial Conduct Authority).
• Publicly available sources (e.g. the electoral roll, court judgments, insolvency registers, internet search engines, news articles) and sources licensed under the Open Government Licence v 3.0.
• Other third parties involved in your insurance policy or a claim (e.g. other insurers).
• Our reinsurers.

Under our User Agreement with the Motor Insurance Bureau, our individual customer representatives don't have access to the data returned by a driving licence number search (DLN) and won't be able to discuss issues relating to your DLN with you. In these cases, we suggest you check the information associated with your DLN is correct at www.gov.uk/view-driving-licence.

Also, if you provide us with a DVLA check code for a named driver on your policy, it is your responsibility to ensure that you have their permission.

3.1.2 What we use your personal information for

We may process your personal information for a number of different purposes. We must have a legal ground for each purpose and we'll rely on the following grounds:

• We need your personal information because it is necessary to enter into or perform a contract (e.g. you request a quote with a view to entering into an insurance contract).
• We have a legitimate interest to use your personal information. For example, to keep a record of the decisions we make when different types of applications are made (e.g. if you request a quotation or changing details of a policy), keep business records, carry out strategic business analysis, review our business planning, or develop and improve our products and services. When using your personal information in this way, we'll always consider your rights and interests.
• We have a legal or regulatory obligation to use your personal information (e.g. to meet the record-keeping requirements of our regulators).

We must have an additional legal ground for processing special categories of information. We'll rely on the following:

• It's in the substantial public interest and it's necessary for an insurance purpose (e.g. assessing your insurance application and managing claims) or to prevent and detect an unlawful act (e.g. fraud).
• To establish, exercise or defend legal claims (e.g. when legal proceedings are being brought or threatened against us or we want to bring a legal claim ourselves).
• Where we have asked for your explicit consent (e.g. if you are unable to pay a debt due to a medical condition or illness).

See the table below. Where we've used the acronym PH this refers to the policyholder of any insurance product. In the case of vehicle insurance, ND refers to any named driver on the quote and TPP (third party payer) to a person who is just responsible for paying for the policy, and TP (third party) to a person who isn't insured by Hastings Direct but may have had an accident with our policyholder, or is acting on behalf of a policyholder.

3.1.3 Who we'll share your personal information with

We'll share personal information within Hastings Group Holdings and/or the following third parties, for the purposes laid out in the table above:

• Credit reference agencies, including debt collection agencies when required. More information about CRAs and how they use personal information is available at https://www.TransUnion.co.uk/crain, https://www.equifax.co.uk/crain and https://www.experian.co.uk/crain
• Finance institutions to allow us to carry out a financial transaction for your policy. For example, in order to process payments from your debit or credit card, we share your personal, card and transaction details with our payment processing provider, Worldpay. Worldpay acts as a controller of your data under the terms of its own Privacy notice which can be found on its corporate website.
• Other insurers and/or brokers who support our products (e.g. our motor legal protection provider or providers of any optional extras bought alongside your policy) or are involved in a claim.
• Our providers who need your information to provide a service to you (e.g. claims services, our repair network, optional extra products, repair quotes etc.).
• Providers of demographic data and vehicle data.
• Financial crime detection agencies and insurance industry financial crime databases (such as for fraud prevention and checking against international sanctions) including the Claims and Underwriting Exchange (known as 'CUE'), CIFAS and the Insurance Fraud Bureau (IFB). The IFB website can be accessed at www.insurancefraudbureau.org.
• The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. For more information on how Cifas use your information, please see their Fair Processing Notice at www.cifas.org.uk/fpn.
• Insurance industry bodies and databases (including but not limited to the Motor Insurance Anti-Fraud and Theft register and the No Claims History database).
• Government agencies and bodies such as the DVLA, Department for Work & Pensions, or regulators (e.g. Financial Conduct Authority).
• Other third parties involved in the insurance application process such as the price comparison website used or other insurers.
• Third party suppliers we use to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, debt collection agencies, document management providers, outsourced business process management providers, our subcontractors and tax advisors.
• The police and other crime prevention and detection agencies. We and fraud prevention agencies may enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
• Selected third parties in connection with any sale, transfer or disposal of our business.
• Where you've bought a policy using an introductory cash back incentive code or link or claim a reward through one of the price comparison websites, the relevant incentive provider.

Sharing of motor vehicle driving data: Once you've taken a driving policy where collecting your driving behaviour is part of the contract and you've activated the device, it will record and provide us with data about your driving style. It will collect a wide range of driving data such as date, time, location, speed, acceleration, cornering and braking. If the device is an app on a mobile it will also record mobile phone use. It won't record details about the actual use but the fact that it has been used.

For these types of products we'll share driving data only in the following circumstances:

• With third parties where we need to do so to manage the insurance policy or any claims (e.g. with our accident recovery partners if the car needs to be recovered following an accident).
• Where your monitoring device was supplied by a third party, the monitored data is processed by them, as well as our Group.
• With insurance industry bodies and databases (including, but not limited to, the Motor Insurance Anti-Fraud and Theft register and the No Claims History database).
• Between departments within the company and/or group. For example:
  • To help reduce fraud, by checking if another person is making a false claim against the driver, the driver is making a false claim against someone else or for debt recovery.
  • To encourage safer driving by examining how various groups drive and at what time of day the most incidents happen.
  • To help calculate tailored renewal premiums for policyholders.
  • To research and refine techniques for analysing driving data, including looking at road safety issues such as analysis of certain roads to identify the risks they represent.
• Analytics suppliers use the data for research (e.g. to improve road safety). Any information we share is made anonymous and does not contain any information classed as personal data under the data protection regulations. This means none of the data can be linked to the policyholder.
• Law enforcement and governing agencies - where justified and proportionate within data protection laws/

3.2.1 What personal information we'll collect and where we'll collect it from

We'll collect the following personal information from you, or from our customer if details were exchanged at the time of the accident, where relevant to your claim:

• Individual details: Your name, address, contact details (e.g. email/telephone), gender, marital status, date of birth, nationality.
• Employment information: Your job title and the nature of the industry you work in.
• Identification details: Your national insurance number, passport information, driving licence number.
• Previous and current claims: Any previous insurance policies you have held and claims made against those policies.
• Information which may be relevant to your claim: This includes the name and contact details of your insurer, details about your car/property and details about your claim (including any statements, photos/video footage, claims assessment reports and driving data). This information may include the following special categories of information relating to you:
  • Health data: Physical or mental health information which are relevant to your claim (e.g. where you've been injured in a motor accident and the driver is insured through us). This may include medical records relating to any injuries.
  • Criminal convictions: Any which are unspent under the Rehabilitation of Offenders Act. This includes motoring and non-motoring offences/alleged offences you have committed or any court sentences you're subject to.
• Financial information: Bank and payment information.
• Website use, including cookies and use of our web chat service: See section 4 below for details.
• Other information: Any information that we capture during recordings of our telephone calls in correspondence with us or if you make a complaint. This may include special categories of information you volunteer when communicating with us. We'll only process such information to the extent necessary in connection with the claim or in connection with legal proceedings. Any further processing will only be with your explicit consent.

We use external sources to supplement and verify the information above and also to provide the following new information:

• Individual details: Your name, address, contact details (e.g. email/telephone), date of birth and nationality.
• Credit and anti-fraud data: Credit history, credit score, sanctions and criminal offences, bankruptcy orders, individual voluntary arrangements (IVAs) or county court judgments, and information received from various anti-fraud databases. Some of this information (e.g. criminal offences) may include special categories of information relating to you.
• Demographic data: Lifestyle indicators such as income, education and size of your household.
• Open source data: Other information which is publicly available (including social media), which relates to you or the circumstances of any accident.

The external sources that provide us with information about you include:

• Other parties involved in your claim, including any named individual insured through us, passengers, witnesses or other third party claimants.
• Other insurers.
• Other Hastings Group Holdings limited companies.
• Third party suppliers we use to help us:
  • Carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, debt collection agencies, document management providers, outsourced business process management providers, our subcontractors and tax advisors.
  • Provide a service in relation to a claim (e.g. external claims handlers, our accident repair network, medical experts, claims investigators and, in limited circumstances, private investigators).
• Credit reference agencies.
• Data enrichment providers to assist in contact details for the processing of any claim.
• Providers of demographic data and vehicle data.
• Financial crime detection agencies and insurance industry databases (e.g. for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as 'CUE'), CIFAS and the Insurance Fraud Bureau (IFB). The IFB website can be accessed at www.insurancefraudbureau.org.
• Insurance industry bodies and databases (including, but not limited to, the Motor Insurance Anti-Fraud and Theft register and the No Claims History database).
• Government agencies and bodies such as the DVLA, HMRC, Department for Work & Pensions, or professional regulators (e.g. the Financial Conduct Authority).
• Publicly available sources (e.g. the electoral roll, court judgments, insolvency registers, internet search engines, news articles, social media) and sources licensed under the Open Government Licence v 3.0.
• The police and other crime prevention and detection agencies. We and fraud prevention agencies may enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
• Other third parties involved in your insurance policy or a claim (e.g. other insurers).
• Our reinsurers.

3.2.2 What we'll use your personal information for

We may process your personal information for a number of different purposes. We must have a legal ground for each purpose and we'll rely on the following grounds:

• We have a legitimate interest to use your personal information. For example, to keep a record of the decisions we make when different types of applications are made (e.g. if you request a quotation or make a change to your policy), keep business records, carry out strategic business analysis, review our business planning and develop and improve our products and services. When using your personal information in this way, we'll always consider your rights and interests.
• We have a legal or regulatory obligation to use your personal information (e.g. to meet the record-keeping requirements of our regulators).

For special categories of information, we must have an additional legal ground for processing. We'll rely on the following:

• It's in the substantial public interest and it's necessary for an insurance purpose (e.g. assessing your insurance application and managing claims), or to prevent and detect an unlawful act (e.g. fraud).
• To establish, exercise or defend legal rights e.g. legal proceedings are being brought against us or we want to bring a legal claim ourselves).

Here's how we use your personal information and the legal grounds we rely on:

3.2.3 Who we'll share your personal information with

We'll share personal information within Hastings Group Holdings limited and/or with the following third parties for the purposes laid out in the table above:

• Third parties involved in administration in any part of the relevant insurance policy or claim. These include loss adjusters, claims handlers, private investigators, data enrichment providers to gain contact details, accountants, auditors, banks, lawyers and other experts including medical experts.
• If you're making a small claim using the new Official Injury Claim service, we may pass your details to third party companies so they can contact you and independently assist you with your claim.
• Other insurers (e.g. where another insurer has previously provided you with a policy or handled a claim) and our reinsurers.
• Third party suppliers we appoint to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisors.
• Insurance brokers and other intermediaries.
• Credit reference agencies.
• Insurance industry bodies and databases (including, but not limited to, the Motor Insurance Anti-Fraud and Theft register and the No Claims History database).
• Financial crime detection agencies and insurance industry databases (e.g. for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as 'CUE'), CIFAS and the Insurance Fraud Bureau (IFB). The IFB website can be accessed at www.insurancefraudbureau.org
• The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. For more information on how Cifas use your information, please see their Fair Processing Notice at www.cifas.org.uk/fpn.
• Government agencies and bodies such as the DVLA, HMRC, Department for Work & Pensions, or regulators (e.g. Financial Conduct Authority).
• Professional regulators (e.g. the Financial Conduct Authority in the UK).
• The police and other crime prevention and detection agencies. We and fraud prevention agencies may enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
• Selected third parties in connection with any sale, transfer or disposal of our business.

3.3.1 What personal information we'll collect and where we'll collect it from

We'll collect the following personal information from you where relevant:

• Individual details: Your name, address, contact details (e.g. email/telephone), gender, date of birth and nationality.
• Employment information: Your job title and the nature of the industry you work in.
• Identification details: Your national insurance number, passport information and driving licence.
• Claims information: In relation to any incident or alleged incident you've witnessed.
• Photo or video data: Includes photos or footage recorded relating to a claim (including accident circumstances and interviews).
• Website use, including cookies and use of our web chat service: See section 4 below for details.
• Other information: Any that we capture during recordings of our telephone calls, in correspondence with us or if you make a complaint. This may include other special categories of information you volunteer when communicating with us about the incident you witnessed. We'll only process this information where it relates to the incident itself or legal proceedings. Any further processing will only be with your explicit consent.

We use external sources to supplement and verify the information above and also to provide the following new information. We would always have a justification and be proportionate:

• Claims assessment reports: By both claims investigators, and in limited circumstances, private investigators.
• Open source data: Unstructured data in the public domain, including social media, about you or the circumstances of any accident.

The external sources that provide us with information about you include:

• Other parties involved in the incident you witnessed (such as any named individual insured through us, passengers, other witnesses, third party claimants, brokers, insurers and the emergency services).
• Other third parties who provide a service in relation to a claim (such as external claims handlers, our accident repair network, medical experts, claims investigators and, in limited circumstances, private investigators).
• Other insurers.
• Publicly available sources (e.g. the electoral roll, court judgments, insolvency registers, internet search engines, news articles, social media).
• Other Hastings Group companies.

3.3.2 What we'll use your personal information for

We may process your personal information for a number of different purposes. We must have a legal ground for each purpose and we'll rely on the following grounds:

• We have a legal or regulatory obligation to use your personal information (our regulators impose certain record-keeping rules which we must adhere to).
• We have a legitimate interest to use your personal information (e.g. to keep a record of the decisions we make when different types of applications are made, keep business records, carry out strategic business analysis, review our business planning and develop and improve our products and services). When using your personal information in this way, we'll always consider your rights and interests.

We must have an additional legal ground for processing special categories of information. We'll rely on the following:

• It is necessary for an insurance purpose and it's in the substantial public interest. This will apply where we're helping with any claims under a policy (we'll only rely on this legal ground if we've not been able to obtain or you've not given us your explicit consent) and undertaking any activities to prevent and detect fraud.
• To establish, exercise or defend legal rights (e.g. legal proceedings are being brought against us or we want to bring a legal claim ourselves).

Here's how we use your personal information and the legal grounds we rely on:

3.3.3 Who we'll share your personal information with

We'll share personal information within Hastings Group Holdings limited and/or with the following third parties for the purposes laid out in the table above:

• Other parties involved in the incident you witnessed.
• Other insurers (e.g. where another insurer is also involved in the claim which relates to the incident you witnessed) and our reinsurers.
• Third parties involved in the administration of an insurance policy or claim. These include loss adjusters, claims handlers, accountants, auditors, banks, lawyers, medical experts and, in limited circumstances, private investigators.
• Third party suppliers we use to help us carry out our everyday business activities including IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisors.
• Insurance industry bodies and databases (including, but not limited to, the Motor Insurance Anti-Fraud and Theft register and the No Claims History database).
• Financial crime detection agencies and insurance industry databases (e.g. for fraud prevention and checking against international sanctions) including the Claims Underwriting Exchange (known as 'CUE'), CIFAS and the Insurance Fraud Bureau (IFB). The IFB website can be accessed at www.insurancefraudbureau.org.
• The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. For more information on how Cifas use your information, please see their Fair Processing Notice at www.cifas.org.uk/fpn.
• Government agencies and bodies such as the DVLA, HMRC, Department for Work & Pensions, or regulators (e.g. Financial Conduct Authority).
• The police and other crime prevention and detection agencies. We and fraud prevention agencies may enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
• Selected third parties in connection with any sale, transfer or disposal of our business.