This privacy statement describes how ES Risks Limited (“we”/”us”/”our”) will collect and handle personal data that ES Risks collects from you, the data subject, in the course of its business and in accordance with the European General Data Protection Regulation (GDPR) 2018 as applied in the United Kingdom by the Data Protection Act 2018.

“Personal Data” is information that identifies you as an individual.

By providing your personal data to us, you agree to this privacy notice.

For the purposes of the Data Protection Act 2018 the Data Controller is ES Risks Limited, a private limited company, number 063438972, registered at 5th floor Minories House, 2-5 Minories, London EC3N 1BJ. ES Risks Limited trading address is at America House, 2, America Square, London, EC3N 2LU.

ES Risks are registered with the Information Commissioner’s Office; Registration Z1592537.

ES Risks Limited may be contacted at the trading address or by calling 0207 977 5215.

What data do we collect?

The personal data that we may collect may include

• Your name, postal address, email address, phone number or other contact details.
• Identification details such as your national insurance number, passport number, driving licence number.
• Bank account or payment card details, credit history or credit score.
• Previous claims history

We may also need to collect special categories of data to assess the risk being insured and provide a quote. This may include data relating to;

• Criminal offences,
• Health
• Racial or ethnic origin
• Political or religious beliefs

Where we need to collect any data that is a special category of personal data, we will do so with your explicit consent.

Where you have provided your consent, you may withdraw this at any time. However, should you exercise this right, we may not be able to fulfil the insurance services requested by you, your policy may terminate, or you may be unable to make a claim. Should you wish to withdraw your consent to the processing of your personal data, please contact us at the address above.

How we may collect your personal data

We may collect your personal data from you, your family or employer or from other insurance market participants such as your insurance broker.

We may also collect your personal data from credit reference agencies.

How we may use your personal data

We will use your personal data for the purpose of providing you with the provision of our services which include arranging and providing insurance coverage and administration of an insurance contract to which you are a party. We may also use your data in assisting you to collect any claims that fall due and to process renewal invitations.

Where we are required to process any of your personal data to allow us to provide you with a suitable insurance solution, that is denoted as special category data, we will only process this data with your explicit consent.

Where overt consent has not been obtained then ESR will rely of the condition that the processing of sensitive personal data is necessary for an insurance purpose as per the Data Protection Act 2018.

We do not sell or supply any personal data to any third party and will disclose personal data only when required by law.

We also do not use personal data for any form of automated processing, decision making or ‘profiling’ to analyse or predict any personal aspects of performance at work, economic situation, health, personal preferences or interests and behaviour.

We do not transfer any personal data to any party outside of the United Kingdom.

Who we may share your information with

In the performance of and in the provision of our services to you, in arranging insurance cover, we may need to disclose your personal data to potential insurers or other insurance market participants or credit reference agencies.

In assisting with the collection of a claim, we may need to disclose your personal data to third parties including loss adjusters, claims handlers and solicitors.

In complying with our legal and regulatory obligations, we may also need to disclose your personal data to the Financial Conduct Authority, the Information Commissioners Office or other regulatory bodies.

Retention of your personal data

We will only keep your data for as long as is necessary based on the original purpose for which it was collected or where we are obliged to do so due to legal or regulatory reasons.

Your rights as a data subject

The GDPR confers a number of rights on you as the data subject. We have listed these rights below as they appear in the GDPR.

• The right of access: you have a right to access the personal data that we hold about you so that you may verify the lawfulness of the processing of your data that we may conduct. To request a copy of the personal data that we hold, please contact us at the address above.
• The right to rectification: if the personal information that we hold about you is incorrect, you may ask us to amend it.
• The right to erasure: you may request that the personal data that we hold about you be deleted or removed where there is no longer any reason for continued processing of your personal data. For instance, you no longer wish us to provide our services to you.
• The right to restrict processing: you have the right to ‘block’ the processing of the personal data that we hold where you contest the accuracy of the personal data we hold. You may also request that we restrict processing where you object to our legitimate interests as the basis of the processing of your personal data or you believe continued processing to be unlawful.
• The right to data portability: you have the right, on request, to ask us to provide to you a copy of the personal data that you have previously supplied to us. For instance, you no longer wish us to provide our services to you and you wish to transfer to a new service provider.
• The right to object: you have the right to object to the processing of your personal data by us where you can demonstrate that to do so would be detrimental to your interests.

You may also object and request that we do not process your personal data for any purposes of direct marketing.

Your right to complain

In the event that you are not satisfied with our use of your personal data or you believe that we have not upheld your rights as a data subject, please contact us at the address above. We will acknowledge any complaint as soon as received and our aim is to resolve any complaint and to provide you with a resolution within one month.

Should you remain dissatisfied with our response, you have the right to complain to the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Insurance industry core uses information notice

Insurance involves the use and disclosure of your personal data by various insurance market participants such as intermediaries, insurers and reinsurers. The London Insurance Market Core Uses Information Notice can be found at www.lmalloyds.com and sets out those core necessary personal data uses and disclosures.

Our core uses and disclosures are consistent with the London Market Core Uses Information Notice. We recommend you review this notice.