Heffernan Insurances and Investments Ltd Privacy Statement

Introduction

Heffernan Insurances and Investments Ltd is committed to protecting and respecting your privacy. We wish to be transparent on how we process your data and show you that we are accountable with the GDPR in relation to not only processing your data but ensuring you understand your rights as a client.

It is the intention of this privacy statement to explain to you the information practices of Heffernan Insurances and Investments Ltd in relation to the information we collect about you.

Please read this Statement carefully as this sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

Who are we?

Heffernan Insurances and Investments Limited of 35 Morgan Street, Waterford specialise in the provision of Life, Pensions, Investments and General Insurance services to consumers. Heffernan Insurances and Investments Limited is a member of Brokers Ireland. Heffernan Insurances and Investments Limited t/a Heffernan Insurances is regulated by the Central Bank of Ireland. Our registration number is 2189.

Why we are processing your data? Our legal basis.

In order for us to arrange general and life insurance on your behalf we will need to collect your personal data. We require this Data in order to manage and administer our relationship with you, evaluate the risk and recommend the product(s)/services which are most suitable for your particular needs. We will also be required to pass on your data to the insurers with whom we hold agency so that they may validate and settle any claims, bring and/or defend legal proceedings, prevent, detect and investigate fraud, and in order to generally take any steps required to fulfil our contract with you/comply with our legal obligations.

Note: If you provide us with Data relating to another person you must first: (a) inform that person about the content of our Privacy Policy and (b) obtain any legally required consent from that person to the sharing of their Data in this manner.

The Data we collect

Where appropriate, we may collect the following personal data (‘Data’) from and/or about you:

• Contact and identifying information such as title, name, address, email address, telephone number, date and place of birth, gender, marital status, VAT number, nationality, country of residence, dates of residence and photographic identification.
• Financial information such as bank account details, credit/debit card details and income details.
• Employment and qualification details such as occupation, job position, employment status.
• Medical and health details including information related to personal habits (such as smoking or consumption of alcohol), medical history, details of any disability, injuries sustained and prognosis for recovery.
• Other sensitive information such as details of any criminal convictions and offences (including penalty points), civil litigation history as well as pending prosecutions. We may also, in certain cases, receive sensitive information from which it may be possible to infer your trade union membership, religious or political beliefs (for example. if you are a member of a group scheme through a professional, trade, religious, community or political organisation).
• Information pertaining to the risk insured such as description of the risk, value of the risk, location of the risk, and claims history.
• Claims data such as details of the circumstances of any incident giving rise to a claim under this policy, details of activities carried out following any such incident, details of any other claims that you have made, as well as financial, medical, health and other lawfully obtained information relevant to your claim including social welfare information.

If we collect any special categories of personal data (e.g. health, religious beliefs, racial, ethnic origin and details of criminal convictions we will ensure that we obtain your explicit consent to do so. If we need to pass your sensitive personal data onto a third party we will only do so once we have obtained your explicit consent, unless we are legally required to do otherwise.

What we do with your Data

We may use, process and store the Data for the following purposes:

Assessing which insurance products are appropriate for you, risk evaluation, policy quotation, premium collection, policy administration, policy renewal, claims processing, claims payment,
recovering debt, marketing, statistical analysis, in order to prevent and detect fraud as well as the non-disclosure of relevant information to insurers.

Heffernan Insurances and Investments Ltd may share information about you with insurers with whom we hold agency. These insurers may check your details with fraud prevention agencies, as
well as against databases and other sources of information and where appropriate where appropriate, private investigators and law enforcement agencies.

Below is a sample of the databases/sources used by insurers:

• The Integrated Information Data Service (‘IIDS’) which allows members of Insurance Ireland to verify information including penalty points and no-claims discount information
  provided by their customers.
• The National Vehicle and Driver File, maintained and supported by the Department of Transport, Tourism and Sport, containing details of all registered vehicles in the State.
• Motor Insurance Anti-Fraud and Theft Register (MIAFTR) operated by the Association of British Insurers in the UK to log all insurance claims relating to written-off and stolen vehicles in the UK the Companies Registration Office.
• The insurance industry claims database known as InsuranceLink maintained by Insurance Ireland (for more information see www.inslink.ie) The purpose of InsuranceLink is to help insurers identify incorrect information and fraudulent claims and, therefore, to protect customers. Under data protection legislation you have a right to know what information about you and your previous claims is held on InsuranceLink.

Heffernan Insurances and Investments Ltd will process (collect, store and use) the information you
provide in a manner compatible with the EU’s General Data Protection Regulation (GDPR). We
will endeavor to keep your information accurate and up to date, and not keep it for longer than is
necessary.

Data Retention

The time periods for which we retain your Data depend on the purposes for which we use it. We will keep your Data for no longer than is required or legally permitted. Data will not be held for longer than is necessary for the purpose(s) for which they were obtained. Heffernan Insurances and Investments Ltd will process personal data in accordance with our retention schedule. This retention schedule has been governed by Central Bank regulations and our internal governance.

Data subject rights

You have the following rights in relation to your Data which is held by us:

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• The right to receive notification of a Data breach.
• Where processing is based on consent, the right to withdraw such consent.
• Right to judicial review: in the event that Organisation Name refuses your request under rights of access, we will provide you with a reason as to why.
• The right to lodge a complaint to the Data Protection Commission.

If you wish to avail of these rights, a request must be submitted in writing to our Data Protection Officer. In order to protect your privacy, you may be asked to provide suitable proof of identification before we can process your request.

Sharing Of Data

We may be required to pass on your personal data to third-party service providers contracted in the course of dealing with you. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only to fulfil the service they provide on your behalf. When they no longer need your data to fulfil this service, they will dispose of the details in line with GDPR and CCPC guidelines:

We may share your Data (where appropriate/applicable) with the following:

• Insurers with whom we hold agency, auditors, legal firms, cloud service providers, third-party claim administrators and outsourced service providers) to assist us in carrying out business
  activities which are in our legitimate business interests and where such interests are not overridden by your interests.
• Where transfers take place outside the European Economic Area (‘EEA’) we will ensure that they are undertaken lawfully and pursuant to appropriate safeguards.
• With any intermediary or third party acting for you.
• With persons to whom you have given authority for us to deal with your insurance policy on your behalf.
• In order to comply with our legal obligations, a Court Order or to cooperate with State and regulatory bodies (such as the Revenue Commissioners and the Central Bank of Ireland), as well as with relevant government departments and agencies and the Gardai.

Failure to provide required data or further information

As we are collecting your data for the purposes of arranging a contract of insurance and you cannot provide this data the consequences of this could mean the contract cannot be completed. Furthermore misrepresentation or non disclosure of material facts, including; your medical details or history and any previous insurance claims made by you for the type of insurance sought may
lead to the insurer cancelling/voiding your policy and claims may not be paid. Furthermore you may encounter difficulty in trying to purchase insurance elsewhere; and in the case of property
insurance, that the failure to have property insurance in place could lead to a breach of the terms and conditions attaching to any loan secured on that property.

Additional Processing

If we intend to further process your personal data for a purpose other than for which the data was collected, we will provide this information prior to processing this data.

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by Heffernan Insurances and Investments Ltd or how your complaint has been handled, you have
the right to lodge a complaint directly with our Data Protection Officer and the Data Protection Commissioner.

The details of our data protection officer are as follows:

Name: Ray Heffernan
Contact Address: Heffernan Insurances and Investments Ltd, 35 Morgan Street, Waterford City.
Telephone: 051 871444
Email: ray@heffernan.ie

Contact Us

Your privacy is important to us. If you have any comments or questions regarding this statement,
please contact us on 051 871444 or email insurance@heffernan.ie

Privacy policy statement changes

Heffernan Insurances and Investments Ltd may change this privacy policy from time to time.
When such a change is made, we will post a revised version online. Changes will be effective from
the point at which they are posted. It is your responsibility to review this privacy policy
periodically so you’re aware of any changes. By using our services you agree to this privacy policy.