Privacy Policy Overview

We take the privacy of our customers very seriously and are committed to protecting your privacy. This policy explains how we collect, use and transfer your personal data, and your rights in relation to the personal data stored by us when you use our website or otherwise engage with our services.

This policy sets out the following:

• What personal data we collect about you and how;
• How the data is used;
• Our legal basis for collecting your information;
• Who we share your data with;
• Where we transfer your information;
• How long we retain your information;
• Your rights and choices in relation to the data held by us;
• How to make a complaint in relation to the data held by us; and
• How to contact us with any queries in relation to this notice, or the personal data held by us.
• It also contains information about how we use cookies on our website.

Who is TMHCC?

Tokio Marine HCC is a trading name of HCC Insurance Holdings, Inc. and its subsidiaries worldwide (Including On Call International, LLC "On Call"). Please see here for further information http://www.tokiomarinehd.com/en/group/. These companies are collectively referred to in this privacy statement as "TMHCC", "we", "us" or "our".

For the purposes of European data protection laws, if you are visiting our website www.tmhcc.com (our "Website") or otherwise engaging with our services from the European Economic Area (or "EEA"), the data controller of your information is TMHCC.

What is personal data?

In this privacy notice, references to "personal information" or "personal data" are references to data that can be used to identify you. Some examples of personal data are your name, address, and telephone number but may also include information such as your IP address and location.

What personal data do we collect?

Information that you provide voluntarily

In order to provide services to you, we may ask you to provide personal information. This may include, amongst other things, your name, email address, postal address, telephone number, gender, date of birth, passport number, bank account details, credit history and claims history. The personal information you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point at which we ask you for it.

Some of the information you provide may be "sensitive personal data." "Sensitive personal data" includes information relating to your physical or mental health, racial or ethnic origin, political opinions, sexual life, criminal history, trade union membership, or religious beliefs.

Information that we collect automatically

When you visit our Website, we may collect certain information automatically from your device. In some countries, including countries in the EEA, this information may be considered personal information under applicable data protection laws.

Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location), and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

Collecting this information enables us to better understand visitors to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading "Cookies" below.

• Information that we obtain from third party sources

From time to time, we may receive personal information about you from third party sources but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

For example, if you are an individual who is obtaining services from us via one of our corporate customers, such as a travel provider, we may obtain data about you from your travel provider in order to help provide the Service. For information about how your travel provider uses and shares your personal data, please refer to the travel provider's own privacy statement.

We may also collect personal data from the following sources in order to provide services to you:

• Credit reference agencies;
• Anti-fraud and other databases;
• Government agencies;
• Electoral register;
• Court judgments;
• Sanctions lists;
• Family members; and
• In the event of an insurance claim: the other party to the claim, witnesses, experts, loss adjusters, solicitors, and claims handlers.

How is personal data used?

We may need to use your personal data in order to carry out the following activities:

• To set you up as a new client (including carrying out ‘know your customer’ checks);
• To provide you the Service;
• To accept payments from you;
• To communicate with you about your policy;
• To renew your policy;
• To obtain reinsurance for your policy;
• To process insurance and reinsurance claims;
• For general insurance administration purposes;
• To comply with our legal and regulatory obligations;
• To model our risks;
• To defend or prosecute legal claims;
• To investigate or prosecute fraud;
• To respond to your enquiries; or
• When you sign up for an online account.

Our legal basis for collecting your information

If you are travelling to/from the EEA, our legal basis for collecting and using your personal data will depend on the personal data concerned and the specific context in which we collect it

However, we will normally collect personal data where we need the information to provide you with our services / perform a contract with you, where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or with your consent.

In some cases, we may use your personal data for a legal obligation, e.g. in order to complete ‘know your customer’ and money laundering checks before taking you on as a new client.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as advise you of the possible consequences if you do not provide your personal information). You are under no obligation to provide personal data to us. However, if you should choose to withhold requested data, we may not be able to provide you with certain services.

Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

If you are a UK resident, we may collect and use your personal information, including sensitive personal information, on the basis of the substantial public interest of insurance purposes, as regulated in the UK Data Protection Act 2018.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the "Contact Us" section below.

Who is your personal data shared with?

We may disclose your personal information with the following categories of recipients.

• to our group companies, third party service providers and partners who provide data processing services (for example, to assist in the performance of our services) or who otherwise process personal information for purposes that are described in this Privacy Notice (see "How does TMHCC use my personal data?"). A list of our current group companies is available at http://www.tokiomarinehd.com/en/group/ and a list of our current service providers and partners may be available upon request;
• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish, or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
• to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger, or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice;
• to any other person with your consent to the disclosure.

International transfers

Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.

Specifically, the servers of HCC Insurance Holdings Inc. are located in the United States. However, other TMHCC group companies are registered elsewhere, including in the EEA, and operate around the world. This means when we collect your information, we may process it in any of these countries.

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EEA in accordance with European Union data protection law.

We may also retain your personal data where such retention is necessary in order to protect your vital interests or the vital interests of another natural person.

Your rights as a data subject

If you are an EEA resident or the Services are provided in the EEA, your principal rights under data protection law are as follows:

1. the right to access;
2. the right to rectification;
3. the right to erasure;
4. the right to restrict processing;
5. the right to object to processing;
6. the right to data portability;
7. the right to complain to a supervisory authority; and
8. the right to withdraw consent.
   • If you wish to access, correct, update, or request deletion of your personal information, we will ask you to provide us with a copy of any two of the following documents: Driver’s licence; Passport; Birth certificate; Bank statement (from the last 3 months); or Utility bill (from the last 3 months). With regard to your right of access, the first access request will be complied with free of charge, but additional copies may be subject to a reasonable fee.
   • In addition, if you are a resident of the European Union, you can object to the processing of your personal information, ask us to restrict processing of your personal information, or request portability of your personal information.
   • You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing e-mails we send you or by contacting us using the details provided under the "Marketing" heading below.
   • Similarly, if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
   • You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area, Switzerland, and certain non-European countries (including the US and Canada) are available here.)

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

You may exercise any of your rights in relation to your personal data by contacting us using the email [email protected] or the details set out in the "Contact us" section at the bottom of this page.

Marketing

As mentioned above, we may use your personal data to send you marketing materials.

If you would like to stop receiving marketing information from us, please unsubscribe by clicking the "unsubscribe" link in the relevant marketing email, email us at [email protected]., or write to us at:

Marketing Officer
On Call International
11 Manor Parkway
Salem, NH 03079
USA

Security

TMHCC places great importance on the security of all personal data associated with our customers. We have security measures in place to attempt to protect against the loss, misuse, and alteration of personal data under our control.

For example, our security and technology policies are periodically reviewed and enhanced as necessary, and only authorised personnel have access to user information. We use Secured Socket Layer (SSL) to encrypt financial information you input before it is sent to us. The servers we use to store personal data are kept in a secure environment.

Whilst we cannot ensure or guarantee that loss, misuse, or alteration of data will not occur, we use our best efforts to prevent this.

Cookies

Our sites use cookies (a small piece of information that is placed on your computer when you visit certain websites) to distinguish you from other users, to track your browsing pattern, and to build a profile of how you and other users use our sites. This helps us to provide you with a good experience when you browse any of our sites and also allows us to improve our sites. If you have an online account with us, TMHCC also uses Cookies to recognize you to pre-fill forms to save you time. TMHCC does not mandate Cookies for you to access our sites, and you may freely set your browser to reject all Cookies or prompt you to accept or reject them. Some of the Cookies we use are session Cookies and only last until you close your browser, others are persistent Cookies which are stored on your computer for longer. We may collect information through web beacons about your web browsing activities such as the address of the page you are visiting, the address of the referrer page you had previously visited, the time you are viewing the page, your browsing environment and your display settings. We do this in order to optimize your browsing experience, the use of web-based services, and to provide you with relevant information on TMHCC products and services when you have opted-in to receiving such correspondence. For further information about TMHCC's use of Cookies, see TMHCC's Cookie Policy.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical, or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

Contact Us

If you have any questions about this Privacy Notice, please contact us using the following contact details:

Data Protection Officer
TMHCC
1 Aldgate
London
EC3N 1RE
[email protected]