Adviser privacy notice

When we say ‘we’ or ‘us’ in this notice we’re referring to Royal London Mutual Insurance Society Limited, a company registered in England and Wales (registration number:99064).

We may collect and process the following:

• Personal information - for example name and date of birth.
• Contact information – for example email address, fax and phone number(s). We may also have your home address, if you’ve provided this on agency application forms or this is your correspondence address. 
• Identification numbers – for example your National Insurance number and your Royal London Agency Number . 
• Information about your business – for example business name, business address, FCA registration number, remuneration address, phone, fax, email and website. 
• Financial information – for example bank account details and credit checks. 
• Contractual information – for example details of your agency agreement with us and remuneration preferences. 
• Transactional information – details of the business you place with us or amends to your clients’ plans. 
• Online information – for example cookies and IP address (your computer’s internet address), if you use our websites or tools. 
• Audio or video recordings – for example voice recording when you contact us, or CCTV footage if you visit our offices. Calls may be recorded for training and monitoring purposes to help us continually improve our customer service and also to protect you and your client’s information. 
• Directors’, partners’ and principles’ additional information – for example position at your firm, any other agencies you are or have been linked with and details of your professional standing such as any history of debt, fraud or other criminal offences.

When we collect your information, we’ll let you know if any of it's optional. If it is, we’ll explain why it would be useful to us, and you can decide whether it’s something you’re happy for us to have.

We use the information we obtain directly from you for a number of reasons:

• Setting up and administering your agency.
• Completing any client quotes, applications, amends or requests you make. 
• Verifying your identity and preventing fraud.
• Researching our advisers’ opinions and exploring new ways to meet your needs. 
• Assessing and developing our products, systems, prices and brand. 
• Fulfilling any legal or regulatory obligations. 
• Sending you marketing information. 
• Monitoring the use of our websites.

Most of the information we receive comes directly from you, or at your instruction from your network, your service provider or industry service providers such as Origo. We may also get personal information about you from other sources, including:

• Financial Conduct Authority – we’ll get information from the Financial Services Register to check the authorisation and permissions of your firm, as well as details of the approved persons(s) under your firm.
• Association of British Insurers (ABI) – we may receive information about you as part of research and analysis for initiatives undertaken in conjunction with other insurers, via the ABI. 
• Credit reference agencies - we use Experian to verify your identity and conduct a credit check when setting up new agencies and for ongoing due diligence checks. This is to meet our anti-money laundering obligations and to protect against other conduct risks.
• Data brokers, including:
• Equifax - we share information on the business placed with us with Equifax, which is stored in their system called Touchstone, to help us and other insurers understand our market share. This is now reported at an agency level, but if you’re a sole trader or part of a partnership, this may also constitute your personal information; 
• CRIF decision solutions – we obtain and share information with CRIF, which is a stored on a system called Elixir 2000, in order to meet our regulatory requirement to report remuneration debts and to protect against conduct risk; 
• Matrix solutions – we share information on the business placed with us with Matrix Solutions, which is stored on their system called Financial Clarity. This helps us and other insurers understand our market share. This is not reported at an agency level, but if you are a sole trader or part of a partnership this may also constitute your personal information. The information is also used to inform our segmentation model (see section 10 for more details on adviser segmentation) which helps inform our analysis and market research activity.
• Third party cookies - to collect information on how visitors use our website. Our cookie policy can give you more information. 
• Comparison services / portals - If you use a comparison service or portal to obtain multiple quotes at once, such as UnderwriteMe’s Comparison Service, the portal provider will share your information with us as well as your client’s information. 
• Companies House or other companies who provide access to financial accounts - if we need to verify information on directors, owners or your business, we may obtain information from Companies House or similar companies; 
• Online resources - if we lose touch with you, we may search for information such as contact details online, so we can get back in touch.

Data Protection gives organisations a number of different conditions to allow us to process your information lawfully.

We’ll only use your personal information when one of these conditions has been met. Below you can see how we use your information and the legal grounds for processing this:

As you’d expect, our employees will access your records in order to use your information for the purposes mentioned above. However, only those employees who need access to particular information are given it. For example, our customer service staff need access to your details to support you when you get in contact, and our research teams will need access to a subset of your information to perform their analysis. We regularly check who has access to our systems.

We may also share your personal information with these third parties:

• Our service providers and agents, for example mailing houses for printing, offsite storage companies, confidential waste disposal and IT companies who support our technology.
• Our professional advisers: auditors and legal advisers. 
• ID authentication and fraud prevention agencies. 
• HM Revenue & Customs, who have powers to ask us for a return detailing all payments to advisers. 
• Regulators such as the Financial Conduct Authority and other authorities like the Information Commissioner’s Office. 
• Other insurance providers.
• Market research agencies. 
• The Association of British Insurers (ABI). 
• Data Brokers, for example Experian, Equifax, Matrix Solutions and CRIF Decisions Solutions. 
• Your network or service provider, if we've identified unethical behaviour.
• We may share your information with advertising partners (e.g. Facebook) to help us identify and market to new customers. We will always consider your rights and freedoms before we do this and assess the balance between our interests and yours.

We sometimes use third parties located in other countries to provide support services. As a result, your personal information may be processed in countries outside the European Economic Area (EEA).

These services will be carried out by experienced and reputable organisations on terms which safeguard the security of your information and comply with the European data protection requirements. Some countries have been assessed by the EU as being ‘adequate’, which means their legal system offers a level of protection for personal information which is equal to the EU’s protection. Where the country hasn’t been assessed as adequate, the method we've chosen is standard contractual clauses.

The European Commission has recognised ‘standard contractual clauses’ as offering adequate safeguards to protect your rights and we’ll use these where required ensuring adequate protection for your information. The European Commission approved standard contractual clauses are available here.

We use standard contractual clauses for the below activities, to help us provide:

• IT support and technology development with operations based in India.
• Other service providers, research partners and administrators with operations based in India and the United States.

We always make sure all personal information is provided with adequate protection and all transfers of personal information outside the EEA are done lawfully.

We use Transport Layer Security (TLS) to encrypt and protect email traffic. We also use industry standard tools when information is shared, which use standardised formats and which encrypt information in transit - such as Unipass (provided by Origo), Edi (provider by Opentext) and Unipass (provided by Clearswift). We'll always share information such as client information or your remuneration statements via one of these applications which ensure encryption.

However, if your email service doesn’t support TLS and you don’t use an encryption tool, the emails you send won’t be protected. We recommend you don’t send anything confidential to us by unsecured email.

Once we receive your information, we use strict procedures and security features to protect your information from unauthorised access.

We’ll keep your personal information for as long as it’s considered necessary, for the purpose for which it was collected, and to comply with our legal and regulatory requirements. This will involve keeping your information for a reasonable period of time after your relationship with us has ended.

In the absence of specific legal, regulatory or contractual requirements, information relating to you in our adviser records will be retained for seven years after the end of your relationship with us. Your information which is included within your client’s plan will be kept for seven years after the client’s plan has ended.

There are also a few exceptions to this rule, where we need to keep plan information for longer periods. We keep underwriting and quote information for ten years, to allow us to assess whether our policy cover is appropriate. We need information for the longer period, to make sure we can evaluate a large enough number of cases and make informed decisions. For pension schemes, we need information for all the payments in and out of the scheme to be kept for seven years after the scheme closes. So your information may be kept for a long time.

We’re also running a programme as part of our need to treat our customers fairly. Until this finishes, we’ll be keeping your information beyond seven years.

Automated decisions are where a computer makes a decision about you without a person being involved. We do use credit reference agencies to check your credit report, which we then score using our own rules, but there's always a person involved in this assessment.

Profiling and adviser Segmentation

We use firm level and business data, to provide us with insight into the distribution market place. We use a variety of publicly available and purchased sources of information to divide the distribution market into categories and sub-categories. The categories and sub-categories are a way of grouping intermediary firm and advisers who are likely to have similar business models, business strategies and potentially have similar customers. The results are assessed and combined so we get a picture of the distribution market as a whole. Your segment information may also be used in our product and proposition assessments.

In the future we’d like to keep a note of the category you or your agency falls into, against your records, so we can tailor our communications to suit you. Before we do this we’ll assess if this is fair.

Your rights are outlined below. The easiest way to exercise any of your rights would be to contact our Data Protection Officer using the contact details below in section 15 – Contact us. We’ll provide a response within 30 days, if not sooner. There’s normally no charge for exercising any of your rights.

Accessing your personal information

You have the right to find out what personal information we hold about you, in many circumstances.

Correcting or adding to your personal information

If any of your details are incorrect, inaccurate or incomplete you can ask us to correct them or to add information.

Data portability

In some circumstances you can ask us to send an electronic copy of the personal information you have provided to us, either to you or to another organisation.

Objecting to the use of your personal information for legitimate interests

You also have the right to object to any processing done under legitimate interests. We’ll re-assess the balance between our interests and yours, considering your particular circumstances. If we have a compelling reason we may still continue to use your information.

Objecting to direct marketing

You have a specific right to object to our use of your information for direct marketing purposes, which we’ll always act upon.

Restricting the use of your personal information

If you’re uncertain about the accuracy or our use of your information, you can ask us to stop using your information until your query is resolved. We’ll let you know the outcome before we take any further action in relation to this information.

Right to erasure

In some circumstances you can ask us to delete your personal information, such as if your agency agreement has ended and we don’t need to keep your information for legal or regulatory reasons. If we’re using consent to process your information and you withdraw it, you can ask us to delete your information.

If you’re unhappy with how we’re using your information, you have the right to complain to the Information Commissioner’s Office. We’d encourage you to contact us first, so we can help with your concerns.

The Information Commissioner’s Office can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If we want to use your personal information for a new purpose which we haven’t previously told you about, we’ll contact you to explain the new use of your information. We’ll set out why we’re using it and our legal reasons.

Making sure that we keep you up to date with privacy information is a continuous responsibility and we keep this notice under review. We’ll update our notice as changes are required.

This privacy notice was last updated on the 24 June 2021 and is version 1.2.

If you have any questions or comments regarding this privacy notice, or if you’re not happy with the way Royal London uses your information, please contact us using the details below.

Post: Data Protection Officer, Royal London, Royal London House, Alderley Park, Congleton Road, Nether Alderley, Macclesfield, SK10 4EL.

Email: GDPR@royallondon.com

Phone: 0800 085 8352