Last updated: 25 Jun 2021
We take the security of your Personal Information very seriously. We use a combination of technical, organisational and physical security measures to protect your Personal Information in line with our obligations under data protection law. Our employees receive training to help us comply with data protection law and safeguard your privacy.
You may also find it useful to review the London Insurance Market Core Uses Information Notice, which explains how the various insurance market participants, e.g. intermediaries, insurers and reinsurers use Personal Information. Our core uses and disclosures of Personal Information are consistent with the London Market Core Uses Information Notice.
2. Personal Information We Collect and How it is Used
Sources of Personal Information
We obtain Personal Information directly from you, including from application and claims forms that you complete, communications between us, your participation in promotions and market research, and your use of our apps and websites, as well as details from the devices you use to interact with our apps and websites . Where you are a joint policyholder, an additional traveller or otherwise a beneficiary under a policy we will also obtain Personal Information from the named policyholder.
We may also obtain Personal Information from third parties, including the following:
- Insurance brokers, financial advisers or one of our business partners, where you have obtained a product through one of these third parties;
- Comparison websites and other similar companies where you have used these companies to obtain quotes for travel insurance products;
- Third parties who provide you with services relating to your product, e.g. travel assistance providers and healthcare providers;
- Third parties who provide us, or a third party insurer relevant to your product or claim, with services, e.g. loss adjusters, claims handlers (e.g. CEGA Group Services Limited), legal advisers, assistance providers, experts and, in limited circumstances, private investigators;
- Third parties involved in your product or claim including other insurers, brokers, assistance providers, claimants, defendants and witnesses to an incident;
- Aviva group companies who may provide information in relation to other products you hold, previous claims, policies or quotes;
- Credit reference agencies;
- Financial crime and fraud detection agencies, databases and sanctions lists, including the Claims Underwriting Exchange (CUE) and Insurance Fraud Bureau (IFB);
- Government agencies and regulatory bodies including the police, the courts, the Department for Work and Pensions (DWP), Companies House and HM Revenue & Customs (HMRC);
- Regulators who regulate how we operate including the Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), Information Commissioner’s Office (ICO) and the Financial Ombudsman Service (FOS);
- Insurance industry bodies including the Association of British Insurers;
- Debt advisors, including where breathing space is requested on outstanding debts;
- Third parties who provide us with details of individuals who have expressed an interest in hearing about insurance products;
- Third parties suppliers that provide services in relation to your policy or claim, including checking no claims discounts,
- Third parties that help us maintain the accuracy of our data e.g. by identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details;
- Other third party suppliers including actuaries, auditors, legal advisers and other professional service firms and sanctions-checking service providers;
- Data suppliers, e.g. Experian and LexisNexis;
- Publicly available sources, e.g. data made available under the Open Government Licence, including internet searches, news articles, online marketplaces and social media sites, apps and networks (e.g. Twitter, Facebook and Instagram);
- Providers of marketing and advertising services;
- Third parties in connection with any acquisition of a business by us.
Types of Personal Information collected
The Personal Information we hold and process will differ depending on our relationship with you. For example, where you have cover as part of an arrangement with one of our business partners, e.g. your bank, we will collect and use Personal Information differently than if you purchase a single trip or annual insurance policy on its own. For example, if you receive cover as part of an arrangement with one of our business partners, we may process less information about you when your cover starts. You will need to provide us with Personal Information if you need to make a claim or declare a medical condition. The Personal Information we hold and process includes:
Information provided by you or third parties, including:
- General data – includes your name, date of birth, marital status, country of residence/citizenship and your relationships to other people, e.g. family members on a joint insurance policy;
- Contact data – includes your address, telephone number and e-mail address;
- Identification data – includes government issued identification numbers e.g. your national insurance number, passport number or driving licence number and other identifiers e.g. usernames and social media identifiers;
- Appearance and behavioural data – includes your gender, age, general interests, descriptive data e.g. your height, images, demographic data and behavioural data, e.g. your purchase history;
- Product data – includes information about quotations, policies, schemes and claims and any other information relevant to your product, including details regarding your travel arrangements, any sports and other activities you plan to undertake when travelling, e.g. scuba diving or skiing and your policy and claim histories;
- Claims data – if a claim is made under an insurance policy, this includes information about the claim collected from your and relevant third parties, e.g. witnesses;
- Fraud and sanctions related data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources such as newspapers and social media sites and information obtained from checks of fraud databases and sanctions lists such as relationships/close associations with politically exposed persons;
- Education and employment-related data – includes your education, vocational and professional qualifications, employment status, job title and employment and educational history;
- Financial data – includes credit and payment card numbers, bank account details, payment information, whether you provide a continuous payment authority, tax information and details of income and assets;
- Credit assessment data – includes information received from credit agencies e.g. details of bankruptcy orders, voluntary arrangements and county court judgments;
- Vulnerability data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that that we can better meet your needs;
- Authentication data – includes account log-in information, passwords and memorable data for accessing your Aviva accounts;
- Telephone recordings and online chat transcripts – information obtained during recordings of telephone calls or online chats with our representatives and call centres;
- Marketing and communication preferences, promotion entries and customer feedback – includes marketing and communication preferences, information relating to promotions and prize draws, responses to surveys, complaints and details of your customer experience.
Information provided by third parties, including:
- An individual risk score where you disclose a medical condition. We use a third party tool to assess the additional risk that such medical condition poses and we use the score generated in order to generate a more accurate price for your insurance policy;
- Accurate contact data, e.g. where you have moved address, changed your telephone number or started using a new email address and not yet advised Aviva. This data may be used to ensure that we have a complete understanding of your product holding and to provide you with communications about your products. It will not be used for direct marketing purposes unless it was collected by the third party expressly for that purpose and always in accordance with data protection law.
Information collected from your devices, including:
Information already held by Aviva, including:
- Data relating to other Aviva policies – e.g. quote, policy and claim histories relating to other existing Aviva policies or products or those you may have applied for or held in the past, and contact details where you may have advised Aviva about a change on one product, but not another;
- Modelled data that has been developed by Aviva using data that it already holds. For example, we use claims data to identify customers who are likely to claim more than others.
Information inferred from your Personal Information, including:
- Appearance and behavioural data – includes your general interests, descriptive data and behavioural data to allow us to make certain predictions and assumptions about your interests, which allows us to personalise your experience with us;
- Vulnerability data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that we can better meet your needs;
- Fraud and sanctions-related data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources, such as newspapers and social media sites and checks of fraud databases and sanctions lists.
- We collect data about children in some circumstances e.g. where a child is insured on an adult's policy, where a child takes out a policy with us, e.g. travel insurance for under 18s or where a child is a claimant.
Sensitive Personal Information
Sometimes we will request or receive Personal Information that is sensitive and we call this “Sensitive Personal Information”. This is information relating to your health, genetic or biometric data, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership. It also covers criminal offence data, including information about criminal activity, allegations (including those unproven), investigations, proceedings and penalties. For example, to investigate a bodily injury claim, we’ll need to ask you to provide details of the injury. We know how sensitive this data is, so protecting it is a top priority. The types of Sensitive Personal Information we hold and process where relevant include:
- Health data – includes details of existing and previous physical or mental health conditions, health status, test results, medical diagnoses and treatment of you and any person insured under a policy. If you or anyone insured under a policy has declared medical conditions, a third party may provide us with a 'risk score' in order for us to calculate your premium. See Automated Decision Making for more information. We also collect details regarding any illness (including medication and treatment) or personal injury about you or other beneficiaries when you make a claim under the policy;
- Criminal data – includes details of convictions, e.g. in relation to fraud;
- Other sensitive data - in limited circumstances we may process other Sensitive Personal Information. For example, we may process information relating to your religious beliefs where relevant to your preferences regarding medical treatment provided under your travel policy.
Uses of Personal Information
The main purposes for which we use Personal Information are to:
- Communicate with you and other individuals;
- Make assessments and take decisions, including whether to pay your claim or pursue any losses against you or a third party, provide you with our products and services and on what terms. For further information, see Automated Decision Making;
- Process payments when you purchase a product or service and any refunds;
- Provide our products and services, including insurance administration, taking payment, making changes where requested or necessary, managing renewal, claims assessment, settlement and dispute resolution and the provision of our apps and other technologies e.g. MyAviva;
- Manage relationships with third parties, e.g. brokers and service providers;
- Prevent, detect and investigate fraud and other crime, including by carrying out fraud, sanctions and anti-money laundering checks. For further information see Fraud and Other Financial Crime;
- Improve our products and services, provide staff training and maintain information security, including by recording and monitoring telephone calls;
- Provide marketing information and run promotions in accordance with preferences you have expressed. For further information see the section on Marketing;
- Conduct customer analysis, market research and focus groups, including customer segmentation, campaign planning, creating promotional materials, gathering customer feedback and customer satisfaction surveys;
- Help us better understand our customers and improve our customer engagement, including noting your interest in our website, understanding your customer journey, and use of profiled data (which is not actual information about you but predictions about you, e.g. assumptions about your interests based on the preferred leisure pursuits of households your area). This allows us to make correlations about our customers to improve and promote our products and to suggest other products, services and information which may be relevant or of interest to customers;
- Carry out data analysis, including to ensure data accuracy and quality and for insurance risk modelling and product and pricing refinement. For further information see Profiling and Data Analysis;
- Manage complaints, including to allow us to respond to any current complaints, or challenges you or others might raise later, for internal training and monitoring purposes and to help us to improve our complaints handling processes. We may be obliged to forward details about your complaints, including your Personal Information, to the appropriate authorities, e.g. the relevant ombudsman;
- Manage feedback and queries, and handle requests to exercise data subject rights. For further information see Data Rights;
- Manage our business operations, including by carrying out internal audits, quality assurance and training, financial analysis and accounting, producing management information and performing administrative activities in connection with the services we provide;
- Manage commercial risk, including by taking out and maintaining appropriate insurance and reinsurance;
- Comply with applicable legal, regulatory and professional obligations, including cooperating with regulatory bodies, e.g. the ICO, FCA and PRA and government authorities, to comply with law enforcement and to manage legal claims;
- Identify and support customers requiring additional support, to help us better meet your needs and to comply with regulatory guidance about how we meet your needs. Sometimes you or a third party may tell us that you have additional support requirements, and in other cases we may infer this from your Personal Information and our interactions with you;
- Establish, enforce and defend our legal rights or those third parties, including enforcing our terms and conditions, pursuing available remedies and limiting our damages.
- Carry out activities that are in the public interest, e.g. we may need to use Personal Information to carry out anti-money laundering checks;
- Buy, sell, transfer or dispose of any part of our business;
- Archiving, scientific or historical research or statistical purposes.
Lawful Bases for uses of Personal Information
- Performance of a contract – to arrange, underwrite or manage our products, or handle claims in accordance with their terms;
- Compliance with a legal obligation – to meet responsibilities we have to our regulators, tax officials, law enforcement, or other legal responsibilities;
- Legitimate interests – to operate and improve our products and services and keep people informed about our products and services or for any other purposes we identify as appropriate to our business needs, or those business needs of a third party;
- Consent – where we have obtained appropriate consents to collect or use your Personal Information for a particular purpose.
- To further our business and commercial activities and objectives, or those of a third party, e.g., to provide our products and services and produce management information on our performance and the performance of third parties;
- To help us better understand our customers and improve our customer engagement and marketing campaigns including by carrying out analysis and profiling, e.g. by making certain predictions and assumptions about your interests;
- To send you marketing information in accordance with your preferences, e.g. about other products and services we offer, and to administer promotions that you enter;
- To comply with our legal and regulatory obligations, guidelines, standards and codes of conduct, e.g., background checks or the prevention, detection and investigation of financial crime or fraud;
- To improve and develop our business, products and services, or those of a third party, e.g. to ensure the accuracy of customer data and to develop our pricing and risk methods and models;
- To retain your policy record for a period of time in order to ensure we have appropriate records in place in respect of any future claims that may be insured by us;
- To safeguard our business, shareholders, employees and customers, or a third party, e.g., maintaining the security of our IT network and information, enforcing claims, including debt collection;
- To facilitate the purchase, sale, transfer or disposal of any part of our business; and
- To analyse and assess competition in the market for our products and services, e.g., by carrying out market research.
Our lawful bases for the use of Personal Information:
|Purpose||Lawful Basis for Personal Information Processing|
|Communicating with you and others including complaints handling|| |
Performance of a contract
|Identifying customers requiring additional support|| |
Compliance with a legal obligation
|Evaluating your application or renewal or to provide a quote|| |
Performance of a contract
|Provision and administration of a policy including taking payment|| |
Performance of a contract
|Managing third party relationships e.g. brokers|| |
Performance of a contract
|Claims assessment and management of claims|| |
Performance of a contract
|Financial or other crime, fraud and credit checks|| |
Performance of a contract
Compliance with legal or regulatory obligations
|Compliance with a legal obligation|
|Establish, enforce or defend legal rights|| |
Compliance with a legal obligation
|Improving quality, training and security||Legitimate interests|
|Managing our business operations e.g. accounts, financial analysis, internal audit|| |
Compliance with a legal obligation
|Data analysis (including modelling)||Legitimate interests|
|Applying for or claiming on our insurance||Legitimate interests|
|Marketing and customer insight analysis, campaign planning etc||Legitimate interests |
|Marketing in accordance with your preferences and administering promotions||Legitimate interests |
|Buy, sell, transfer or dispose of our business||Compliance with a legal obligation |
|Archiving, research or statistical purposes||Legitimate interests|
We can only collect and use Sensitive Personal Information where we have an additional, specific lawful basis to process such information. We usually rely upon one of the following lawful bases where we process Sensitive Personal Information:
- Reasons of substantial public interest:
- insurance purposes – including advising on, arranging, underwriting and administering contracts of insurance, administering claims under a contract of insurance and exercising rights, or complying with obligations that arise in connection with contracts of insurance;
- complying, or helping someone else comply with, a regulatory requirement relating to unlawful acts and dishonesty - including regulatory requirements to carry out money laundering checks;
- preventing or detecting unlawful acts – including disclosures to competent authorities;
- preventing fraud – including investigating alleged fraud;
- safeguarding the economic well-being of certain individuals – including where we identify additional support required by our customers;
- equality of opportunity or treatment – including where we need to keep under review the equality of treatment of customers with additional support needs.
- Necessary to establish, exercise or defend a legal claim – including where we are faced with legal proceedings, we bring legal proceedings ourselves or where we are investigating legal proceedings that a third party has brought against you;
- Necessary to protect your vital interests or those of another individual;
- Information has been clearly or obviously made public by you.
Our lawful bases for the use of Sensitive Personal Information:
|Purpose||Lawful Basis for Sensitive Personal Information Processing|
|Communicating with you and others including complaints handling||Necessary for insurance purposes |
Necessary for safeguarding economic well-being of certain individuals
|Identifying customers requiring additional support||Necessary for safeguarding economic well-being of certain individuals |
Necessary for the equality of opportunity or treatment
|Evaluating your application or renewal or to provide a quote||Necessary for insurance purposes |
|Providing and administrating a policy, including taking payment||Necessary for insurance purposes|
|Managing third party relationships, e.g. brokers||Necessary for insurance purposes|
|Claims assessment and management of claims||Necessary for insurance purposes |
|Identifying or investigating financial or other crime and fraud||Necessary for insurance purposes |
Regulatory requirement relating to unlawful acts or dishonesty
Clearly or obviously made public by you
Prevent or detect crime
|Compliance with legal or regulatory obligations||Necessary for insurance purposes |
Regulatory requirement relating to unlawful acts or dishonesty
|Establishing, enforcing or defending legal rights||Legal claims|
|Improving quality, training and security||Legal claims |
|Managing our business operations, e.g. accounts, financial analysis, internal audit||Legal claims |
|Data analysis (including modelling)||Necessary for insurance purposes|
|Applying for or claiming on our insurance||Necessary for insurance purposes |
|Buying, selling, transferring or disposing of our business||Necessary for insurance purposes |
|Archiving, research or statistical analysis||Necessary for archiving, research or statistical analysis|
Where we cannot rely on one of the above lawful bases to process your Sensitive Personal Information for a particular purpose, we will seek your explicit consent.
If you would like to know more about the lawful bases we rely upon, or how the lawful basis of legitimate interests applies to a particular purpose, you can contact us.
4. Fraud and Other Financial Crime
We use your Personal Information to detect and prevent fraud and other financial crime including to meet our statutory and regulatory responsibilities in relation to fraud and financial crime.
If you’re making an application or a claim, we may use profiling and other forms of automated processing to assess if your application or claim may be fraudulent. This assessment may involve the use of Sensitive Personal Information. For further details, see Automated Decision Making.
We also use your Personal Information to help us detect fraud committed by brokers or financial advisers.
To prevent, detect and investigate fraud, we:
- check public registers (e.g. the electoral roll or registers of county court judgments, bankruptcy orders or repossessions);
- conduct online searches from websites, social media and other information sharing platforms;
- share Personal Information and undertake searches with other third parties, including other insurers, fraud prevention agencies, law enforcement agencies, public bodies and our regulators (which include the FCA, PRA and ICO).
This will help us verify your identity, make decisions about providing you with our products and related services e.g. paying claims and trace debtors or beneficiaries.
If you give us false or inaccurate information and we suspect fraud, we’ll record this to prevent further fraud and money laundering and this may be shared between insurers.
We can supply on request further details of the agencies and databases we access or contribute to and how this information may be used. If you require further details, please contact us.
5. Credit Reference Agencies
To ensure we have the necessary facts to assess your insurance risk, verify your identity, help prevent fraud and provide you with our best premium and payment options, we may need to obtain information relating to you at quotation, renewal and in certain circumstances where policy amendments are requested. We or our agents may undertake checks against publicly available information (e.g. electoral roll, county court judgments, bankruptcy orders or repossession(s)). Similar checks may be made when assessing claims.
Information about the credit reference agency we use and the ways in which they use and share Personal Information, are explained in more detail on the TransUnion website.
6. Automated Decision Making
We may use automated processes to make decisions. These automated processes use data provided by you, other records we hold about you in our systems and data sourced from third parties to make predictions, including the likelihood that a claim will be made and its value, the likelihood a product will be purchased and the likelihood that a claim might be fraudulent. This helps us to determine eligibility for a policy, the terms of the policy and whether we can provide cover for medical conditions disclosed to us, the price, and whether we can provide you with a monthly credit payment option.
In order to provide you with a price for your insurance policy, the following steps are taken:
- You provide us with data: The first step is that you tell us who you are and what type of insurance you are looking for, e.g. single trip travel insurance for a week in Europe.
- We enrich the data you have provided: Once you have provided us with data, we carry out checks to validate this data (e.g. confirming your identity) and enrich it with data from third party sources. Information on the third party data sources we use is set out above in Types of Personal Information collected. For example, where you declare a pre-existing medical condition we use third party information to assess how much risk the medical condition poses.
- We calculate your insurance risk: We use statistical modelling techniques to assess the data in order to predict the likelihood that a claim will be made and the likely severity of a claim. This assessment is based on various factors including information about the area you are planning to visit. For example, if you are travelling to an area where the cost of medical treatment is high, this may lead to a higher premium. All insurers will use different weightings to price insurance and this is confidential to each insurer.
- Provision of the final price: Once we have a view of your insurance risk we can provide you with a final price, which will include any commission payments and insurance premium tax.
Where you are provided with cover as part of an arrangement with one of our business partners, e.g. your bank, we will not make any automated decisions when your insurance policy starts unless you declare a medical condition. If you declare a medical condition, we may carry out some automated decision making to decide whether we can provide cover, and on what terms, for that medical condition.
Your personalised price may be presented to you in suitable marketing communications, including those sent from price comparison websites or third party partners with whom you have a relationship.
We also make automated decisions throughout the life of your policy, e.g. before offering you a renewal or when dealing with a claim.
Where we make an automated decision using Personal Information which has a legal or substantially similar effect, you have certain rights in relation to that decision. In particular, you have the right to receive meaningful information about the logic involved in relation to the decision, the right to human intervention and the right to obtain an explanation of the decision and challenge it. For more information about this right and how to exercise it please see Data Rights.
7. Profiling and Data Analysis
We use profiling and other data analysis to build, train and audit our insurance models and algorithms (including those used in our Automated Decision Making) and our machine-learning tools. The models, algorithms and tools we use help us do a number of things including:
- understanding our customers and potential customers better, e.g. how they feel about Aviva, what kind of content or products would be of most use and interest to them, whether they might be displaying characteristics meaning that they may require additional support from us; and
- predicting the likelihood of events arising to assess insurance risk, the likelihood a product will be purchased or to predict if a claim might be fraudulent.
We may also use profiling and data analysis for other reasons, e.g. to ensure data quality and accuracy and to help us improve our business.
The purpose of this analysis is not to make decisions about you directly, but your Personal Information, in combination with Personal Information relating to other customers, potential customers and/or data provided by third parties, will be used to conduct data analysis so that we can improve our processes, our products and services and check the way our models, algorithms and machine-learning tools work. The Personal Information you submitted to obtain a quote from us may be used for this analysis whether or not you decided to purchase the product.
Where possible, we pseudonymise the data in order to perform this analysis. This means that we remove information from which you can be directly identified, e.g. your name and replace it with a pseudonym or unique identifier. We do this to maximise the security of your information.
We also use profiling in relation to marketing. For further information please see Marketing.
To support us in managing how long we hold your data and our record management, we maintain a data retention policy which includes clear guidelines on data retention and deletion.
If you would like more information about our data retention policy, please contact us.
9. International Data Transfers
Sometimes we, or third parties acting on our behalf, may need to transfer Personal Information outside of the UK. We’ll always take steps to ensure that any transfer of Personal Information outside the UK is carefully managed to protect your privacy rights and ensure that adequate safeguards are in place. This might include transfers to countries that the UK considers will provide adequate levels of data protection for your Personal Information (such as countries in the European Economic Area) or putting contractual obligations in place with the party we are sending information to. Transfers within the Aviva group will be covered by an agreement entered into by members of the Aviva group (an intra-group agreement) which contractually obliges each group company to ensure that your Personal Information receives an adequate and consistent level of protection wherever it is transferred within the group.
For more information about data transfers and the safeguards we have put in place, please contact us.
We may use Personal Information to send you direct marketing communications about our products and services that we feel you’ll be interested in. This may include marketing relating to products offered by other brands or companies within the Aviva group as well as communications about promotions and prize draws.
Marketing communications may be sent by email, post, SMS, telephone and push notification. You may also see display advertising on websites, mobile applications, social media, television or in online search results.
You have control over our use of your Personal Information in relation to marketing communications. You can:
- ‘Opt out’ of receiving direct marketing. When you register with us, request an online quote, or purchase a product or service you will be given the opportunity to opt out. In addition, our email, post, SMS and telephone marketing communications include information to help you manage your marketing preferences;
- Change your marketing preferences at any time by e-mailing us at firstname.lastname@example.org or writing to us at Aviva, Freepost, Mailing Exclusion Team, Unit 5, Wanlip Road Ind Est, Syston, Leicester, LE7 1PD. If you are registered for MyAviva you can change your marketing preferences at any time from within your account.
Please note that opting out of one type of marketing, e.g. by email or telephone, doesn’t mean you will be opted out of all marketing. Bear this in mind when you manage your preferences. You can always contact us directly if you would like us to stop all forms of direct marketing.
We try to limit marketing and only send you offers and promotions that you might be interested in, based on Personal Information we have about you and profiling that we have carried out (further details can be found under the sub-heading ‘Marketing profiles’ below).
Please remember that if you opt out of receiving marketing, we will still send you communications relating to your products. If you choose to opt out of tailored offers and advertising, you may still see generic advertising displayed online and in MyAviva, it just might not be as relevant to you.
Cookies and similar technologies
We rely on third-party advertising technology (such as the deployment of cookies or small text files on our website or pixels within emails) to collect information about you. This technology is used to optimise what you may see on our websites and deliver content when you are browsing elsewhere. We may also collect information about your use of other websites. We do this to provide you with advertising that we believe may be relevant for you, as well as to improve our own products and services.
Social media and online platforms
We share Personal Information with media agencies and social media and other online platforms to help us target our online marketing. Social media and other online platforms may also use Personal Information they hold and combine it with Personal Information received from us to create target audiences. These are audiences that we think would be interested in our online advertising. This may involve social media and other online platforms building a ‘lookalike’ profile of the type of person we are trying to target and providing specific adverts to those people when they browse the internet or use social media.
If we use or share Personal Information with third parties in order to send you direct marketing, we will respect the marketing preferences you have set. We recommend you routinely review the privacy notices and preference settings that are available to you in MyAviva and any online platforms and smart devices you use as they will dictate how adverts and other messages are displayed and shared across those platforms.
We use automated processes to help us provide more personalised marketing of our products. To do this, our automated process creates a marketing profile for you using information such as:
- identification data;
- behavioural data (e.g. data relating to your use of our website);
- your gender and age;
- contact data;
- status data (e.g. number of children in household);
- product related data (e.g. policy identifiers);
- device and vehicle-related data.
Our process analyses this data to determine the most relevant products, services, offers or benefits to offer you and to decide the appropriate time and channel for offering them to you.
Information obtained in relation to one product may be used in relation to marketing other products from the Aviva group.
Promotions and prize draws
We occasionally run promotions and prize draws for our customers and third parties. Our communications to you about these promotions before you enter them are marketing. If you opt out of receiving direct marketing, you will not receive communications about promotions and prize draws.
We may use your Personal Information to select you as a winner, inform you of promotion outcomes and send prizes to your nominated address. We may use third party fulfilment partners to assist us in administering promotions, including contacting you on our behalf. In accordance with the rules of the Advertising Standards Authority, we may publish or make publicly available information that indicates that a valid award has taken place. If we do this, only your surname, country and, if applicable, your winning entry, will be published. You have the right to object to this use of your Personal Information.
11. Data Rights
You have legal rights under data protection laws in relation to your Personal Information. Read below to learn more about each right you may have.
We may ask you for proof of identity when you make a request to exercise any of these rights. We do this to ensure we only disclose information to the right individual.
We aim to respond to all valid requests within one month. It may take us longer if the request is particularly complicated or you have made several requests. We’ll always let you know if we think a response will take longer than one month. We may also ask you to provide more detail about what you want to receive or are concerned about.
We may not always be able to do what you have asked. This is because your rights will not always apply, e.g. if it would impact the duty of confidentiality we owe to others, or if the law allow us to deal with the request in a different way. We will always explain to you how we are dealing with your request. In some circumstances (such as the right to erasure or withdrawal of consent), exercising a right might mean that we can no longer provide our product to you.
Your rights are as follows:
Access to your Personal Information
You may ask us for a copy of your Personal Information together with specified details about how we use your information. This is commonly known as a ‘subject access request’.
If your request is made electronically, we will, where possible, respond to you electronically. Otherwise, we will normally respond in writing unless you request otherwise.
Rectification of your Personal Information
We do our best to ensure that your Personal Information is accurate and kept up to date. If you believe your information is inaccurate or incomplete, then please contact us to request that we amend or update it.
Erasing your Personal Information
You may ask us to erase your Personal Information, but this right only applies in certain circumstances, e.g. where:
- it is no longer necessary for us to use your Personal Information for the original purpose;
- our lawful basis for using your Personal Information is consent and you withdraw your consent; or
- our lawful basis is legitimate interests and there is no overriding legitimate interest to continue using your Personal Information if you object.
This isn’t an absolute right and we have to balance your request against other factors such as legal or regulatory requirements, which may mean we cannot erase your Personal Information.
Restricting processing of your Personal Information
You may ask us to stop using your Personal Information in certain circumstances such as:
- where you have contacted us about the accuracy of your Personal Information and we are checking the accuracy;
- if you have objected to your Personal Information being used based on legitimate interests.
This isn’t an absolute right and we may not be able to comply with your request.
In some cases, you can ask us to transfer Personal Information that you have provided to us to another third party of your choice. This right only applies where:
- we have justified our use of your Personal Information based on your consent or the performance of a contract with you; and
- our use of your Personal Information is by electronic means.
Right to object
You can object if you no longer wish to receive direct marketing from us. Please see Marketing for further information.
You may also object where you have grounds relating to your particular situation and the lawful basis we rely on for using your Personal Information is our (or a third party's) legitimate interests. However, we may continue to use your Personal Information where there are compelling legitimate grounds to do so.
Automated decision making and profiling
You have the right not to be subject to a decision using your Personal Information which is based solely on automated processing (without human involvement) where that decision produces a legal effect or otherwise significantly affects you. This right does not apply if the decision is:
- necessary for the purposes of a contract between us and you;
- authorised by law (e.g. to prevent fraud); or
- based on your explicit consent.
You do however have a right to request human intervention, express your view and challenge the decision.
In some circumstances we ask for your consent to use your Personal Information. You are free to withdraw your consent at any time.
If it is the case that we need your consent to provide you with a particular product and you wish to withdraw your consent, we may no longer be able to provide our product to you. Where that is the case, we will inform you before taking any action.
12. Contacting Aviva
Write to: The Data Protection Team, Aviva, PO Box 7684, Pitheavlis, Perth PH2 1JR
Email us: DATAPRT@aviva.com
If you'd like to submit a subject access request, please fill out this form or write to us at the above address.
If you’re not happy with the way we’re handling your Personal Information, you have a right to make a complaint with your local data protection supervisory authority at any time. In the UK this is the Information Commissioner's Office (ICO). We ask that you please attempt to resolve any issues with us before contacting the ICO.