Privacy Notice
This privacy notice is issued on behalf of the WiseChoice Insurance Agency in Malawi. When we mention “WiseChoice”, “we”, “us” or “our”, what we mean is the relevant company in the WiseChoice Insurance Agency that processes your personal information. Additional details about the WiseChoice Insurance Agency are set out below.
About this document
This Privacy Notice will help you understand how we collect, use and protect your personal information. You should also show this notice to anyone who is included in your policy, and anyone else whose details you provide to us.
We may need to make changes to this privacy notice, for example, to include legislation changes, new technologies or other developments in privacy laws. You should check our website periodically to view our most up to date privacy notice. If you have any queries about this Privacy Notice or how we process your personal information, please contact the Data Protection Officer on Contact us page
Who we are
When you buy insurance policies the organisation responsible for the processing of your personal information is WiseChoice Insurance Limited. This means that we are a ‘Data Controller’ under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, referred to in this document as Data Protection Legislation. Additional data controllers include Underwriters identified in your policy booklet. We may also partner with other companies providing you with insurance and insurance related services.
WHAT INFORMATION WE COLLECT ABOUT YOU
The personal data you have provided, we have collected from you, or we have received from third parties includes:
• name, address and address history, date of birth and gender
• contact details, including telephone numbers and email address
• financial information, including bank details (although we do not retain complete payment card information)
• details about your family and dependents (e.g. your marital status and number of children)
• information about your lifestyle and living circumstances (e.g. your employment details and home ownership)
• sensitive personal information such as criminal convictions, health details and medical history for the purposes of providing you with a policy or processing claims, or details of any court or judgements for the purposes of preventing, detecting and investigating fraud.
• information about your marketing preferences
HOW WE COLLECT INFORMATION ABOUT YOU
Most of the personal information we hold about you is that which we collect directly from you, for example:
• each time you ask us for an insurance quote
• when you purchase our products or services
• when you register to receive information from us
• when you register a claim and discuss that claim with us as it progresses
• each time you interact with us, respond to communications or surveys, or enter competitions
• when you make enquiries or raise concerns with our customer service team.
In order to understand more about you and provide you with an appropriate insurance quote and cover, and to improve our marketing interaction, we also supplement and combine the personal information that we collect from you with other categories of data obtained from other sources.
WHAT WE USE YOUR INFORMATION FOR AND THE LEGAL BASES FOR PROCESSING
We may store and use your personal information for the purposes of:
(a) administering your insurance quotes and policies (as is necessary for performance of a contract between you and us and/or as is necessary for our legitimate interests);
(b) carrying out anti-fraud and anti-money laundering checks and verifying your identity (as is necessary for compliance with our legal obligations and/or as is necessary for our legitimate interests);
(c) assessing financial and insurance risks
(d) providing you with insurance cover and related services including financing services (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);
(e) using your bank details to process payments relating to your policies, including fees, premiums, renewals of cover, mid-term changes to your policy, and refunds (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);
(f) sending you information about how to renew your insurance cover (as is necessary for compliance with our legal obligations);
(g) handling insurance claims, including by carrying out checks on claims related databases (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);
(h) communicating with you about your quotes, policies, and claims, including responding to your enquiries (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);
(i) administering debt recoveries and helping us with recovering monies you owe us under a contract or otherwise (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests);
(j) undertaking market research and statistical analysis, including analysing your use of our website. This allows us to underwrite and price your insurance policy, and to develop new, or improve existing, products and services (as is necessary for our legitimate interests); and
(k) fulfilling our obligations owed to a relevant regulator, tax authority or revenue service (as is necessary for compliance with our legal obligations and/or as is necessary for our legitimate interests).
Our “legitimate interests” as referred to above (and below) include our legitimate business purposes and commercial interests in operating our business in a customer-focused, efficient and sustainable manner, in accordance with all applicable legal and regulatory requirements.
USING YOUR PERSONAL DATA FOR MARKETING
We will send you marketing about similar products and services by post, telephone, email, SMS and through digital channels. Digital channels include social media and similar such digital marketing channels. We may upload and match the personal data you provide to us with the data you provide to social media and similar such digital marketing channels. This allows us to improve our knowledge of you and, in return, serve you with relevant marketing messages. We may contact you If we consider that it is within our legitimate interests to send you information about our products and services for marketing purposes.
You can object to receiving marketing from us at any time. Please provide your details via the contact us form; send us your name, address and date of birth
USING YOUR DATA FOR FRAUD PREVENTION
Before we provide you with our products and services, we use your personal data to conduct checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you. We may also share your details with fraud prevention and law enforcement agencies.
Please see ‘other data controllers’ for details of the agencies we share your data with. We, and fraud prevention agencies, will use this information to prevent fraud and money laundering, and to verify your identity. We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
When we and fraud prevention agencies process your personal data, we do so on the basis that we have a legitimate interest to process your data in such way, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested.
We may also share your details with third parties who operate and maintain fraud detection registers for the purposes of preventing and investigating fraud.
CONSEQUENCES OF PROCESSING
If we, or a fraud prevention agency, determine that you pose a risk of fraud or money laundering, we may refuse to provide the products, services and financing you have requested. We may also stop providing existing services to you. A record of any fraud or money laundering risk will be retained by us and the fraud prevention agencies. It may also result in others refusing to provide products, services, financing or employment to you. If you have any questions about our processing of your data for fraud purposes, please contact us.
WHO WE SHARE YOUR DATA WITH
Where relevant given the nature of the products and services provided to you, we may also share your information with the following categories of third parties which may act as controllers or processors of your data:
• insurance and reinsurance underwriters, intermediaries and others who are involved with the provision of insurance services to you alongside us (as is necessary for the performance of a contract between you and us);;
• third party product providers who provide products or services (e.g. optional cover) you obtained a quote for or purchased alongside the products and services provided by ‘us’.
• third party service providers who we instruct for the purposes of handling claims, including repairers, surveyors, loss adjustors, solicitors, third parties involved in the claim, other insurers, medical agencies (as is necessary for the performance of a contract between you and us);;
• third party service providers who may add value to the products and services we provide (as is necessary for our legitimate interests);
• third party data suppliers, as explained under “How we collect information about you” (as is necessary for our legitimate interests);
• third party service providers who support the operation of our business, such as IT and marketing suppliers, financial service providers, and debt collection agencies. Your data will be linked to the data of your spouse, any joint applicants or other financial associates.
• the operators of claims related databases (as is necessary for the performance of a contract between you and us and/or as is necessary for our legitimate interests).
• fraud prevention agencies and associations and other third parties who operate and maintain fraud detection registers, (as is necessary for compliance with our legal obligations and/or as is necessary for our legitimate interests); regulators and law enforcement agencies, including the police.
• MRA or any other relevant authority who may have jurisdiction (as is necessary for compliance with our legal obligations).
As explained under “Using your data for fraud prevention”, the personal data you have provided, we have collected from you, or we have received from third parties, may be shared with fraud prevention agencies.
PROCESSING OUTSIDE OF MALAWI
The personal information that we collect from you, and which is shared with some fraud prevention agencies, may be transferred to and processed in a destination outside of the Malawi. It may also be processed by staff operating outside the Malawi who work for one of our suppliers. In these circumstances, your personal information will only be transferred on one of the following bases:
• the country that we send the data is approved as providing an adequate level of protection for personal information; or;
• the recipient has agreed with us standard contractual clauses approved by the European Commission or the Information Commissioner’s Office, obliging the recipient to safeguard the personal information (in particular, our transfer of personal information to suppliers in India and the United States for marketing, IT development and IT testing purposes are protected in each case by the use of appropriate model clauses); or
• there exists another situation where the transfer is permitted under applicable Data Protection Legislation (for example, where a third party recipient of personal data in the United States has registered for the EU-US Privacy Shield)
HOW LONG YOUR INFORMATION IS KEPT
Where necessary we will retain your personal information for a number of purposes, to allow us to carry out our business. Your information may be kept for up to 7 years on our main systems after which time it will be archived, deleted or anonymised. Some of the archived information may be retained for up to 50 years for the purposes of processing of your existing or future claims. Records created for fraud prevention purposes will be deleted 7 years after creation. Fraud prevention agencies can hold your personal data for different periods of time, depending on how that data is being used. If you are considered to pose a risk of fraud or of money laundering, your data can be held by fraud prevention agencies for up to 6 years from its receipt by them. Please contact them for more information. Any retention of personal data will be done in compliance with legal and regulatory obligations and with industry standards. These data retention periods are subject to change without further notice as a result of changes to associated law or regulations. If you have any questions in relation to the retention of your personal data, please contact us.
YOUR RIGHTS
Data Protection legislation gives you certain rights. These include the right to:
• ask us how we use your personal data
• access your personal data
• ask us to correct any information about you that’s out of date, incorrect or incomplete
• tell us that you don’t want us to use your personal data in a certain way – e.g. to send you marketing communications
• tell us to delete personal data we have on file. In some circumstances we won’t be able to do this however – e.g. if we’re required to keep the information by law
• ask us to give your data to a 3rd party – e.g. another insurer
• ask us to temporarily pause processing your data
• not hold you to a decision that’s been made solely in an automated way
• ask us to review automated decisions we make about you
Please note, these rights are not absolute and there may be times when we can’t do what you ask us to. If that’s the case, we’ll explain why when we reply to you. If you have a question about this Privacy Notice, how we use your personal information, or if you’re not happy with how we process your personal information, please contact us.
Without your consent in some circumstances, we may not be able to provide you with cover under our policy or handle claims or you may not be able to benefit from some of our services.