Privacy Policy

This Privacy Policy was last modified in September 2023, and should be read together with the Terms of Use of the website (the “Site”).

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING THE SITE. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU MUST NOT USE THE SITE. BY USING THE SITE YOU ARE ACKNOWLEDGING THAT YOU HAVE READ, UNDERSTOOD AND CONTRACTUALLY AGREE TO BE BOUND BY THIS PRIVACY POLICY.

Coralisle Group Ltd. and its subsidiaries (referred to as “CG”, the “Company” or the “Group”) are committed to maintaining a robust data privacy and protection framework to ensure compliance with the relevant rules and regulations that govern data privacy and protection in our jurisdictions of operations (i.e. Personal Information Protection Act 2016 in Bermuda, Data Protection Act in the Cayman Islands etc.).

At CG, the privacy and protection of our customers personal information is of utmost importance to us. We understand that when you select CG as your insurance or pension provider, you place trust in us to safeguard your personal information. Our commitment is to maintain transparency and honesty by informing you about our practices concerning the collection, utilization, and protection of your data.

This Privacy Policy/Notice (the “Privacy Policy”), together with our website’s Terms of Use, sets out how and why CG collects and processes your personal information we collect through:

• This CG-operated Site, the software applications made available by us for use on or through computers, mobile devices or other Internet-connected devices; and/or
• Our products or services – information can be gathered from various sources, such as your application and claim forms, phone conversations, email exchanges, and other forms of communication between us.

As part of this commitment we would like to share with you our guidelines for the collection and protection of your information, and thereby secure your consent and agreement to this Privacy Policy. Also, where necessary, we will direct you to our Privacy Policy and ask you to confirm your consent to us processing your personal data for the purposes specified here and in other documentation you receive.

CHANGES TO OUR PRIVACY POLICY

Please note that this Privacy Policy may be reviewed and amended as and when CG deems necessary to provide for the continued accuracy and protection of our valued customers' personal information. CG reserves the right to modify this Privacy Policy from time to time without notice. Any amendments to the Privacy Policy will take effect immediately upon posting on this Site. The date of the last update will be clearly indicated at the top of this page. Your continued use of the Site following the posting of any revised Privacy Policy shall be deemed to conclusively indicate your acceptance of such revised Privacy Policy. Accordingly, you should periodically re-review this Privacy Policy.

What are your rights?

Depending on the data protection legislation that applies to the processing of your personal data, you may possess certain rights of your Personal Data. The determination of which data protection legislation applies is generally based on your residency and/or the location where your data is being processed. You can ask us to do various things with your personal information. For example, at any time you can ask us for a copy of your personal information, ask us to correct mistakes, change the way we use your information, or even delete it. You can make any of the requests set out below using the contact details provided to you in your documentation. Your rights, subject to relevant laws and regulations, may encompass the following:

Right to be informed

This encompasses the obligation for us to be transparent in how we collect and use your personal data.

Right of access

You have the right to access a copy of the personal data and supplementary information we hold about you and certain details of how we use it. Your personal data will usually be provided to you electronically where possible. Where not possible, or where otherwise agreed, we will provide your personal data in another format (i.e. in writing, audio recording etc. where applicable).

Right to rectification

We take reasonable steps to ensure that the personal data we hold about you is accurate and, to the extent necessary, complete. However, if you believe the information we hold on you is inaccurate or incomplete, you can request we correct this. please contact us and you can request us to update or amend it.

Right to erasure

In certain circumstances, you have the right to request we delete or remove personal for example where the personal information we collected is no longer necessary for the purpose for which we have told you we will use it, or where you withdraw your consent if that is our legal ground for processing the information. However, this will need to be balanced against other factors, for example according to the type of personal data we hold about you and why we have collected it. There may be a legal and regulatory reason which means we cannot comply with your request.

Right to restrict processing

In certain circumstances, you have the right to request we cease processing your data, if:

• You consider it inaccurate or incomplete.
• You think that we no longer need to process your personal data.
• Where we don’t need the data for the original reason we collected it, but may need us to keep it for legal reasons.

Right to data portability

In certain circumstances, you have the right to ask that we transfer any personal information that you have provided to us to another third party of your choice. Once transferred, the other party will be responsible for looking after your personal information.

Right to object

You have the right to object to our processing under certain circumstances.

To exercise these rights or to find out if these rights will apply then please contact us using the contact details set out in this Privacy Policy.

If you are unhappy with the way we have used your Personal Data or our response to any request by you to exercise any of your rights in the section above, or if you think that we have breached the applicable data protection legislation, then you may have the right to complain to the relevant data protection supervisory authority.

How we collect your Personal Data?

• You, such as when you submit applications or forms to apply for our products or services (e.g. name, address, employment, birth date, gender, income).
• You, your employer and/or plan sponsor if CG provides them with certain products or services (for example, group health or pensions).
• Transactional activity in your account (e.g., trading history).
• Quotes, feedback forms and surveys.
• Other insurance market participants to whom you provide personal data (e.g. brokers, (re)insurers, healthcare providers);
• A claim, third parties including the other party to the claim (claimant / defendant), witnesses, experts (including medical experts), loss adjustors, solicitors, and claims handlers.
• Publicly available information such as court judgments, fraud databases, government databases, credit reference agencies, social media, websites etc.
• Other sources with your consent or with the consent of your representative (for example, from other institutions if you transfer into the CG Group).
• Individuals that may be associated with (e.g. joint account holders, company employees or directors, family members etc.).
• Your particular circumstances will determine which sources apply.

What Personal Data do we collect?

The types of personal data we collect will depend on the nature of the relationship you have with us (i.e. policyholder, insured, product type, claimant, witness, broker, appointed representative, beneficiary etc.). If we need information about other people named on your policy, we may ask you to provide the information below in relation to those people too. We may collect and process different kinds of personal data about you, including, but not limited to the following:

How is your personal data used and processed?

We may process your personal data for a number of different purposes, including to deliver and manage our products and services we provide to you. Under data protection laws we can only process your information where we have a lawful basis for doing. We have set out below the main reasons why we process your personal information and the applicable circumstances when we will do so.

Quoting / Provision of Insurance Cover

Policy Administration

Claims Processing

Policy Renewals

Complaints Handling

Pension Services

Other

We will use your personally identifiable information to, among other things, serve you better, process your enquiry or application for each product or service together, and respond to your enquiries regarding CG. We may also use this information to inform you of any changes to our product and service offerings and pricing structures.

The information that we collect and retain is used to create an accurate view of each individual valued customer. In many cases the information we collect helps us to customize a product or service to meet our customer's individual needs.

Direct Marketing

CG presently conducts direct marketing activities offering suggestions, recommendations and insights regarding our products and services that we think may be of interest to you. We may contact you via post, telephone, e-mail, social media or through our business portals. We do so on the basis of our legitimate interests or consent where obtained. You have the option to unsubscribe from marketing communications at any time by contacting us through the "Contact us" section.

Special Categories of Personal Data

When the personal information we process about you is classed as sensitive personal information (criminal offences information and ‘Special Category Personal Data’ such as your health, sexual orientation and ethnic origin), we must have an additional legal condition for such processing, including the substantial public interest condition for the insurance industry or, where necessary, we will ask for your consent.

However, processing of personal and sensitive personal information is necessary in order for us to provide your insurance policy and/or pension policy, benefits or other services, such as assessing your application and setting you up as a policyholder, or trust beneficiary, administering and managing your insurance policy or benefits, providing all related services, providing a quote, handling and paying claims and communicating with you. In these circumstances, if you do not provide such information, we may not be able to offer you a policy, service or process a claim.

What other information is collected? How is it used?

Certain Information You Provide in Communications via the Site

We do not consider any information other than personally identifiable information communicated to Coralisle (e.g., questions, comments, ideas or suggestions) confidential and we have no obligations of confidentiality to you and disclaim any such obligations with respect to such information. You understand that anything you transmit to Coralisle may, subject to applicable law, be used by Coralisle for any purpose and you hereby grant to us to use, including reproduce, disclose, transmit, publish, broadcast and post such information. Furthermore, Coralisle is free to use any ideas, concepts, know-how, processes or techniques contained in any communication you send via any Site (including via any email address posted on any Site) for any purpose whatsoever including, but not limited to, developing, manufacturing, marketing, and selling products and services using such ideas, concepts, know-how, processes, or techniques.

Additional Information Collected by Coralisle on the Site

Coralisle may, or may engage an independent organization, to collect certain information in anonymous and/or aggregate form in order to collect data such as the total number of visits to our Site and the number of visitors to each page of our Site. We use this information to understand how visitors use the Site so that we may improve it. We may also share this anonymous and/or aggregate information with Coralisle's affiliates, subsidiaries, and third parties (as described in this Privacy Policy). You understand that such information is not personally identifiable information and that we have no obligations of confidentiality to you with respect to such information.

Profiling and automated decision making

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

CG performs profiling of your personal data to:

• Determine whether the premium amount matches the associated risk of the customer and product; and
• Help identify and understand fraud or suspicious activity patterns.

Automated decision-making is the process of making a decision by automated means without any human involvement. These decisions can be based on factual data, as well as on digitally created profiles or inferred data. Some of our decisions are made automatically by computer systems/technology (rather than by our employees) and based on your personal information. We recognize that sometimes these decisions can have a legal or similarly significant effect on you and when they do, you can ask us to provide an explanation and ask for a member of staff to review the decision:

Policy Underwriting

CG Insurance

• Where you use any of our Quote and Buy applications on any of our Site, the generation of insurance quotations and the decision by us to sell certain insurance products is done using personal data provided by you to make an automated decision on eligibility and premium.
• We use the personal information that you and others provide to us about you, your family, property, where you live, your policy, claims history, and other non-personal information such as garage repair costs to determine your premium and eligibility. We also use information about how long you have been a customer, how many claims you have made and how much you pay in premiums to determine what terms you are offered at renewal.

Claims Processing

CG Medical

• We may use automated processing to assess who is at fault for a claim and / or whether your claim is eligible for payment.
• Eligibility for payment of a healthcare provider invoice is based on whether your policy is active at the time of your claim and/or incur a cost for which there is a claim and if so whether or not the claim or cost is covered under the terms of your policy.

CG Insurance

• We may use automated processing to assess who is at fault for a claim and / or whether your claim is eligible for payment.

Anti-Money Laundering, Sanctions & Fraud Prevention

• CG uses automated anti-fraud, anti-money laundering and sanction filters that check against lists of people known to have undertaken fraudulent transactions or are sanctioned individuals or entity’s and will reject those applicants on the basis they are likely to defraud the company.

Should you request us to provide more information on automated decision-making, and to verify whether a decision has been made correctly, we will act in accordance with the applicable data protection law.

Sharing of Personal Data

In order to provide our products and services your personal data may be shared with other companies in the CG group. Additionally, we may pass your personal data on to third-party service providers contracted to CG in the course of dealing with you. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only for the legitimate reasons they were obtained for originally. When they no longer need your data, they will dispose of the details in line with CG’s procedures as set out in the contracts signed with them. If we wish to pass your sensitive personal data onto a third party we will only do so once we have obtained your consent, unless we are legally required to do otherwise.

The following is a non-exhaustive list of third parties we may disclose your Personal Data under certain circumstances:

• Other Companies in the CG Group – we may share your personal data with other CG group companies who may use this data for the purposes described in this Privacy Policy.
• Service providers, contractors, or agents appointed by us - we may disclose personal data to service providers or agents who perform services and other business operations on our behalf. These may include IT and analytics providers, medical specialists and hospitals, actuarial service entities, auditors, advisors, claim adjustors and administrators, brokers, reinsurers etc.
• Insurance market participants – financial institutions and business partners who utilize your personal data in connection with providing insurance services or related products.
• Family member, relatives, guardian or power of attorney – when someone else is acting on your behalf where you are incapacitated or unable.
• Any law enforcement agency, court, regulator, competent authority, governmental or professional body – We may share your personal data with these parties when we believe it is necessary or advisable to comply with legal or regulatory obligations or to protect our rights or the property of the CG Group.
• Acquisition/Takeover – In the event of a sale, transfer, or contemplated restructuring of all or a significant portion of our assets and business, we may disclose your personal data to any third party involved in the transaction. We will make reasonable efforts to ensure that the receiving entity utilizes the personal data in a manner consistent with this Privacy Policy.

Retention of data

We keep your personal information for as long as reasonably necessary to fulfil the relevant purposes set out in this Privacy Policy and in order to comply or demonstrate compliance with our legal and regulatory obligations. The time period we retain your personal information for will differ depending on the nature of the personal information and what we do with it.

Securing your information

CG places great importance on the security of all personally identifiable information associated with our customers. We have security measures in place to attempt to protect against the loss, misuse and alteration of customer data under our control. While we cannot ensure or guarantee that loss, misuse or alteration of data will not occur, we use our best efforts to prevent this through implementing the following:

• IT Security Policy and Procedures.
• IT Risk and Control Register.
• Active directory group policy with access control, password complexity/history controls, patching, windows updates and auditing policies.
• Physical protection of CG Data Center and workplace.
• Data center monitoring and notification system
• Firewalls with limited and controlled access
• File server access controls.
• Hardware and software Vendor SLAs, signed NDA when required.
• Security Penetration testing and venerability assessment by a third party.
• Backup data encryption.
• Employee training.
• Periodic security audits.

Non-personal information

We may collect non-personal information about you such as the type of internet browsers you use or the Website from which you linked to our Site. You cannot be identified from this information and it is only used to assist us in providing an effective service on this Site. We may disclose aggregate statistics about our Site users to prospective partners, advertisers and other reputable third parties, but these statistics will include no personally identifying information.

Log Files

As is true of most website hosts, CG gathers certain information automatically and stores it in log files. This information includes user's Internet protocol (IP) addresses, browser type, Internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data. CG uses this information, which does not identify individual users, to analyze trends, administer the Site, and track users' movements around the Site. We do not link this automatically-collected data to personally identifiable information.

Cookies

A “cookie” is a piece of information that a web server may place on your computer when you visit a website. Cookies are commonly used by websites to improve the user experience. Many cookies last only through a single website session or visit (session cookies). Others may have an expiration date or may remain on your computer until you delete them (persistent cookies).

This Site (cgcoralisle.com) uses cookies. We use both session cookies and persistent cookies for many purposes, such as: maintaining continuity during a user session; gathering data about the usage of our Site for research, marketing and other purposes; to enable our servers to recognize your computer so that your preferences and/or authentication credentials will be recognized to avoid repeated information gathering; to track and measure the number of Site visits and page views; to track the time spent on our Site; to otherwise track visitor behavior on our Site so that we can evolve the operational features of our Site to satisfy the demands of the visitors; and, to allow us to manage the load distribution of traffic on the Site.

You agree and acknowledge that you can decide if, and how, your computer will accept any cookies by configuring your cookie preferences in your browser. You agree that if you choose to reject cookies, you may not be able to use this Site, or certain of our Site's features. You also agree that we may use other persons or businesses to enable cookies on our Site to gather information on our behalf. Those persons or businesses may operate hardware, software or services on our behalf which will also use cookies that are enabled on our Site, which will be used for the same purposes we have described. You agree that the information that we gather, and that is generated by, the cookies we deploy may be transmitted by, stored, processed and analyzed by other persons and businesses on our behalf.

Some of the features of this website may rely on services offered by third-party websites, which may include, in particular:

• Sharing buttons (Facebook, LinkedIn and Twitter)
• Integrated tweets (Twitter)
• Interactive timelines (Facebook, Instagram, LinkedIn and Twitter)
• Videos (Youtube)
• Cookies and Pixels

These features use these third parties' cookies, which are placed by these services onto your computer allowing them to track your browsing. Such features may enable the social media to identify you and see your browsing on this Site if your session on the relevant social media is opened on your device when you use this Site. You agree to check the relevant social media website(s) for more information about their privacy policies and these cookies.

By using cookies, we collect and process your personal data as a controller. You have certain rights regarding the personal data we hold about you, subject to local law. These may include the rights to access, correct, delete, restrict or object to our use of, or receive a portable copy in a usable electronic format of your personal data, and to lodge a complaint with your local data protection or privacy regulator. Depending on your jurisdiction, you may also have the right to provide instructions regarding the handling of your personal data after your death. You agree that we may modify or update this Cookie policy and terms from time to time. If we change this Cookie policy and terms, we will notify you of the changes. Where changes to this Cookie policy and terms will have a fundamental impact on the nature of the personal data processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).

Links to Other Websites

CG may place hypertext links on the Site that connect to third party websites. This Privacy Policy does not cover the links within this Site linking to other websites which are not controlled by us. You understand and agree that CG has no control over these third-party websites, their content, or their terms of use and privacy policies. We are not responsible for the collection or use of your Personal Information from these third-party websites. Your use of such linked sites will be subject to such websites' terms of use and privacy policies, and we therefore encourage you to read them before using or sharing personal information with such sites.

Google Analytics

Google Analytics is used to collect information about how visitors use our Site. We use the information to compile reports and to help us improve the Site. The cookie collects information in an anonymous form, including the number of visitors to the Site, where visitors have come to the Site from and what pages they visited. The cookie does not collect personal identifiable information. The _ga cookie will last for two years. Please refer to Google’s privacy policy which includes analytics for further information: http://www.google.co.uk/intl/en/policies/privacy/.

You can opt out of Google Analytics by visiting this page.

CG’s Data Privacy Officer

CG has appointed a Data Privacy Officer (DPO) who is responsible for overseeing CG’s privacy program and our Privacy Policy. Any questions or queries please utilize the Contact Details below.

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by CG (or third parties as described in our Data Protection Policy), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority, CG’s DPO at privacy@cgcoralisle.com or via the complaint feedback portal on the Site (Complaints & Feedback).

Contact details

How to contact us

We recognize that you may have questions on how we process and/or store your data, or may want to change either the data we hold on you or how we communicate with you in the future. If you have given consent for processing, you are free to withdraw that consent. To do so, please contact the DPO at privacy@cgcoralisle.com.

If you have any questions in respect of this Privacy Policy, or would like to exercise your rights as a data subject (for example, to correct data or to exercise your right to access) please contact the DPO at privacy@cgcoralisle.com.

How to Contact the appropriate authority