Who are we?
We are Wrightway Underwriting Ltd (referred to as ‘WUL’), a private company limited by shares incorporated in Ireland and registered under company number 293846. Our registered office is at Zurich House, Ballsbridge Park, Dublin 4. WUL is a member of the global Zurich Insurance Group (‘Group’). WUL is ultimately owned by Zurich Insurance Company Ltd a company incorporated in Switzerland.
We are a Managing General Agent (“MGA”) regulated by the Central Bank of Ireland. We distribute insurance products on behalf of insurance companies (“Product Providers”), domiciled in Ireland and abroad through our broker network in Ireland. As an MGA, we have been granted authority by our Product Providers to bind cover on their behalf, service your policy and to handle and settle any claims thereunder.
DATA PROTECTION DEFINITIONS
We use certain expressions throughout this document such as Personal Data and Special Categories of Personal Data.
Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Special Categories of Personal Data includes information revealing a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
If you have any queries on data protection, our Data Protection Officer may be contacted at:
What personal data do we collect from you?
You may give us Personal Data and Special Categories of Personal Data:
Where appropriate, we may collect the following classes of Personal Data and/or Special Categories of Personal Data from and/or about you or any other person who may benefit from insurance coverage taken out or sought by you:
Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.
What personal data do we collect about you, from third parties?
Where appropriate, we may obtain Personal Data and/or Special Categories of Personal Data about you from the following third party sources:
- Your broker, advisor, or any other third party acting on your behalf, other insurance companies, financial institutions or anybody else insured under your policy of insurance;
- Without limitation:
- The insurance industry’s claims database known as InsuranceLink (for more information see www.inslink.ie);
- The Integrated Information Data Service (‘IIDS’) which allows members of Insurance Ireland to verify information including penalty points and no-claims discount information provided by their customers;
- The National Vehicle and Driver File, maintained and supported by the Department of Transport, Tourism and Sport, containing details of all registered vehicles in the State;
- The Motor Insurance Anti-Fraud and Theft Register (MIAFTR) operated by the Association of British Insurers in the UK to log all insurance claims relating to written-off and stolen vehicles in the UK;
- Third party vendors who provide data enrichment services (such as vehicle and claims history) to the insurance industry;
- Geocoding databases to determine location based risk factors;
- The Companies Registration Office and other business search tools.
- Any third parties involved in or witnesses to the incident;
- Emergency services such as ambulance or fire services;
- An Garda Síochána or other law enforcement agencies;
- Experts or professionals (such as brokers, claim management companies, legal representatives, medical professionals, tradesmen, loss assessors, loss adjustors, accident investigators, other insurance companies, motor repairers, motor engineers, car hire providers and salvage providers) acting on your behalf as the claimant or on behalf of a third party entitled to indemnity under the policy;
- The Personal Injuries Assessment Board;
- Claims service providers and experts appointed by us during the handling of the claim (such as legal representatives, medical professionals, tradesmen, loss adjustors, accident investigators, motor repairers, motor engineers, car hire providers, salvage providers, consulting engineers, forensic engineers, architects and surveyors);
- Private investigators in connection with the investigation of a claim;
- The Department of Employment Affairs and Social Protection in connection with the Recovery of Benefits and Assistance scheme.
What personal data do we collect from you, about other people?
Where appropriate, we may collect Personal Data and/or Special Categories of Personal Data from you that relate to people other than you, such as:
Why do we collect this personal data?
We collect Personal Data and, where necessary and in accordance with legal requirements, Special Categories of Personal Data, in order to distribute and administer insurance products on behalf of our Product Providers, to transact business, validate and settle any claims, to develop or enhance our online service and to recruit staff.
Where appropriate, we will use this information:
The legal bases for the processing of your Personal Data and Special Categories of Personal Data are:
Who might we share your personal data with?
Where appropriate, we may share your Personal Data, and if necessary and in accordance with legal requirements, Special Categories of Personal Data, with relevant Product Providers, other companies in the Group, partners of the Group and reinsurance companies, located in Ireland and abroad, including outside the European Economic Area (’EEA’).
When you apply for or purchase a product through a broker, or other third party, we will, as appropriate, correspond with that broker, or other third party relating to your products: this may result in us sharing your Personal Data, and if necessary and in accordance with legal requirements, Special Categories of Personal Data, with that broker, or other third party.
In addition, we may disclose your Personal Data and Special Categories of Personal Data with third parties:
Please note, information about claims (whether by policyholders or third-parties) is collected by us when a claim is made under a policy and may be placed on InsuranceLink. This information may be shared with other insurance companies, self-insurers or statutory authorities.
The purpose of InsuranceLink is to help us identify incorrect information and fraudulent claims and, therefore, to protect policyholders. Under data protection legislation you have a right to know what information about you and your previous claims is held on InsuranceLink. If you wish to exercise this right, please contact us at the address below or for further information on InsuranceLink go to www.inslink.ie.
Finally, where you have consented to our doing so, we may share information that you provide to companies within the Group and with other companies that we establish commercial links with so we and they may contact you (by email, SMS, telephone or other appropriate means) in order to tell you about carefully selected products, services or offers that we believe will be of interest to you.
How long do we keep hold of your personal data and special categories of personal data?
The time periods for which we retain your Personal Data and Special Categories of Personal Data depends on the type of information and the purposes for which we use it. We will keep your information for no longer than is required or permitted.
All Personal Data and Special Categories of Personal Data will be retained for the duration of the periods set out in our Data Retention Policy. These periods of time are subject to legal, tax and regulatory requirements or to enable us to manage our business. If you would like further information, please contact us at the details provided below.
In some circumstances we may anonymise your Personal Data and Special Categories of Personal Data so that it can no longer be associated with you, in which case we may use such information without further notice to you. This anonymised data may be used for research or analytical purposes.
Do we transfer your information outside the European Union or European Economic Area?
Yes. Given the global nature of our Group’s business, our data is transferred to other countries.
The Personal Data and Special Categories of Personal Data that we collect from you may be transferred to, and stored in, Switzerland, which is outside the European Economic Area (‘EEA’) and for which there is an adequacy decision relating to the safeguards for Personal Data from the European Commission.
What are your rights with respect to your personal data and special categories of personal data?
You have the following rights:
A. To access the Personal Data and Special Categories of Personal Data we hold about you.
B. To require us to rectify any inaccurate Personal Data or Special Categories of Personal Data relating to you without undue delay.
C. To have us erase any Personal Data or Special Categories of Personal Data we hold about you in specific circumstances, e.g. where it is no longer necessary for us to hold the Personal Data or Special Categories of Personal Data (see our data retention policy).
D. To object to us processing your Personal Data or Special Categories of Personal Data in specific circumstances.
E. To ask us to provide your Personal Data and Special Categories of Personal Data to you in a portable format or, where technically feasible, for us to port that information to another controlller provided it does not result in a disclosure of information relating to other people.
F. To request a restriction of the processing of your Personal Data or Special Categories of Personal Data.
G. In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your Personal Data or Special Categories of Personal Data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. In that instance, any processing that we have carried out before you withdrew your consent remains lawful.
You may exercise any of the above rights by writing to us at: Data Protection Officer, Wrightway Underwriting Ltd, Wrightway House, Ardcavan Business Park, Ardcavan, Wexford, Co. Wexford, Ireland, Y35 FP8A or by emailing us at email@example.com.
In the above circumstances, we may need to request specific information from you to help us confirm your identity and ensure your right to access the Personal Data or Special Categories of Personal Data (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Data or Special Categories of Personal Data is not disclosed to any person who has no right to receive it.
You may lodge a complaint with respect to our processing of your information. In Ireland, the local Supervisory Authority is the Office of the Data Protection Commission with an address at Canal House, Station Road, Portarlington, Co. Laois.
Automated decision making and profiling
Automated decision-making takes place when an electronic system uses Personal Data and/or Special Categories of Personal Data to make a decision without human intervention.
We use automated decision making, including profiling, in the following situations:
We use the information provided by you and obtained from third party sources about you, including your claims history and other factors relating to the risk proposed such as your address, your age and the type of vehicle you drive in order to undertake a risk assessment and to determine the appropriate premium on behalf of our Product Providers.
During the underwriting process we may send some of your Personal Data to third party contractors in order to validate and obtain additional information relevant to the risk being proposed. We may also send your address details to a third party contractor to determine information about the area in which you live in order to assess any environmental risks (such as the potential flood risk). This is done in order to properly assess your risk profile which determines your premium and the insurance cover to be provided to you.
Underwriting is the process by which an insurance company assesses, accepts or rejects risks and classifies those selected, in order to charge an appropriate premium. The underwriting factors that must be evaluated to complete the underwriting process depend on the insurance product the customer is interested in; each product requires different categories of information to assess the risk profile of the proposer.
Where a decision is based on solely automated decision making, you will always be entitled to have a person review the decision so that you can contest it and to elaborate on your specific circumstances and make a personal representation.
We have put in place measures to protect the security of your Personal Data and Special Categories of Personal Data.
Details of these measures are available upon request.
Third parties acting on our behalf will only process your Personal Data and Special Categories of Personal Data on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your Personal Data and Special Categories of Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data and Special Categories of Personal Data to those Product Providers, employees, agents, contractors and other third parties who have a business need to know.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How can you contact us about data protection?
You can contact us:
Third Parties with whom we may share your Personal Data and/or Special Categories of Personal Data.
Agents, Managing General Agents, Brokers and Advisors
Electronic Data Interchange (EDI) Service Providers
Claims Handling Administrators
Claims Investigators(including Private Investigators)
Claims Service Providers (including Loss Adjustors, Motor Engineers, Motor Damage Repairers and Car Hire Providers)
Fraud Detection Service Providers
Law Enforcement Agencies and Fraud Prevention Agencies
Medical Professionals (including Doctors, Nurses and Dentists)
Relatives and Guardians
Third party claimants and/or their representatives where legally required
Credit Check Companies
Other companies in the Zurich Insurance Group
Direct Marketing and Marketing Service Providers
Courier Delivery Service Providers
Document Management Providers (including Web-Scanning Service Providers)
External Printing and Posting Service Providers
IT Cloud Hosting and Cloud Service Providers
IT Service and Support Providers (including Back-up Providers, Data Centre Providers, Consultants, Web-Hosting Providers, Email Providers, Outsourced Service Providers)
Operations Support Service Providers
Outsourced Service Providers
Industry and trade bodies
Internal and External Auditors
Relevant government departments and statutory bodies such as the Personal Injuries Assessment Board
Motor Insurers Bureau of Ireland
Regulators and competent authorities such as the Data Protection Commission, the Revenue Commissioners, the Central Bank of Ireland, and the Financial Services Ombudsman
Third Party Support Providers for Regulatory, Sanctions and Anti-Money Laundering Law Compliance
Data Enrichment services providers
Other insurance companies and/or their agents