Privacy Notice

Review the below Privacy Notices to learn more about how we collect and process personal data, when and how we share personal data, and how to contact us.

Marsh Ireland Brokers Limited Privacy Notice

This privacy notice describes how we may collect, handle and process personal information in relation to services we offer.

Marsh Ireland Brokers Limited (Marsh Ireland), a business of Marsh McLennan, strives to protect the privacy and the confidentiality of Personal Data that the company processes in connection with the services it provides to clients and individuals’ use of the Marsh Ireland websites. Marsh Ireland’s services consist primarily of risk consulting and insurance broking, which enable the consideration of, access to, administration of, and making of claims on, insurance.

To arrange insurance cover and handle insurance claims, Marsh Ireland and other participants in the insurance industry are required to use and share Personal Data.

During the insurance lifecycle Marsh Ireland will receive Personal Data relating to potential or actual policyholders, beneficiaries under a policy, their family members, claimants and other parties involved in a claim. Therefore references to “individuals” in this notice include any living person from the preceding list, whose Personal Data Marsh Ireland receives in connection with the services it provides under its engagements with its clients. This notice sets out Marsh Ireland’s uses of this Personal Data and the disclosures it makes to other insurance market participants and other third parties.

Identity of Controller and Contact Details

Marsh Ireland Brokers Limited, of 4th floor, 25/28 Adelaide Road, Dublin 2 (Marsh Ireland or We), is the controller in respect of the Personal Data it receives in connection with the services provided under the relevant engagement with its client.

Personal Information that We Process

We collect and process the following Personal Data:

  • Health data: current or former physical or mental medical conditions, health status, injury or disability information, medical procedures performed or health care services accessed, relevant personal habits (e.g. smoking or consumption of alcohol), prescription information, medical history;
  • Criminal records data: criminal convictions, including driving offences; and
  • Other special categories of Personal Data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning an individual’s sex life or sexual orientation;
  • Policy information: information about the quotes individuals receive and the policies they obtain;
  • Credit and anti-fraud data: credit history and credit score, information about fraud convictions, allegations of crimes and sanctions details received from various anti-fraud and sanctions databases, or regulators or law enforcement agencies;
  • Previous claims: information about previous claims, which may include health data, criminal records data and other special categories of Personal Data (as described in the Insured Risk definition above);
  • Current claims: information about current claims, which may include health data, criminal records data and other special categories of Personal Data (as described in the Insured Risk definition above);
  • Marketing data: whether or not the individual has consented to receive marketing from us and/or from third parties; and/or their marketing preferences.
  • Marketing data: whether or not the individual has consented to receive marketing from us and/or from third parties; and/or their marketing preferences.
  • Website and communication usage: details of your visits to our websites and information collected through cookies and other tracking technologies, including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, and the resources that you access.
  • Where we collect such information directly from individuals, we will inform them of whether the information is required and the consequences of not providing it on the relevant form.

    Sources of Personal Data

    We collect and receive Personal Data from various sources, including (depending on the service we are seeking to or are providing and country you are in):

    We collect and receive Personal Data from various sources, including (depending on the service we are seeking to or are providing and country you are in):

    • Individuals and their family members, online, face to face, by telephone, or in written correspondence;
    • Individuals' employers or trade or professional associations of which they are a member;
    • In the event of a claim, third parties including the other party to the claim (claimant/defendant), witnesses, experts (including medical experts), loss adjusters, lawyers and claims handlers;
    • Other insurance market participants, such as insurers, reinsurers and other intermediaries;
    • Credit reference agencies (to the extent Marsh Ireland is taking any credit risk);
    • Anti-fraud databases and other third party databases, including sanctions lists;
    • Government agencies, such as vehicle registration authorities and tax authorities;
    • Claim forms;
    • Open electoral registers and other publicly available information;
    • Business information and research tools;
    • Selected third parties who provide us with details of potential customers;
    • Third parties who introduce business to us; and
    • Forms on our website and your interactions with our website (please also see our Cookie Notice).

    How We Use and Disclose Your Personal Data

    In this section, we set out the purposes for which we use Personal Data, explain how we share the information, and identify the “legal grounds" on which we rely to process the information.

    These "legal grounds" are set out in the General Data Protection Regulation (the GDPR), which allows companies to process Personal Data only when the processing is permitted by the specific “legal grounds” set out in the GDPR (the full description of each of the grounds can be found in the Appendix below). In addition to the legal grounds in the Appendix, we may generally process personal data based on a legal or regulatory obligation.

    Read our Purpose of Processing (PDF)

    Quotation/Inception

    • Establishing a client relationship, including fraud, anti-money laundering and sanctions checks
    • Checking credit where we are taking any credit risk
    • Evaluating the risks to be covered and matching to appropriate insurer, policy and premium

    Policy Administration

    • General client care, including communicating with clients
    • Facilitating premium finance arrangements

    Claims processing

    • Managing insurance claims
    • Defending or prosecuting legal claims
    • Investigating and prosecuting fraud or possible criminal offences

    Renewals

    • Contacting you in order to arrange the renewal of the insurance policy

    Throughout the insurance lifecycle

    • Marketing analytics, sending marketing materials and communications including data de-identification and/or aggregation
    • Carrying out customer satisfaction surveys and market research
    • Transferring books of business, company sales and reorganisations
    • General risk modelling
    • Analytics include the de-identification of personal data for the purposes of analytics
    • Complying with our legal or regulatory obligations

    Consultancy activities

    • General client care, including communications with clients
    • General risk modelling in the context of our consultancy services in order to evaluate risks and provide advice
    • Analysis as part of the specific consultancy advice
    • Complying with our legal or regulatory obligations in the context of our consultancy business

    Website activities

    • To communicate with you regarding any queries you raise via the website
    • To monitor your interaction with the website to ensure service quality, compliance with procedures and to combat fraud
    • To ensure the website content is relevant and presented in the most effective manner for you and your device

    Please note that in addition to the disclosures we have identified in this table, we will disclose Personal Data for the purposes we explain in this notice to service providers, contractors, advisers, agents and MMC group companies that perform activities on our behalf.

    Consent

    In order to facilitate the provision of insurance cover and administer insurance claims, unless another legal ground applies, we rely on the data subject’s consent to process special categories of Personal Data and criminal records data, such as medical and criminal convictions records, as set out in the table above and for profiling as set out in the next section. This consent allows us to share the information with other insurers, intermediaries and reinsurers that need to process the information in order to undertake their role in the insurance market (which in turn allows for the pooling and pricing of risk in a sustainable manner).

    The affected individual’s consent to this processing of special categories of Personal Data and criminal records data may be necessary for Marsh Ireland to be able to provide the services the client requests.

    Where you are providing us with information about a person other than yourself, you agree to notify them of our use of their Personal Data and to obtain such consent for us.

    Individuals may withdraw their consent to such processing at any time by contacting the Data Protection Officer using the contact details at the Questions, Requests or Complaints section below. However, doing so may prevent Marsh Ireland from continuing to provide the services to the relevant client. In addition, if an individual withdraws consent to an insurer’s or reinsurer’s processing of their special categories of Personal Data and criminal records data, it may not be possible for the insurance cover to continue.

    Profiling and Automated Decision Making

    Insurance premiums are calculated by insurance market participants benchmarking clients’ and beneficiaries’ attributes as against other clients’ and beneficiaries’ attributes and propensities for insured events to occur. This benchmarking requires Marsh Ireland and other insurance market participants to analyse and compile information received from all insureds, beneficiaries or claimants to model such propensities. Accordingly, we may use Personal Data to both match against the information in the models and to create the models that determine the premium pricing in general and for other insureds. Marsh Ireland and other insurance market participants may use special categories of Personal Data and criminal records data for such modelling to the extent it is relevant, such as medical history for life insurance or past motor vehicle convictions for motor insurance.

    Marsh Ireland and other insurance market participants use similar predictive techniques to assess information that clients and individuals provide to understand fraud patterns, the probability of future losses actually occurring in claims scenarios, and as set out below.

    We use these models only for the purposes listed in this Privacy Notice. In most cases, our staff make decisions based on the models.

    Automated Broking Platform

    Where clients use the automated broking platform, insurance quotations are offered entirely by matching whether the attributes that the client has provided meet the criteria set by the insurers, which determines (a) whether a quotation will be made; (b) on what terms; and (c) at what price. Each insurer will use different algorithms to determine their pricing, and clients must consult each insurer’s privacy policy for further details. Our platform merely queries whether attributes of potential insureds satisfy insurers’ models and then returns the results. If the potential insured’s attributes do not satisfy insurers’ models, the quotation request is referred for review by a team with underwriting authority. We also apply fraud prediction algorithms to the information clients provide to assist us in detecting and preventing fraud. We regularly review all profiling and associated algorithms against inaccuracies and bias. These partially automated processes may result in a client not being offered insurance or affect the price or terms of the insurance.

    Clients may request that we provide information about the decision-making methodology and ask us to verify that the automated decision has been made correctly. We may reject the request, as permitted by applicable law, including when providing the information would result in a disclosure of a trade secret or would interfere with the prevention or detection of fraud or other crime. However, generally in these circumstances we will verify that the algorithm and source data are functioning as anticipated without error or bias.

    Marketing

    We may use your Personal Data to provide you with information about products or services which we think would be of interest to you. We may also share your Personal Data with other companies in the MMC group so that they can provide you with information about their products and services. These may be sent by email or post or, in some circumstances, we may telephone you to explain this information to you. Within the MMC group we operate under a number of brands and you may receive such communications from the following of our trading names:

    Marsh IrelandBowring Marsh
    Guy Carpenter & Company

    We take care to ensure that our marketing activities comply with all applicable legal requirements. In some cases, this may mean that we ask for your consent in advance of sending you marketing materials.

    In all cases, you can opt out of receiving marketing communications, at any time. You can do this by clicking on the "unsubscribe" link in any marketing email or by contacting us using the details set out at the end of this Privacy Notice.

    Please note that, even if you opt out of receiving marketing messages, we may still send you communications in connection with the services we provide to you.

    Safeguards

    We have in place physical, electronic, and procedural safeguards appropriate to the sensitivity of the information we maintain. These safeguards will vary depending on the sensitivity, format, location, amount, distribution and storage of the Personal Data, and include measures designed to keep Personal Data protected from unauthorised access. If appropriate, the safeguards include the encryption of communications via Secure Sockets Layer, encryption of information during storage, firewalls, access controls, separation of duties, and similar security protocols. We restrict access to Personal Data to personnel and third parties that require access to such information for legitimate, relevant business purposes.

    Limiting Collection and Retention of Personal Information

    We collect, use, disclose and otherwise process Personal Data that is necessary for the purposes identified in this Privacy Notice or as permitted by law. If we require Personal Data for a purpose inconsistent with the purposes we identified in this Privacy Notice, we will notify clients of the new purpose and, where required, seek individuals’ consent (or ask other parties to do so on Marsh Ireland’s behalf) to process Personal Data for the new purposes.

    Our retention periods for Personal Data are based on business needs and legal requirements. We retain Personal Data for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. For example, we retain certain transaction details and correspondence until the time limit for claims arising from the transaction has expired, or to comply with regulatory requirements regarding the retention of such data. When Personal Data is no longer needed, we either de-identify or aggregate the data (in which case we may further retain and use the de-identified or aggregated information for analytics purposes) or securely destroy the data.

    Cross-Border Transfer of Personal Information

    Marsh Ireland transfers Personal Data to, or permits access to Personal Data from, countries outside the European Economic Area (EEA). These countries’ data protection laws do not always offer the same level of protection for Personal Data as offered in the EEA. We will, in all circumstances, safeguard Personal Data as set out in this Privacy Notice.

    Certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections as EEA data protection laws. EU data protection laws allow Marsh Ireland to freely transfer Personal Data to such countries.

    If we transfer Personal Data to other countries outside the EEA, we will establish legal grounds justifying such transfer, such as MMC Binding Corporate Rules, model contractual clauses, individuals’ consent, or other legal grounds permitted by applicable legal requirements.

    Individuals can request additional information about the specific safeguards applied to the export of their Personal Data.

    Accuracy, Accountability, Openness and Your Rights

    We strive to maintain Personal Data that is accurate, complete and current. Individuals should contact us at MarshIreland@marsh.com to update their information.

    Questions regarding Marsh Ireland’s privacy practices should be directed to the Data Protection Officer using the contact details in the Questions, Requests or Complaints section below.

    Under certain conditions, individuals have the right to request that Marsh Ireland:

    • provide further details on how we use and process their Personal Data;
    • provide a copy of the Personal Data we maintain about the individual;
    • update any inaccuracies in the Personal Data we hold;
    • delete Personal Data that we no longer have a legal ground to process; and
    • restrict how we process the Personal Data while we consider the individual's enquiry.

    In addition, under certain conditions, individuals have the right to:

    • where processing is based on consent, withdraw the consent;
    • object to any processing of Personal Data that Marsh Ireland justifies on the "legitimate interests" legal grounds, unless our reasons for undertaking that processing outweigh any prejudice to the individual's privacy rights; and
    • object to direct marketing (including any profiling for such purposes) at any time.

    These rights are subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). We will respond to most requests within 30 days.

    If we are unable to resolve an enquiry or a complaint, individuals have the right to contact the Irish data protection regulator, the Data Protection Commission (DPC).

    The DPC can be contacted by telephone at +353 578 684 800 or by postal address at:

    Data Protection Commission
    21 Fitzwilliam Square South
    Dublin 2
    D02 RD28, Ireland.

    Questions, Requests or Complaints

    To submit questions or requests regarding this Privacy Notice or Marsh Ireland’s privacy practices, please write to the Data Protection Officer at the following address:

    The Data Protection Officer
    Marsh Ireland Brokers Limited
    4th floor
    25/28 Adelaide Road
    Dublin 2
    Phone: +353 (0) 1 604 8100
    Email: MarshIreland@marsh.com

    If we are unable to resolve an enquiry or a compliant, individuals have the right to contact the Irish data protection regulator, the Data Protection Commission (DPC).
    The DPC can be contacted by telephone at +353 578 684 800 or by postal address at:

    Data Protection Commission
    21 Fitzwilliam Square South
    Dublin 2
    D02 RD28, Ireland.

    Links to Third Party Websites

    Our websites may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal information. Please check these policies before you submit any personal information to such third party websites.

    Changes to this Privacy Notice

    This Privacy Notice is subject to change at any time. It was last changed on 30 November 2020. If we make changes to this Privacy Notice, we will update the date on which it was last changed. Where we have an engagement with you, we will notify you of any changes we make to this Privacy Notice in accordance with the notice provisions in the terms of our engagement. In other circumstances, we will publish the revised Privacy Notice on our website.

    Download our Privacy Notice

    Appendix

    List of the legal grounds we rely on:

    For processing personal data and special categories of personal data

    Legal ground

    Details

    Performance of our contract with you

    Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

    Compliance with a legal obligation

    Processing is necessary for compliance with a legal obligation to which we are subject.

    For our legitimate business interests

    Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where you are a child. These legitimate interests are set out next to each purpose.

    For processing special categories of personal data and criminal convictions data:

    Legal ground

    Details

    You consent

    You have given your consent to the processing of those personal data for one or more specified purposes. You are free to withdraw your consent, by contacting our Data Protection Contact. However withdrawal of this consent may impact our ability to provide the services. For more detail see the Consent section above.

    For legal claims

    Processing is necessary for legal advice or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings or otherwise establishing, exercising or defending legal rights or claims or whenever courts are acting in their judicial capacity.

    Insurance Purposes (health data only)

    Processing is necessary and proportionate for the purposes of (a) a policy of insurance or life assurance, (b) a policy of health insurance or health-related insurance, (c) an occupational pension, a retirement annuity contract or any other pension arrangement, or (d) the mortgaging of property.

    Performance of a Contract (criminal convictions data only)

    Processing is necessary and proportionate for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

    Substantial Public Interest

    Processing is necessary for reasons of substantial public interest, on the basis of EU or Irish law.

    Marsh Ireland Brokers Limited UK Branch Privacy Notice

    Introduction

    The UK branch of Marsh Ireland Brokers Limited, trading as Marsh Ireland, Bowring Marsh, Charity Insurance, Echelon Claims Consultants, Guy Carpenter & Company, ILCS, Insolutions, Lloyd & Partners, Marsh Aviation Consulting, Marsh Claims Management Services, Marsh Claims Solutions, Marsh Specialty, Marsh Reclaim, and Marsh Risk Consulting (Marsh), a business of Marsh McLennan, strives to protect the privacy and the confidentiality of Personal Data that the company processes in connection with the services it provides to clients and individuals’ use of the Marsh websites. Marsh’s services consist primarily of risk consulting and insurance broking, which enable the consideration of, access to, administration of, and making of claims on, insurance.

    To arrange insurance cover and handle insurance claims, Marsh and other participants in the insurance industry are required to use and share Personal Data. For an overview of how and why the insurance industry is required to use and share Personal Data please see the Insurance Market Core Uses Information Notice hosted on the website of a UK insurance industry association, the Lloyd’s Market Association (the LMA Notice). Marsh’s use of Personal Data is consistent with the LMA Notice.

    During the insurance lifecycle Marsh will receive Personal Data relating to potential or actual policyholders, beneficiaries under a policy, their family members, claimants and other parties involved in a claim. Therefore references to “individuals” in this notice include any living person from the preceding list, whose Personal Data Marsh receives in connection with the services it provides under its engagements with its clients. This notice sets out Marsh’s uses of this Personal Data and the disclosures it makes to other insurance market participants and other third parties.

    Identity of Controller and Contract Details

    The UK branch of Marsh Ireland Brokers Limited, trading as Marsh Ireland, Bowring Marsh, Charity Insurance, Echelon Claims Consultants, Guy Carpenter & Company, ILCS, Insolutions, Lloyd & Partners, Marsh Aviation Consulting, Marsh Claims Management Services, Marsh Claims Solutions, Marsh Specialty, Marsh Reclaim, and Marsh Risk Consulting of 1 Tower Place West, Tower Place, London EC3R 5BU (Marsh or We) is the controller in respect of the Personal Data it receives in connection with the services provided under the relevant engagement with its client.

    Personal Information that We Process

    We collect and process the following Personal Data:

    • Health data: current or former physical or mental medical conditions, health status, injury or disability information, medical procedures performed or health care services accessed, relevant personal habits (e.g. smoking or consumption of alcohol), prescription information, medical history;
    • Criminal records data: criminal convictions, including driving offences; and
    • Other special categories of Personal Data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning an individual’s sex life or sexual orientation;
  • Policy information: information about the quotes individuals receive and the policies they obtain;
  • Credit and anti-fraud data: credit history and credit score, information about fraud convictions, allegations of crimes and sanctions details received from various anti-fraud and sanctions databases, regulators or law enforcement agencies;
  • Previous claims: information about previous claims, which may include health data, criminal records data and other special categories of Personal Data (as described in the Insured Risk definition above);
  • Current claims: information about current claims, which may include health data, criminal records data and other special categories of Personal Data (as described in the Insured Risk definition above);
  • Marketing data: whether or not the individual has consented to receive marketing from us and/or from third parties and/or their marketing preferences; and
  • Website and communication usage: details of your visits to our websites and information collected through cookies and other tracking technologies, including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, and the resources that you access.
  • Where we collect such information directly from individuals, we will inform them of whether the information is required and the consequences of not providing it on the relevant form.

    Sources of Personal Data

    We collect and receive Personal Data from various sources, including (depending on the service we are seeking to or are providing and country you are in):

    • Individuals and their family members, online, face to face, or by telephone, or in written correspondence;
    • Individuals’ employers or trade or professional associations of which they are a member;
    • In the event of a claim, third parties including the other party to the claim (claimant/defendant), witnesses, experts (including medical experts), loss adjusters, lawyers and claims handlers;
    • Other insurance market participants, such as insurers, reinsurers and other intermediaries;
    • Credit reference agencies (to the extent Marsh is taking any credit risk);
    • Anti-fraud databases and other third party databases, including sanctions lists;
    • Government agencies, such as vehicle registration authorities and tax authorities;
    • Claim forms;
    • Open electoral registers and other publicly available information;
    • Business information and research tools;
    • Selected third parties who provide us with details of potential customers
    • Third parties who introduce business to us; and
    • Forms on our website and your interactions with our website (please also see our Cookie Notice).

    How We Use and Disclose Your Personal Data

    In this section, we set out the purposes for which we use Personal Data, explain how we share the information, and identify the “legal grounds” on which we rely to process the information.

    These “legal grounds” are set out in the data privacy laws applicable in the relevant country. In the UK, this means the UK General Data Protection Regulation and the Data Protection Act 2018 and, in Ireland or to the extent that Irish law applies to the processing, the EU General Data Protection Regulation and the Irish Data Protection Acts 1988 to 2018 (we refer to the applicable data protection legislation in this Privacy Notice as the GDPR). The GDPR allows companies to process Personal Data only when the processing is permitted by the specific “legal grounds” set out in the GDPR (the full description of each of the grounds can be found in the Appendix below).

    Read our Purpose of Processing (PDF)

    Quotation/Inception

    • Establishing a client relationship, including fraud, anti-money laundering and sanctions checks
    • Checking credit where we are taking any credit risk
    • Evaluating the risks to be covered and matching to appropriate insurer, policy and premium

    Policy Administration

    • General client care, including communicating with clients
    • Collection or refunding of premiums, paying on claims, processing and facilitating other payments
    • Facilitating premium finance arrangements

    Claims processing

    • Managing insurance claims
    • Defending or prosecuting legal claims
    • Investigating and prosecuting fraud or possible criminal offences

    Renewals

    • Contacting you in order to arrange the renewal of the insurance policy

    Throughout the insurance lifecycle

    • Marketing analytics, sending marketing materials and communications including data de-identification and/or aggregation
    • Carrying out customer satisfaction surveys and market research
    • Transferring books of business, company sales and reorganisations
    • General risk modelling
    • Analytics include the de-identification of personal data for the purposes of analytics
    • Complying with our legal or regulatory obligations

    Consultancy activities

    • General client care, including communications with clients
    • General risk modelling in the context of our consultancy services in order to evaluate risks and provide advice
    • Analysis as part of the specific consultancy advice
    • Complying with our legal or regulatory obligations in the context of our consultancy business

    Website activities

    • To communicate with you regarding any queries you raise via the website
    • To monitor your interaction with the website to ensure service quality, compliance with procedures and to combat fraud
    • To ensure the website content is relevant and presented in the most effective manner for you and your device

    Please note that in addition to the disclosures we have identified in this table, we will disclose Personal Data for the purposes we explain in this notice to service providers, contractors, advisers, agents and MMC group companies that perform activities on our behalf.

    Special Categories of Personal Data and Criminal Data

    In relation to processing by Marsh Ireland Brokers Limited in the UK and/or subject to UK law, when we collect, use or disclose to third parties (such as insurers, intermediaries and reinsurers) Special Categories of Personal Data and Criminal Records Data for the reasons set out in the table above and for profiling as set out in the next section, we typically do so for reasons of substantial public interests, namely because it is necessary for the wide range of insurance-related activities that we undertake or because it is necessary for fraud prevention purposes. As regards processing in Ireland by Marsh Ireland Brokers Limited, or to the extent that Irish law applies to processing by the UK branch, such processing may be necessary (i) for insurance purposes (health data only) (ii) in connection with legal advice or establishing or exercising legal rights, (iii) for the performance of a function conferred by an enactment or (iv) for performance of our contract with you. We will ask for your explicit consent where it does not meet the criteria and will explain at the time why this is necessary.

    Before you provide us with Special Categories of Personal Data and Criminal Records Data about a person other than yourself, you agree to notify such person of our use of their Personal Data and, if requested by us, to obtain their consent to our use of their Special Categories of Personal Data and Criminal Records Data (for example, by requiring the individual to sign a consent form).

    Profiling and Automated Decision Making

    Insurance premiums are calculated by insurance market participants benchmarking clients’ and beneficiaries’ attributes as against other clients’ and beneficiaries’ attributes and propensities for insured events to occur. This benchmarking requires Marsh and other insurance market participants to analyse and compile information received from all insureds, beneficiaries or claimants to model such propensities. Accordingly, we may use Personal Data to both match against the information in the models and to create the models that determine the premium pricing in general and for other insureds. Marsh and other insurance market participants may use special categories of Personal Data and criminal records data for such modelling to the extent it is relevant, such as medical history for life insurance or past motor vehicle convictions for motor insurance.

    Marsh and other insurance market participants use similar predictive techniques to assess information that clients and individuals provide to understand fraud patterns, the probability of future losses actually occurring in claims scenarios, and as set out below.

    We use these models only for the purposes listed in this Privacy Notice. In most cases, our staff make decisions based on the models.

    Automated Broking Platform

    Where clients use the automated broking platform, insurance quotations are offered entirely by matching whether the attributes that the client has provided meet the criteria set by the insurers, which determines (a) whether a quotation will be made; (b) on what terms; and (c) at what price. Each insurer will use different algorithms to determine their pricing, and clients must consult each insurer’s privacy policy for further details. Our platform merely queries whether attributes of potential insureds satisfy insurers’ models and then returns the results. If the potential insured’s attributes do not satisfy insurers’ models, the quotation request is referred for review by a team with underwriting authority. We also apply fraud prediction algorithms to the information clients provide to assist us in detecting and preventing fraud. We regularly review all profiling and associated algorithms against inaccuracies and bias.

    These partially automated processes may result in a client not being offered insurance or affect the price or terms of the insurance.

    Clients may request that we provide information about the decision-making methodology and ask us to verify that the automated decision has been made correctly. We may reject the request, as permitted by applicable law, including when providing the information would result in a disclosure of a trade secret or would interfere with the prevention or detection of fraud or other crime. However, generally in these circumstances we will verify that the algorithm and source data are functioning as anticipated without error or bias.

    Marketing

    We may use your Personal Data to provide you with information about products or services which we think would be of interest to you. We may also share your Personal Data with other companies in the MMC group so that they can provide you with information about their products and services. These may be sent by email or post or, in some circumstances, we or our group companies may telephone you to explain this information to you.

    Within the MMC group we operate under a number of brands and you may receive such communications from the following of our trading names Marsh Ireland, Bowring Marsh, Charity Insurance, Echelon Claims Consultants, Guy Carpenter & Company, ILCS, Insolutions, Lloyd & Partners, Marsh Aviation Consulting, Marsh Claims Management Services, Marsh Claims Solutions, Marsh Specialty, Marsh Reclaim, and Marsh Risk Consulting.

    We take care to ensure that our marketing activities comply with all applicable legal requirements. In some cases, this may mean that we ask for your consent in advance of us or our group companies sending you marketing materials.

    In all cases, you can opt out of receiving marketing communications, at any time. You can do this by clicking on the "unsubscribe" link in any marketing email or by contacting us using the details set out at the end of this Privacy Notice.

    Please note that, even if you opt out of receiving marketing messages, we may still send you communications in connection with the services we provide to you.

    Safeguards

    We have in place physical, electronic, and procedural safeguards appropriate to the sensitivity of the information we maintain. These safeguards will vary depending on the sensitivity, format, location, amount, distribution and storage of the Personal Data, and include measures designed to keep Personal Data protected from unauthorised access.

    If appropriate, the safeguards include the encryption of communications via Secure Sockets Layer, encryption of information during storage, firewalls, access controls, separation of duties, and similar security protocols. We restrict access to Personal Data to personnel and third parties that require access to such information for legitimate, relevant business purposes.

    Limiting Collection and Retention of Personal Information

    We collect, use, disclose and otherwise process Personal Data that is necessary for the purposes identified in this Privacy Notice or as permitted by law. If we require Personal Data for a purpose inconsistent with the purposes we identified in this Privacy Notice, we will notify clients of the new purpose and, where required, seek individuals’ consent (or ask other parties to do so on Marsh’s behalf) to process Personal Data for the new purposes.

    Our retention periods for Personal Data are based on business needs and legal requirements. We retain Personal Data for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. For example, we retain certain transaction details and correspondence until the time limit for claims arising from the transaction has expired, or to comply with regulatory requirements regarding the retention of such data. When Personal Data is no longer needed, we either de-identify or aggregate the data (in which case we may further retain and use the de-identified or aggregated information for analytics purposes) or securely destroy the data.

    Cross-Border Transfer of Personal Information

    Marsh transfers Personal Data to, or permits access to Personal Data from, countries outside the UK and European Economic Area (EEA). These countries’ data protection laws do not always offer the same level of protection for Personal Data as offered in the UK and EEA. We will, in all circumstances, safeguard Personal Data as set out in this Privacy Notice.

    Certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections as EEA data protection laws. The UK Government has approved the same countries as providing essentially equivalent protections as UK data protection laws. Both the UK and EU data protection laws allow Marsh to freely transfer Personal Data to such countries.

    If we transfer Personal Data to other countries outside the UK or EEA, we will establish legal grounds justifying such transfer, such as MMC Binding Corporate Rules, model contractual clauses, individuals’ consent, or other legal grounds permitted by applicable legal requirements.

    Individuals can request additional information about the specific safeguards applied to the export of their Personal Data by contacting the Data Protection Officer using the contact details in the Questions, Requests or Complaints section below.

    Accuracy, Accountability, Openness and Your Rights

    We strive to maintain Personal Data that is accurate, complete and current. Individuals should contact us at dataprotection@marsh.com to update their information.

    Questions regarding Marsh’s privacy practices should be directed to the Data Protection Officer using the contact details in the Questions, Requests or Complaints section below.

    Under certain conditions, individuals have the right to request that Marsh:

    • provide further details on how we use and process their Personal Data;
    • provide a copy of the Personal Data we maintain about the individual;
    • update any inaccuracies in the Personal Data we hold
    • delete Personal Data that we no longer have a legal ground to process; and
    • restrict how we process the Personal Data while we consider the individual’s enquiry.

    In addition, under certain conditions, individuals have the right to:

    • where processing is based on consent, withdraw the consent;
    • object to any processing of Personal Data that Marsh justifies on the “legitimate interests” legal grounds, unless our reasons for undertaking that processing outweigh any prejudice to the individual’s privacy rights; and
    • object to direct marketing (including any profiling for such purposes) at any time.

    These rights are subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). We will respond to most requests within 30 days.

    If we are unable to resolve an enquiry or a complaint, individuals have the right to contact the UK data protection regulator, the Information Commissioner’s Office (ICO).

    The ICO can be contacted by telephone at 0303 123 1113 or by email at casework@ico.org.uk.

    Irish data protection laws apply to Marsh Ireland Brokers Limited and therefore if you have any concerns about their processing of your personal data by Marsh Ireland Brokers Limited in Ireland, or to the extent that Irish law applies to processing by the UK branch, individuals have the right to contact the Data Protection Commission (DPC).

    The DPC can be contacted on +353 578 684 800 or through the “CONTACT US ONLINE” button at https://www.dataprotection.ie/en/contact/how-contact-us.

    Questions, Requests or Complaints

    To submit questions or requests regarding this Privacy Notice or Marsh’s privacy practices, please complete the form here. You will need to provide your email address when you make your request via this form.
    If you would prefer to contact us by post or by phone, please contact the Data Protection Officer using the following contact details:

    The Data Protection Officer
    UK branch of Marsh Ireland Brokers Limited
    Tower Place London
    EC3R 5BU
    Phone: 020 7357 1000
    Email: dataprotection@marsh.com

    If we are unable to resolve an enquiry or a complaint, individuals have the right to contact the UK data protection regulator, the Information Commissioner's Office (ICO).

    The ICO can be contacted by telephone at 0303 123 1113 or by email at casework@ico.org.uk.

    Irish data protection laws apply to Marsh Ireland Brokers Limited and therefore if you have any concerns about their processing of your personal data by Marsh Ireland Brokers Limited in Ireland, or to the extent that Irish law applies to processing by the UK branch, individuals may contact the Data Protection Officer at the following address:

    Marsh Ireland Brokers Limited
    4th floor
    25/28 Adelaide Road
    Dublin 2

    MarshIreland@marsh.com

    Individuals also have the right to contact the Data Protection Commission.

    The DPC can be contacted on +353 578 684 800or or through the “CONTACT US ONLINE” button at https://www.dataprotection.ie/en/contact/how-contact-us

    Links to Third Party Websites

    Our websites may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal information. Please check these policies before you submit any personal information to such third party websites.

    Changes to this Privacy Notice

    This Privacy Notice is subject to change at any time. It was last changed 7 January 2022. If we make changes to this Privacy Notice, we will update the date on which it was last changed. Where we have an engagement with you, we will notify you of any changes we make to this Privacy Notice in accordance with the notice provisions in the terms of our engagement. In other circumstances, we will publish the revised Privacy Notice on our website.

    Download our Privacy Notice here.

    Appendix

    List of the legal grounds we rely on:

    For processing personal data

    Legal ground

    Details

    Performance of our contract with you

    Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

    Compliance with a legal obligation

    Processing is necessary for compliance with a legal obligation to which we are subject.

    For our legitimate business interests

    Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where you are a child.  These legitimate interests are set out next to each purpose.

    For processing special categories of personal data and criminal convictions data:

    You explicit consent

    You have given your explicit consent to the processing of those personal data for one or more specified purposes.

    You are free to withdraw your consent, by contacting our Data Protection Contact. However withdrawal of this consent may impact our ability to provide the services.

    For more detail see the Special Categories of Personal Data and Criminal Data

    section above.

    For legal claims

    Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

    As regards processing subject to Irish law, where the processing is necessary for legal advice or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings or otherwise establishing, exercising or defending legal rights or claims.

    For statutory functions (where Irish law applies)

    Where necessary for the performance of a function conferred by an enactment

    Substantial public interest (where UK law applies)

    Processing is necessary for reasons of substantial public interest, on the basis of EU or UK law, including where such processing is necessary for insurance purposes or fraud prevention purposes.

    Insurance Purposes (health data only) (where Irish law applies)

    Processing is necessary and proportionate for the purposes of (a) a policy of insurance or life assurance, (b) a policy of health insurance or health-related insurance, (c) an occupational pension, a retirement annuity contract or any other pension arrangement, or (d) the mortgaging of property.

    Performance of a Contract (criminal convictions data only) (where Irish law applies)

    Processing is necessary and proportionate for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

    Substantial Public Interest (where Irish law applies)

    Processing is necessary for reasons of substantial public interest, on the basis of EU or Irish law.