Last Updated: 23/08/2024

1. Introduction

Davies Group Limited with its registered office at 5th Floor, 20 Gracechurch Street, London, EC3V 0BG, United Kingdom, and its entities and subsidiaries (hereinafter referred to as ‘Davies Group’) is committed to being transparent about how it processes your personal data.

This Privacy Policy outlines how Davies Group will collect, hold, process, and share your personal data, to assist you in making informed decisions when using our website and/or accessing our products and services.

In this Privacy Policy, the terms ‘we’, ‘our’ or ‘us’ are used to refer to Davies Group, who are the data controller or processor responsible for processing your personal data.

2. The types of personal data we collect

We collect and process the following types of personal data:

• When you browse our website, we use cookies to collect usage data, which may include, but is not limited to, your IP address, browser type/version, browsing behaviour on our site (including the pages that you visit, the time spent on those pages and the date and time of your visit) and your geolocation data. More information about the types of cookies we use and our reasons for using them can be in our Cookie Policy.
• Personal identifiers, contact details, and characteristics, such as your name, country of residence, address, phone number and email address.
• Special category data including health and/or medical diagnosis information, which may be held, used, and processed for the purpose of providing the services offered by Davies Group.
• We may collect personal information relating to children, but only if consent has been obtained (where required) from a parent or guardian, and the information is relevant to the products and services we provide.

3. Where we obtain your personal data from

The personal data we process may be collected from a variety of sources including, but not limited to:

• Fraud prevention agencies and organisations.
• Industry regulators and ombudsmen, including but not limited to the Financial Conduct Authority (FCA), Information Commissioner’s Office (ICO) and Financial Ombudsman Service (FOS).
• Insurance companies.
• Insurance industry databases.
• Intermediaries, such as claims management companies.
• Law enforcement agencies.
• Loss adjusters and claims investigators.
• Other third parties.
• Our clients.
• Our website cookies.
• Social media.
• Third party data providers/search systems.
• Your Insurer/Underwriter.

During the course of providing our services, we may also collect personal data from you directly, for example when the information is needed to progress your claim.

4. Our lawful bases for processing your personal data

Under the UK/EU General Data Protection Regulation (‘GDPR’), the lawful bases we may rely on for processing your personal data are:

• Consent – you have given clear consent for us to process your personal data for a specific purpose. Please note – for any processing we undertake which relies on your consent, you are able to remove your consent at any time by contacting our Data Protection Officer at DPO@davies-group.com.
• Contract – the processing is necessary for a contract we (or the relevant data controller, where we are acting in the capacity of data processor) have with you, or because you have asked us to take specific steps before entering into a contract.
• Legal Obligation – the processing is necessary for us to comply with the law.
• Vital Interest – the processing is necessary to protect your life.
• Public Task – the processing is necessary for us to perform a task in the public interest or our official functions, and the task or function has a clear basis in law.
• Legitimate Interest – the processing is necessary for our legitimate interests or the legitimate interests of a third party. For example, when you register to attend an event or webinar, we will use your contact details to contact you about the event/webinar and inform relevant staff, and any partner that we are running the event/webinar with, that you will be attending. We may also use your name for name tags and any other event management requirements, including but not limited to table arrangements, corporate gifting and collateral.

5. Change of purpose

We will only process your personal data in line with the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose, and that purpose is compatible with the original purpose.

Please note – we may process your personal data without your knowledge or consent in compliance with the above rules, where this is required or permitted by law. For example, where the processing relates to the detection and prevention of crime.

6. Automated decision-making and profiling

In some circumstances, Davies Group may use automated processing and decision-making, where a decision is made by automated means without any human involvement. Our current use of automation technologies includes:

• Robotic Process Automation (RPA) – Where virtual workers automate the copying and pasting of information from one system into another.
• Self-Service Platforms – Allows humans to directly interact with an RPA process, enabling human-in-the-loop processing of information.
• Artificial Intelligence (AI) and Machine Learning – To enable virtual workers to learn and understand the data presented and improve effectiveness.
• Intelligent Automation Digital Assistant – An AI supervisor that automatically manages, tracks, and orchestrates virtual worker schedules and activities.
• Computer Vision/Optical Character Recognition – Offers pattern matching within images and can be used to interpret complicated language-based text recognition.
• Natural Language Processing – Translates/extracts human language into computer readable information (think “Hey Siri”) for the purpose of classifying information.
• Conversational AI – Uses AI and Natural Language Processing to enable real-time conversations with customers via the use of chatbots.
• API End-points – Uses virtual workers to bridge the gap between old systems and new ones by copying and pasting information across.

We do not anticipate that any of the automation technologies described above will produce legal or similarly significant effects on you, however if this was to change in the future, we would only do so where it is:

• Necessary for the entry into or performance of a contract; and
• Authorised under domestic laws applicable to the data controller; or
• Based on your explicit consent.

7. Who we share your personal data with

Within Davies Group, your personal data will be shared with those team members who need to access it for the processing purposes outlined in this Privacy Policy.

We will only share your personal data with other parties where it is reasonable and necessary to accomplish the processing purposes outlined in this Privacy Policy. This may include (but is not limited to) where we:

• Are required to share information with law enforcement bodies and/or fraud prevention agencies for the purpose of preventing or detecting fraud or criminal activities; or
• Rely on the services of third-party service providers and hosting providers to carry out activities, provide services, or undertake business operations on our behalf. For example, we may use Hotjar in order to better understand our users’ needs and to optimise their service and experience when using our websites. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices, then stores this information on our behalf in a pseudonymised user profile. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

In any such cases, the data we share will be limited to that which is strictly necessary and will be subject to appropriate contractual and confidentiality arrangements being in place.

Additionally, all of our third-party service providers are required to take appropriate security measures to protect your personal data, in line with Davies Group policies, and we do not allow them to use your personal data for their own purposes under any circumstances.

8. International transfers

In the course of providing our products and services to you, there are circumstances when we and/or one of our third-party service or hosting providers may transfer your personal information outside of the United Kingdom (UK) and European Economic Area (EEA).  Please note – where we are acting in the capacity of data processor, we will never do so without receiving appropriate authorisation from the relevant data controller.

Where such a transfer is necessary, we will only make the transfer once we can be assured that suitable protections will be maintained, and appropriate safeguards are in place. This may include:

• Ensuring that we transfer the personal data to countries that the Information ICO has deemed to provide an adequate level of protection.
• Putting suitable clauses in our contracts so that organisations take appropriate steps to give personal data the same protection it has in the UK and EEA.
• Implementing suitable technical and/or organisational measures to protect the personal data.

Please note – where your personal data needs to be transferred between the UK and EEA as part of our business-as-usual operations, this will be done on the basis that the ICO has deemed these jurisdictions to provide an adequate level of protection.

If you would like to understand more about this, please send an email outlining your query to DPO@davies-group.com.

9. How long we keep your personal data for

We will keep your personal data for as long as necessary to fulfil the purposes that we describe in this Privacy Policy, including to satisfy any applicable legal, tax-related, and other business requirements.

To determine the appropriate retention period, we also consider a number of additional factors, such as the:

• Nature and sensitivity of the personal data.
• Potential risk of harm from unauthorised use or disclosure of the personal data.
• Requirements of the relevant data controller, where we are acting in the capacity of data processor.

10. How we keep your data secure

Davies Group has implemented an Information Security Management System (ISMS) which is certified globally to International Standards Organisation (ISO) 27001 for Information Security. This demonstrates our commitment to manage risks related to the security of the personal data we own and handle. Where applicable (UK) we are also certified to Cyber Essentials Plus.

Both certifications are supported by an internal audit function and annual external certification.

11. Your rights

Davies Group is committed to processing your personal data in compliance with all applicable laws and regulations. Under UK/EU GDPR, you may be able to exercise several individual rights, including:

Right of Access

You have the right to ask us for a copy of the personal data we hold about you, as well as other supplementary information.

Right to be Informed

You have the right to know how we will collect and use your personal data.

Right to Rectification

You have the right to ask us to rectify personal information you think is inaccurate, or to complete information you think is incomplete.

Right to Erasure

You have the right to ask us to erase your personal data, in certain circumstances. Please note – there may be certain circumstances under which we are obliged to retain your personal data.

Right to Restrict Processing

You have the right to request the restriction or suppression of your personal data. This means that you can limit the way we use your data.

Right to Object

You have the right to object to the processing of your personal information, in certain circumstances.

Right to Data Portability

You have the right to ask that we transfer the personal information you gave us to another organisation, or to yourself, in certain circumstances.

Rights Related to Automated Decision-Making and Profiling

You have the right to request human intervention where a decision has been taken about you using fully automated decision-making or profiling, and which produces legal or similarly significant effects on you, such as the automatic refusal of a claim.

To exercise any of the rights outlined above, please contact us at SAR@davies-group.com.

12. How to complain

We aim to meet the highest standards to safeguard your privacy. However, if you have any concerns about Davies Group’s use of your personal data, you can make a complaint to our Data Protection Officer by emailing DPO@davies-group.com, or by writing to:

Data Protection Officer

Davies Group

3rd, and 4th Floors

No.2 Smithfields

Stoke-on-Trent, ST1 3DH

United Kingdom

You also have the right to contact the data protection regulator if you feel that we have processed your personal data in a manner which contravenes privacy law. You can do this by following the link to their website: https://ico.org.uk/make-a-complaint/. Alternatively, you can contact them by:

Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Email: casework@ico.org.uk

Phone: 0303 123 1113 (Local rate) or 01625 545 745 (National rate)

13. Contact Us

Our Group Data Protection Officer is Adam Banks-Smith.

If you have any questions that could not be answered by this Privacy Policy or if you wish to receive more in-depth information about any of the content within it, please contact us at:

Post: Data Protection Officer, Davies Group, 3rd, and 4th Floors, No.2 Smithfields, Stoke-on-Trent, ST1 3DH, United Kingdom

Email: DPO@davies-group.com

14. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time, and we will provide you with a copy of the updated Privacy Policy (displayed electronically) when we make any substantial changes. We may also notify you in other ways from time to time about changes to the processing of your personal information.

Subsidiaries 

The Davies Group incorporates the following legal entities, all registered in England and Wales unless otherwise stated: