Last Updated: 27/08/2026
1. Purpose
Davies Group Limited with its registered office at 5th Floor, 20 Gracechurch Street, London, EC3V 0BG, United Kingdom, and its entities and subsidiaries (hereinafter referred to as ‘Davies Group’) is committed to being transparent about how it processes your personal data.
The purpose of this Privacy Notice is to outlines how Davies Group will collect, hold, process, and share your personal data, to assist you in making informed decisions when using our website and/or accessing our products and services.
The objective of this Privacy Notice is to ensure transparency in personal data handling and maintain compliance with relevant data protection regulations, such as Singapore Personal Data Protection Act (PDPA) and Personal Data Protection Regulations.
2. Scope
This Privacy Notice applies to all Davies entities, including all regulated entities, in the following territories:
| Jurisdiction |
| Singapore |
In this Privacy Notice, the terms ‘we’, ‘our’ or ‘us’ are used to refer to Davies Group, who are the data controller or data processor (i.e. data intermediary) responsible for processing your personal data.
3. Definitions
The following key terms and definitions are used in this Privacy Notice and should be interpreted in accordance with applicable privacy and data protection laws.
| Personal Data | Information relating to an identified or identifiable individual, whether true or not. This includes data that directly identifies a person (such as their name or identification number), or data that can be combined with other information accessible to the organisation to identify the individual. |
| Sensitive Personal Data | Sensitive information including health, National Registration Identity Card (NRIC) numbers, Children’s personal data, Biometric data etc. |
| Data Controller i.e. Organisation | Entity responsible for determining how personal data is processed. |
| Data Intermediary i.e. Data Processor | Individual or entity processing data on behalf of the Data Controller i.e. the organisation. |
| Data Retention | The practice of keeping data for a specified period, defined by legal and business requirements, after which it is securely deleted. |
| Individual Rights | Individual rights under Singapore PDPA, including access, correction, of their personal data and right to withdraw consent, right to be notified of breach. |
| International Transfers | Movement of personal data outside the Singapore under strict security controls to ensure compliance with data protection standards. |
4. The types of personal data we collect
We collect and process the following types of personal data:
• When you browse our website, we use cookies to collect usage data, which may include, but is not limited to, your IP address, browser type/version, browsing behaviour on our site (including the pages that you visit, the time spent on those pages and the date and time of your visit) and your geolocation data. More information about the types of cookies we use and our reasons for using them can be in our Cookie Policy.
• Personal identifiers, contact details, and characteristics, such as your name, country of residence, address, phone number and email address.
• Transaction Data includes details about payments to and from you and other details of forensic accounting services which you have instructed us to provide.
• Due Diligence and Anti-Money Laundering (AML) Data, including documentation and information required for client onboarding, identity verification, and screening checks (e.g. passport details, national identification numbers, or information about political exposure or criminal convictions, where legally required).
• Legal and Contractual Information, including copies of correspondence, signed contracts, declarations, or dispute resolution materials containing personal identifiers, where necessary for fulfilling legal obligations or maintaining business records.
• Sensitive Categories of Personal Data including health and/or medical diagnosis information, which may be held, used, and processed for the purpose of providing the services offered by Davies Group.
• We may collect personal data relating to children, but only if consent has been obtained (where required) from a parent or guardian, and the information is relevant to the products and services we provide.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
5. Where we obtain your personal data from
The personal data we process may be collected from a variety of sources including, but not limited to:
• Experts.
• Fraud prevention agencies and organisations.
• Industry regulators, government authorities, supervisory bodies, and ombudsman services, including (where applicable) data protection authorities, financial regulators, and dispute‑resolution bodies that oversee our industry or operations.
• Insurance companies.
• Insurance industry databases.
• Intermediaries, such as claims management companies.
• Law enforcement agencies.
• Loss adjusters and claims investigators.
• Other third parties.
• Our clients.
• Our website cookies.
• Social media.
• Public sources.
• Third party data providers/search systems.
• Your Insurer/Underwriter.
• Send information to us as a part of our investigations into an investigation you have asked us to perform or an insurance claim you have made.
• Complete any form or create an account on our website i.e. direct interactions.
• Subscribe to our publications.
• When you subscribe to our publications, request to receive marketing materials, or provide feedback such as comments on our website blogs or articles.
During the course of providing our services, we may also collect personal data from you directly, for example when the information is needed to progress your claim.
6. How we use your personal data
The purpose for which we will use personal data will depend on your relationship with our organization. We may use personal data for the following purposes:
• To provide and manage our services, including claims handling, insurance support, and consulting services etc.
• To manage our relationship with clients and business partners.
• To comply with legal and regulatory obligations.
• To protect our business, systems, and data (including fraud prevention, security monitoring, complaint handling, maintaining or servicing accounts, operating user accounts for security purposes, providing customer service, processing or verifying customer information, processing payments, providing analytics services, providing storage, or providing similar services;) and to improve our services, systems, and customer experience.
• To manage recruitment and employment processes.
• To send marketing communications (where permitted by law).
We process personal data based on the lawful bases set out under applicable data protection laws.
7. Our lawful bases for processing your personal data
We may collect, use, or disclose your personal data in the following ways, where permitted or required under applicable data protection laws such as Singapore PDPA:
1. Express Consent
You may provide your clear, affirmative agreement for us to collect, use, or disclose your personal data for specified purposes. Please note – for any processing we undertake which relies on your consent, you are able to remove your consent at any time by contacting our Data Protection Officer at DPO@davies-group.com
2. Deemed Consent
• By Conduct:
When you voluntarily provide your personal data for a particular purpose (such as filling out a form or contacting us), we may deem this as consent for that purpose.
• By Contractual Necessity:
If you provide personal data to us in connection with a contract or intended transaction, and such data is reasonably necessary to perform the contract, your consent may be deemed.
• By Notification:
In some cases, we may notify you of the intended collection, use, or disclosure of your personal data and allow you a reasonable opportunity to opt out. If you do not opt out within the stated timeframe, your consent may be deemed – provided we have assessed that this is unlikely to have any adverse effect on you.
Exceptions to Consent
Under the Singapore PDPA, we may collect, use, or disclose your personal data without your consent in specific situations as prescribed by law. These include:
• Vital Interests: Processing is necessary to respond to an emergency that threatens the life, health, or safety of the individual or another person.
• Legal or Business Obligations: Processing is necessary to comply with legal obligations or for evaluative purposes such as assessing suitability for employment.
• Public Interest: Processing is in the public interest, such as for public health or safety.
• Legitimate Interests: Processing is necessary for the legitimate interests of the organization or another person, provided these interests are not overridden by the individual’s rights and interests. For example, when you register to attend an event or webinar, we will use your contact details to contact you about the event/webinar and inform relevant staff, and any partner that we are running the event/webinar with, that you will be attending. We may also use your name for name tags and any other event management requirements, including but not limited to table arrangements, corporate gifting and collateral.
• Contract: Processing is necessary for a contract we (or the relevant data controller, where we are acting in the capacity of data processor) have with you, or because you have asked us to take specific steps before entering into a contract.
• Business Improvement: Processing is for improving or enhancing products or services, subject to certain conditions.
• Research Purposes: Processing is for research purposes, including historical or statistical research, under specific conditions.
• Business Asset Transactions: Processing is necessary for a business asset transaction, such as a merger or acquisition.
8. Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note – we may process your personal data without your knowledge or consent in compliance with the above rules, where this is required or permitted by law. For example, where the processing relates to the detection and prevention of crime.
9. Automated processing and use of AI technologies
In some circumstances, we may use automation technologies and AI systems to support the processing of personal data, improve operational efficiency, and enhance user experience. These tools do not make decisions about individuals without human involvement, but rather assist with internal workflows, customer interactions, and data analysis. Our current use of automation technologies includes:
• Robotic Process Automation (RPA) – Where virtual workers automate the copying and pasting of information from one system into another.
• Self-Service Platforms – Allows humans to directly interact with an RPA process, enabling human-in-the-loop processing of information.
• Artificial Intelligence (AI) and Machine Learning – To enable virtual workers to learn and understand the data presented and improve effectiveness.
• Intelligent Automation Digital Assistant – An AI supervisor that automatically manages, tracks, and orchestrates virtual worker schedules and activities.
• Computer Vision/Optical Character Recognition – Offers pattern matching within images and can be used to interpret complicated language-based text recognition.
• Natural Language Processing – Translates/extracts human language into computer readable information (think “Hey Siri”) for the purpose of classifying information.
• Conversational AI – Uses AI and Natural Language Processing to enable real-time conversations with customers via the use of chatbots.
• API End-points – Uses virtual workers to bridge the gap between old systems and new ones by copying and pasting information across.
We do not anticipate that any of the automation technologies described above will produce legal or similarly significant effects on you, however if this was to change in the future, we would only do so where it is:
• Necessary for the entry into or performance of a contract; and
• Authorised under domestic laws applicable to the data controller; or
• Based on your explicit consent.
10. Who we share your personal data with
Within Davies Group, your personal data will be shared with those team members who need to access it for the processing purposes outlined in this Privacy Notice.
We will only share your personal data with other parties where it is reasonable and necessary to accomplish the processing purposes outlined in this Privacy Notice. This may include (but is not limited to) where we:
• Are required to share information with law enforcement bodies and/or fraud prevention agencies for the purpose of preventing or detecting fraud or criminal activities; or
• Rely on the services of third-party service providers and hosting providers to carry out activities, provide services, or undertake business operations on our behalf. For example, we may use Hotjar in order to better understand our users’ needs and to optimise their service and experience when using our websites. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices, then stores this information on our behalf in a pseudonymised user profile. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.
In any such cases, the data we share will be limited to that which is strictly necessary and will be subject to appropriate contractual and confidentiality arrangements being in place.
Additionally, all of our third-party service providers are required to take appropriate security measures to protect your personal data, in line with Davies Group policies, and we do not allow them to use your personal data for their own purposes under any circumstances.
11. International transfers
Davies Group operates internationally and personal data may be transferred to, accessed from, or processed in countries other than the country in which it was collected, including by Davies Group entities, our Global Capability Centre in India, and authorised third-party service providers.
Where we transfer, disclose, store, or otherwise make personal data available outside the country in which it was collected, we will take appropriate steps to protect that data in accordance with applicable data protection laws. These steps may include:
• conducting due diligence on overseas recipients and service providers;
• relying on adequacy decisions, recognised comparable protection mechanisms, or equivalent legal safeguards where available;
• entering into appropriate contractual arrangements, such as standard contractual clauses, model contract clauses, intra-group transfer arrangements, data processing agreements, or other equivalent contractual protections;
• carrying out transfer risk assessments where required or appropriate;
• implementing supplementary technical and organisational measures;
• ensuring overseas recipients are required to protect personal data to a standard that is comparable or equivalent to the protection required under applicable data protection laws;
• limiting overseas transfers to what is necessary for the relevant purpose.
If you would like to understand more about this, please send an email outlining your query to DPO@davies-group.com.
For a list of Davies Group subsidiaries and legal entities, please refer to our Global Privacy Notice.
12. How long we keep your personal data for
We will keep your personal data for as long as necessary to fulfil the purposes that we describe in this Privacy Notice, including to satisfy any applicable legal, tax-related, forensic, and other business requirements.
To determine the appropriate retention period, we also consider a number of additional factors, such as the:
• Nature and sensitivity of the personal data.
• Potential risk of harm from unauthorised use or disclosure of the personal data.
• Requirements of the relevant data controller, where we are acting in the capacity of data intermediary.
13. How we keep your data secure
Davies Group has implemented an Information Security Management System (ISMS), which is globally certified to the International Organization for Standardization (ISO) 27001 standard for Information Security. This demonstrates our commitment to managing risks related to the security of the personal data we own and handle. We implement a range of technical, organisational, and physical security measures aligned with industry standards to protect your personal data from loss, misuse, unauthorised access, disclosure, alteration, or destruction. Our robust controls, policies, and procedures ensure that only authorised personnel have access to your information, maintaining its security throughout its lifecycle. These measures are further supported by an internal audit function and annual external certification.
14. Your rights
Davies Group is committed to processing your personal data in compliance with all applicable laws and regulations. Under Singapore Personal Data Protection Act (PDPA) and Personal Data Protection Regulations, you may be able to exercise several individual rights, including:
• Right to Be Informed: You have the right to be informed about the purposes for which your personal data is being collected, used, or disclosed. We are required to notify you of these purposes at the time of collection or before any use or disclosure, so that you can make informed decisions about your data.
• Right to Give and Withdraw Consent: You have the right to give your consent for us to collect, use, or disclose your personal data for specific purposes. You may also withdraw that consent at any time, and once we receive your withdrawal request, we will stop processing your data unless required or permitted by law.
• Right to Access: You have the right to obtain confirmation from us about whether your personal data are being processed. If your data are being processed, you have the right to access the data and receive information about the processing activities.
• Right to Correction: You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
• Right to Be Notified of a Data Breach: You have the right to be informed if your personal data is involved in a data breach that is likely to result in significant harm to you. We are legally required to notify you in such cases, so that you can take the necessary precautions.
These rights may not apply in some cases, including where providing access is unreasonably burdensome or expensive under the circumstances or where it would violate the rights of someone other than the individual requesting access.
To exercise any of the rights outlined above, please contact us at SAR@davies-group.com. We may request specific information from you to confirm your identity. In some circumstances we may charge a reasonable fee for access to your information.
15. How to complain
We aim to meet the highest standards to safeguard your privacy. However, if you have any concerns about Davies Group use of your personal data, you can make a complaint to our Data Protection Officer by emailing DPO@davies-group.com, or by writing to:
Data Protection Officer
Davies Group
3rd, and 4th Floors
No.2 Smithfields
Stoke-on-Trent, ST1 3DH
United Kingdom
Additionally, as per Singapore PDPA if you believe that your personal data has been mishandled or that we have not complied with the PDPA, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore
Link: https://www.pdpc.gov.sg/complaints-and-reviews/report-a-personal-data-protection-concern
Note: The above link to the Personal Data Protection Commission (PDPC) complaint page may be updated from time to time, as government websites are periodically revised. If the link does not work, please visit the PDPC’s official homepage at https://www.pdpc.gov.sg
16. Contact us
Our Group Data Protection Officer is Adam B Smith.
If you have any questions that could not be answered by this Privacy Notice or if you wish to receive more in-depth information about any of the content within it, please contact us at:
Post: Data Protection Officer, Davies Group, 3rd, and 4th Floors, No.2 Smithfields, Stoke-on-Trent, ST1 3DH, United Kingdom
Email: DPO@davies-group.com
17. Changes to this privacy notice
We reserve the right to update this Privacy Notice at any time, and we will provide you with a copy of the updated Privacy Notice (displayed electronically) when we make any substantial changes. We may also notify you in other ways from time to time about changes to the processing of your personal data.