ViVet Limited, (hereinafter ViVet) regards the lawful and correct treatment of personal information as very important to its successful operations and to maintaining confidence between ViVet and those with whom it carries out business. ViVet ensures that it treats personal information lawfully, correctly and securely.

THE PRINCIPLES OF DATA PROTECTION

ViVet is fully committed to ensuring the security and protection of the personal information that ViVet processes, and to providing a compliant and consistent approach to data protection in accordance with the requirements of applicable data protection law,[1] which stipulate that anyone processing personal data must comply with the following principles of good practice:

Lawfulness, fairness and transparency – personal data shall be processed lawfully, fairly and in a transparent manner.

Purpose limitation – personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

Data minimization – personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy – personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.

Storage limitation – personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Integrity and confidentiality – personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

VIVET PRINCIPLES OF HANDLING OF PERSONAL DATA

Through appropriate management and the use of strict criteria and controls, ViVet:

• fully observes conditions regarding the fair collection and use of personal information;

• meets its legal obligations to specify the purpose for which information is collected and used;

• collects and processes appropriate information only to the extent that is needed to fulfil operational needs or to comply with any legal requirements;

• ensures the quality of information used is correct and up-to-date;

• ensures that personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes;

• takes appropriate technical and organisational security measures to safeguard personal information; and

• ensures that the rights of people about whom the information is held can be fully exercised under the data protection laws.

PROCESSING OF YOUR PERSONAL DATA BY VIVET

 ViVet processes the personal data as defined below.

For Employees and Candidates:

A. Employees, including trainees

 Purposes:

• Performance of employment contracts.

• Compliance with legal and regulatory obligations (work permits, visas, health insurance, pension plan, regulatory fitness and property verification).

 Lawful Basis:

• Processing is necessary for performance of an employment contract.

• Processing is based on data subject explicit consent.

• Processing is necessary for ViVet compliance with the applicable law.

• Processing is necessary for the purpose of carrying out the obligations and exercising the specific rights of a Controller or a data subject in the context of the data subject’s employment.

 B. Candidates

 Purposes:

• Performance recruitment process and assessment of a candidate.

• Compliance with legal and regulatory obligations.

 Lawful Basis:

• Processing is based on data subject consent.

• Processing is necessary for ViVet compliance with the applicable law

 C. Future employees (candidates who accepted a job offer)

•  Purposes:

• Performance of the on-boarding process.

• Preparation of employment contract.

• Compliance with legal and regulatory obligations (work permits, visas, health insurance, pension plan, regulatory fitness and property verification).

Lawful Basis:

• Processing is necessary prior to entering into an employment contract.

• Processing is based on data subject explicit consent.

• Processing is necessary for ViVet compliance with the applicable law.

• Processing is necessary for the purpose of carrying out the obligations and exercising the specific rights of a Controller or a data subject in the context of the data subject’s employment.

For other Data Subjects (Third Parties working with ViVet)

A. Business Partners[2]

Purposes:

• To manage business relationships and contractual relationships.

• To perform all contractual obligations, especially within binders, agency agreements TOBAs.

 Lawful Basis:

• Processing is necessary for purpose of legitimate interest pursued by ViVet (execution of contracts or contractual  obligations, entering into contractual relationships).

• To fulfil all regulatory obligations (compliance verifications relevant to respect of anti-money laundering and sanctions regulations).

 B. Policyholders

 Purposes:

• To manage policy subscription process, management of the cover and potential claim management process.

 Lawful Basis:

• To fulfil all regulatory and contractual obligations (compliance verifications relevant to respect of anti-money laundering and sanctions regulations).

• Processing is necessary for purpose of legitimate interest pursued byViVet (execution of contracts or contractual obligations, entering into contractual obligations).

C. Service providers, vendors, consultants, contractors

 Purposes:

• To manage contractual and commercial relationships.

• To manage services.

• To manage purchase orders and invoicing.

 Lawful Basis:

• Processing is necessary for purpose of legitimate interest pursued by ViVet (execution of contracts or contractual obligations, entering into contractual relationships).

Categories of personal data and recipients of those data are as identified in a relevant personal data processing record, which may be communicated to any concerned individual upon request. The personal data processed by ViVet is accessible only to persons working within or with ViVet organization who need to have access to it in accordance with processing purposes and a lawful basis as defined above.

Personal data may be transferred to some third parties, including third parties being located outside the United Kingdom. In such case, ViVet ensures that the transferred data is adequately protected. For more details regarding protection and safeguard measures put in place by ViVet with regard to personal data transfer, please contact ViVet Data Protection Officer at: dpo@else.co.

 ViVet retains processed personal data only for the period necessary for ViVet to fulfill its legal and regulatory obligations.

DATA SUBJECT RIGHTS

ViVet while processing personal data, observe and respect data subject rights. Any concerned individuals can enforce their data protection rights, by contacting ViVet Data Protection Officer, who can provide the following information:

• type and categories of processed data;

• purpose of the relevant processing;

• recipients to whom the personal data has/will be disclosed;

• duration of the retention of the concerned data;

• source of data (if not collected directly from individual);

• any automated processing of concerned personal data (when applicable).

 Any concerned individual has a right to ask for:

• correction and/or completion of their personal data in case of its incompleteness or inaccuracy;

• erasure of its personal data (when applicable);

• restrict the processing of its personal data.

IMPLEMENTATION

All ViVet employees are fully aware of this notice and of their duties and responsibilities under the data protection laws.

All contractors, consultants, partners or other servants or agents of ViVet must ensure that they and all of their staff who have access to personal data held or processed for or on behalf of ViVet, are aware of this notice and are fully trained in and are aware of their duties and responsibilities under the data protection laws.

ViVet has appointed a Data Protection Officer. The implementation of this notice will be led and monitored by the Data Protection Officer.  

The Data Protection Officer can be reached at ViVet Limited, 35 Ballards Lane, London N3 1XW, England or by email at dpo@else.co.

VARIATION OF NOTICE

ViVet reserves the right to amend this policy from time to time in line with the applicable legislation and ViVet business needs.

[1] Regulation (EU) No. 2016/679 (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and the Data Protection Act 2018. The UK GDPR is that version of the GDPR which the UK retained in its laws, by virtue of the European Union (Withdrawal) Act 2018, as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419).

[2] Includes capacity providers, brokers, potential capacity providers, any other partners with whom ViVet works, excluding service providers or vendors for services not strictly related to underwriting activity.