Halliwell Forensics Limited, Ireland branch - GDPR Statement
Summary
We value the privacy of your personal information.
This Privacy Statement of Halliwell Forensics Limited, operating through its Ireland branch outlines how we collect, hold, use and disclose your personal information in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018 (Ireland).
For the purposes of GDPR, Halliwell Forensics Limited, Ireland branch, may act either as a data controller, a joint controller, or a data processor, depending on the circumstances.
In most cases, where we are instructed by insurer or corporate clients to carry out forensic or investigative services, we act as a data processor on their behalf and process personal data strictly in accordance with their instructions.
In some circumstances, where we provide services directly and are not acting on the instructions of a third-party client (for example, where we are engaged directly by an individual or organisation), Halliwell Forensics Limited, Ireland branch, acts as the sole data controller and determines the purposes and means of processing personal data.
By visiting our website, using any of our services, or providing us with your personal information, you acknowledge that your personal information will be processed as described in this Privacy Statement.
Where we obtain personal data indirectly, this will normally occur on the instructions of our clients as data controllers and on the lawful bases they rely on. This may include relying on any consent you have previously provided to those clients or controllers to share your personal data with third parties such as us for the purposes of investigating and managing claims or related matters, as well as other lawful bases such as necessity for insurance claims handling, fraud prevention, or compliance with legal obligations.
The Purposes for Which We Hold, Use and Disclose Personal Information
We collect personal information to assist our clients in forensically investigating loss incidents (e.g. when we act for an insurer, this will involve us collecting personal information from insureds, claimants and other third parties involved in the claim, as well as checking the validity of such information).
We hold limited personal data which we use to inform our clients’ employees about corporate events and services that we provide. No such communication will be sent to individuals who withdraw their consent or otherwise opt out of such communications.
We also use the personal information that we hold, to contact you, to notify you about changes to our service, to verify your identity, and to provide customer support.
We provide the personal information we collect to our insurer clients, their agents and advisers such as lawyers. This is to assist the insurer or their agent to manage and administer their relationship with the insured, and to decide or advise on payment of a claim. We also provide personal information to other third parties who can confirm the information provided to us (e.g. repairers, witnesses to a claim or law enforcement agencies) to assist us in providing our insurance claims services (e.g. our investigators and other agents and contractors) or to assist with asset management assignments.
Where we disclose information to third parties, we limit the use and disclosure of personal information provided to us by them for the purposes for which we collected it (e.g. in relation to the handling or settlement of the relevant claim). Our insurer clients, their agents, advisers and other relevant third parties may have their own privacy policy that contains information about their privacy practices and how you can access any personal information they hold about you, seek correction of it or make a complaint about a breach of the GDPR.
We may also hold and use your personal information, and disclose your personal information to relevant third parties for the following purposes:
- To deal with enquiries – we may need to collect your personal information to answer an enquiry you make;
- Dealing with a complaint – for example a complaint made by you in respect of service provision;
- Maintaining and improving our service, auditing, quality assurance and training – for example, we may review your personal information to identify how our services can be improved;
- Assisting with the claims process by providing your name address and phone numbers to contractors
- Other purposes – for any other purpose communicated to you at the time we collect your personal information or otherwise permitted or required by law.
Occasionally we may be required or authorised to collect personal information because of laws in Ireland or an order of a Court / Tribunal. If we are collecting personal information for this purpose, and we are permitted to do so, we will inform you.
International Transfers
We may transfer your personal data outside of Ireland where a relevant third party, such as an insurer, reinsurer or their authorised representatives, is located outside of Ireland. Insurers are most commonly located in UK, Europe and USA.
Where this occurs, we ensure that appropriate contractual arrangements are in place requiring those parties to comply with applicable Irish and EU data protection laws, and with our information security requirements. Any such international transfers are carried out in accordance with GDPR, including where applicable through the use of EU adequacy decisions, Standard Contractual Clauses approved by the European Commission, and other appropriate safeguards.
Where we collect personal information from you, please let us know if you have any objections to that information being disclosed to the categories of third parties referred to above, where such disclosure is permitted by law.
Categories of Data
The categories of personal data we process when handling claims are determined by the data controllers we are acting for and based on their instructions to us, or, where we act as a sole data controller, by reference to the purposes described in this Privacy Statement.
Personal Information We Collect and Hold
The personal information we collect and / or hold about you and other individuals (such as a co-insured or your spouse, partner or children) may include:
- name, date of birth and gender of you, your colleagues/employees and/or family members,
- contact details such as address, phone, fax and email of said persons
- medical data;
- county court judgements;
- information relevant to providing a service such as:
- your claims history;
- information obtained as part of the investigation of a loss (e.g. information on a police report);
- details of insurance policies you hold or have held; and
- sensitive information such as criminal records (e.g. where this information is relevant to investigating an incident).
Medical data constitutes special category personal data under Article 9 GDPR. Information relating to criminal convictions or offences constitutes criminal offence data under Article 10 GDPR. We process such data only where necessary for the purposes explained above and in accordance with applicable data protection requirements, including the implementation of appropriate safeguards.
What Happens if You Don’t Give Us Your Personal Information
If you don’t provide us with the required personal information, we and our clients may not be able to provide you with some or all services (e.g. we may not be able to access or assess your claim).
How We Collect Information
We may collect personal information about you and other individuals in various ways including:
- over the phone, including telephone recordings;
- audio/visual recordings, including CCTV;
- in person;
- when we interview witnesses or other third parties;
- when attending site meetings in the notes of those meetings;
- in writing, including via email and hard copy forms
- social media or other on-line sources where data is in the public domain
From whom we may collect:
We may collect such information directly from you or through a variety of third parties such as repairers, suppliers, consultants, and the police. We may also collect personal information from publicly available sources such as the phone book or public websites.
When we collect personal information from you about someone else:
We may seek to collect from you, personal information about another person. This may happen if you have personal information about another person which is relevant to a claim. For example, you may have the details of a witness to an incident for which you are claiming under your insurance policy. If you provide us with information about another person, then you must:
- have their consent or another lawful basis or authority and;
- tell them:
– that you are disclosing their personal information to us; and
– refer them to this Privacy Statement.
How We Hold Personal Information
We hold personal information electronically and on paper / in hard copy.
For the personal information we hold electronically we take reasonable security measures including firewalls, secure logon processes, encryption and intrusion monitoring technologies.
For the information we hold in hard copy / on paper we have in place reasonable confidentiality procedures, and we also take reasonable security measures. We also require third party providers to hold personal information securely.
Data Retention
Your personal information will be retained for a minimum period of seven (7) years for legal, regulatory and accounting purposes, and thereafter only for as long as is reasonably necessary to fulfil the purposes for which it was collected, or as otherwise required by applicable law.
Your Rights
You have the right to withdraw your consent for us to process your personal information at any time where consent is the lawful basis relied upon for that processing. You also have the right to withdraw your consent for us to share your personal information with the third parties identified in this Privacy Statement where such sharing is based on consent.
Please note that withdrawing consent may result in us being unable to continue handling the relevant claim and may adversely affect the services we are instructed to provide by your insurers or other third parties.
You have the right to request rectification of inaccurate personal information, to request restriction of the processing of your personal information, or to object to our processing of your personal information.
You have the right to request the erasure of your personal information where it is no longer necessary for the purposes for which it was collected, or where there is no lawful basis for its continued processing.
Where we have collected your personal information from sources other than directly from you, you have the right to be informed of those sources.
You have the right to ask whether any decisions concerning you are being made by automated means and, where this is the case, to receive information about the logic involved and the potential significance and consequences of such processing for you.
You also have the right to request information about the appropriate safeguards in place where your personal information is transferred to a third country or an international organisation.
We take reasonable steps to ensure that the personal information we collect, use, store and disclose is accurate, up to date and complete. To help us do this, please inform us of any changes to your personal information. If you believe that the personal information, we hold about you is inaccurate, incomplete or out of date, please contact our Data Protection Officer using the contact details set out below to request a correction.
Accessing Your Information – Data Subject Access Request
You can make a written request to access the personal information we hold about you. If we aren’t able to meet your request for access, we’ll let you know why.
You have the rights to the following information:
- The purpose(s) for which we are processing your information.
- The categories of personal information we hold about you
- The recipients or categories of recipient to whom the personal data have been or will be disclosed.
- The period for which we will store your information; or the criteria used to determine that period
Where we act as a data processor, some of our clients may have a different process for handling such requests, and we will inform you if this is the case.
Exercising Your Rights
You can exercise any of these rights at any time by writing to:
Liz Tubb
Data Protection Officer
compliance@halliwellglobal.com
Complaints About How We Handle Your Personal Information
If you have a complaint about our handling of your personal information or an alleged breach of the principles contained in the GDPR, please contact us and provide us with the details of your complaint / the alleged breach as well as any supporting evidence. You can contact us via the below options:
Liz Tubb
Data Protection Officer
compliance@halliwellglobal.com
We will promptly acknowledge the complaint, carefully investigate it and determine the steps that we will undertake to resolve your complaint. We will contact you if we require any further information and will provide you with our determination once it is made.
If you are unhappy with our determination or are not satisfied with the way your information is handled, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):
Data Protection Commission
6 Pembroke Row,
Dublin 2,
D02 X963,
Ireland
Website: https://www.dataprotection.ie
Email address: dpo@dataprotection.ie