Privacy Notice: Lloyd’s Lab
Effective date – 30 November 2018
This Privacy Notice applies to all mentors, innovation advisers and participants of the Lloyd’s Lab. This Privacy Notice describes how Lloyd’s, in addition to L Marks Limited (“L Marks“) and the Boston Consulting Group UK LLP (“BCG“) (where they are acting and processing personal data on behalf of Lloyd’s), collects, uses, shares and retains the personal information you provide. It also informs you about your choices regarding use, access and correction of your personal information. Lloyd’s is committed to ensuring that any personal data it receives is protected and handled in accordance with applicable data protection laws.
For the purposes of this Privacy Notice, references to “we”, “us” or “our” shall refer to Lloyd’s, L Marks and BCG unless the context requires otherwise.
2 Who Lloyd’s are
Lloyd’s are the Society of Lloyd’s (“Lloyd’s”) incorporated by Lloyd’s Act 1871 whose principal place of business is at One Lime Street, EC3M 7HA. The Lloyd’s Lab is an innovation accelerator, based within the Lloyd’s building, for the development of products, platforms and processes designed to help transform Lloyd’s into an increasingly technology-driven market.
3 What personal information we process about you
We will process the personal information that you provide to us, along with personal information about you which we obtain from other sources (for example, publicly-available information sources such as LinkedIn). This personal information may include all or some of the following:
- Identity Data includes first name and last name
- Job Data includes your job title and the name of the company you work for or are affiliated with
- Contact Data includes your business address, business email address and business telephone numbers
- Visual Data includes photographs and video recordings
- Screening Data (for lab participants only) includes screening information required for visa and sanctions checks
4 Why we collect your personal information and the lawful basis for processing
We will collect information from and about you so that we can properly involve you in the Lloyd’s Lab.
For example, the Lloyd’s Lab involves the interaction between different people, including:
- Your interaction with Lloyd’s
- Interactions between participants on the one hand, and mentors and/or innovation advisers on the other hand
- Judges and attendees who attend Lloyd’s Lab events (including Pitch Day).
It is necessary for us to collect and process your Identity Data, Job Data and Contact Data in order to facilitate these interactions, to manage our relationship with you (e.g. to notify you about upcoming events or any decisions which are made in respect of the Lloyd’s Lab), and to provide support and guidance. We may also use your Visual Data in publicity materials for the Lloyd’s Lab (including on Lloyds.com, at Lloyd’s Lab events, and on Lloyd’s social media accounts such as Twitter).
For participants in the Lloyd’s Lab, we may also need to collect and process your Screening Data for compliance purposes, for completing due diligence on you, and for providing information about you to Lloyd’s subsidiaries and the Lloyd’s Market Association.
We will also use your personal data where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
5 Who Lloyd’s are sharing your data with
Lloyd’s may share your personal information with the various person(s) referred to in section 4 above. However, Lloyd’s will not share your Screening Data with any parties other than BCG, L Marks, or the service providers who perform the applicable screening or sanctions checks.
6 How long we keep your data
We will retain your personal information for as long as is reasonably necessary to fulfil the relevant purposes set out in this Privacy Notice. The retention period will primarily be determined by relevant legal and regulatory obligations and/or the duration of our business relationship with you, your employer or another associated party. We maintain and update regularly our data retention policy with a detailed retention schedule. We will securely delete or erase your personal information if there is no valid business reason for retaining your data. In exceptional circumstances, we may retain your personal information for longer periods of time if we reasonably believe there is a prospect of litigation, in the event of any complaints or there is another valid business reason the data will be needed for a longer period.
7 International transfers
From time to time we may need to share your personal information with Lloyd’s subsidiaries that may be based outside the European Union. We may also allow our service providers, who may be located outside the EU, access to your personal information. We may also make other disclosures of your personal information overseas, for example if we receive a legal or regulatory request from a foreign law enforcement body. We will always take steps to ensure that any international transfer of information is carefully managed to protect your rights and interests. Accordingly:
- We will only transfer your personal information to countries which are recognised as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights
- Transfers within Lloyd’s overseas offices will be covered by standard contractual clauses adopted by the European Commission which gives specific contractual protections designed
to ensure that your personal information receives an adequate and consistent level of protection
- Transfers to service providers and other third parties will always be protected by contractual commitments and, where appropriate, further assurances
- Any requests for information we receive from law enforcement or regulators will be carefully checked before personal information is disclosed.
Information relating to the safeguards in place for all international transfers can be obtained by writing to the DPO, whose details can be found in section 9.
8 Your rights
You have certain rights as an individual which you can exercise in relation to the information we hold about you. If you make a request to exercise any of your rights we reserve the right to ask you for proof of your identity. We aim to acknowledge your request as soon as possible.
You have the following rights:
The right to access
You are entitled to confirmation as to whether we are processing your data, a copy of your data, and information about purposes of processing, who do we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, where we got your data from, and how you can make a complaint.
The right to correction
If you believe the personal information we hold about you is inaccurate or incomplete you can request for it to be corrected.
The right to erasure
If you terminate your contract with us or you believe the personal information is no longer necessary for the purposes for which it was collected, you may request your data to be deleted. However, this will need to be balanced against other factors, for example there may be certain regulatory obligations which mean we cannot comply with your request.
The right to restriction of processing
You can ask us to restrict (i.e. keep but not use) your personal data, but only where:
- Its accuracy is contested, to allow us to verify its accuracy
- The processing is unlawful, but you do not want it erased
- It is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims
- You have exercised the right to object, and verification of overriding grounds is pending.
We can continue to use your personal data following a request for restriction, where we have your
consent; to establish, exercise or defend legal claims; or to protect the rights of another natural or legal
The right to object
You have the right to object at any time to processing of your personal data where processing is
necessary for the performance of a task carried out in the public interest, or in the exercise of an official
authority vested in the controller. You may also object where the processing is necessary for the
purposes of the legitimate interests, except:
- Where such interests are overridden by compelling legitimate grounds for the processing which override your interests, rights and freedoms
- For the establishment, exercise or defence of legal claims.
9 Contact details of the Data Protection Officer
If you have any questions relating to data protection that you believe we will be able to answer, please contact our Data Protection Officer:
Data Protection Officer
1 Lime Street
EC3M 7HA, London
If you are not satisfied with our response or believe we are not processing your personal data in accordance with legal requirements, you can make a complaint to the relevant Data Protection Authority. Our Lead Authority within the European Union is the UK Information Commissioner’s Office (https://ico.org.uk/concerns/).