Old Mutual Guernsey is a Branch of Old Mutual Life Assurance Company (South Africa) Limited (OMLACSA).
The Branches are registered in Guernsey and their registered address is Albert House, South Esplanade, St Peter Port, Guernsey, GY1 3NBY. They are licensed to write long term insurance business under the Insurance Business (Bailiwick of Guernsey) Law 2002 by the Guernsey Financial Services Commission.
OMLACSA is part of Old Mutual Limited (OML) and is listed on the Johannesburg Stock Exchange with secondary listings in London, Malawi, Namibia, and Zimbabwe
You may have supplied your personal data to us through:
- application form
- claim form or other documents
- emails and letters
- by consent through your Financial Advisor
- via other companies within OMLACSA or OML
Your Financial Adviser should tell you when they pass your details on to us and you should have given your consent to allow your Financial Adviser to pass your details to us.
‘Personal data’ means any information that can be used to identify an individual person. This means information that could identify you directly or indirectly, and can include your name, address, date of birth, email address, bank details, identification number, location data, online identifier, or one or more factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity.
As required under the regulations the information we collect will be adequate, relevant, and limited to what is necessary for the purpose the information is being collected.
All personal data we collect, and hold will be processed lawfully, fairly and in a transparent manner in relation to you as our data subject.
In some circumstances we may collect sensitive information about you such as:
- details of your health;
- your race / ethnic origin; and
- genetic or biometric data (such as fingerprints).
We do not require data concerning political opinion, membership of a trade union, religious or philosophical beliefs which are also categorised as sensitive personal data however this information may be disclosed by you as part of the underwriting process, if you consider it is relevant. We have a very general question on the application form which asks clients to disclose any feature of their lifestyle which may affect / threaten their life expectancy and through this you may disclose further sensitive information.
If you make any of your sensitive personal data public such as putting information on social media, we can process that data as this information will be in the public domain.
We can also further process your sensitive personal data in the exercise or defence of legal claims for or against OMLACSA or whenever we need to comply with a court order.
As the controllers of your personal data OMLACSA may process your data:
a) to administer and operate your contracts
b) to fulfil OMLACSA's legitimate interests, during the operation, support, and development of our businesses, evaluating customer service, efficiency, cost, and risk and for management purposes
c) carrying out anti money laundering and conflict of interest checks for the prevention of financial crime or fraud
d) exercising and defending our legal rights, complying with regulatory authorities and legislation
e) for audits by national and regulatory enforcement
We will ensure your personal data is processed in a manner that is appropriately secure and we will protect your information against unauthorised or unlawful processing, accidental loss, destruction, or damage. We will do this with the implementation of internal policies, procedures, encryption of emails and data, building security such as swipe cards for building access, CCTV, internal IT testing, IT testing by external parties, internal auditing and staff training therefore treating your personal data with integrity and with the utmost confidence.
OMLACSA will not need to obtain consent of the data subject where we cannot be reasonably expected to have obtained that consent for the processing of your data. OMLACSA can process your personal data when we are not aware of you withholding consent.
Your data will not be further processed in a manner that is incompatible with the above purposes.
Data Protection law allows OMLACSA to process and retain your personal information only if we have a good reason to do so. This includes sharing your information outside of OMLACSA. We must have one or more of the following reasons to process and retain your data:
- To fulfil a contract, we have with you
- When it is our legal duty
- When it is in our legitimate interest
- When you consent to it. (When you give your consent, it should be given freely by you along with an informed indication of your wishes which signifies your agreement of your personal data being processed).
The processing of your information is done so within the legitimate interests of business or commercial activities (these are not overridden by prejudice to your privacy rights). For OMLACSA to comply with applicable regulations it will be necessary, in some cases, to disclose your personal details which would be classed as a legal duty. We will also process your data for us to assist you with your contracts under the general terms and conditions which OMLACSA considers to be a legal contract between you and OMLACSA.
OMLACSA will not share the personal data they hold about you to any non-group company or third party other than where:
- It is legally required to do so
- There is a public duty to disclose
- OMLACSA interests require disclosure
- The data is being transferred to allow the party to provide services to OMLACSA
- The disclosure is made with your consent
- OMLACSA is transferring rights and/or obligations to a third party, in which case they shall be entitled to pass your personal data to such third party
If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies to prevent fraud, money laundering and terrorist financing. A record of such disclosures will be maintained.
If OMLACSA suspects that false or inaccurate information has been furnished, they may record and report suspicion together with any other relevant information.
We can process your personal information if it is necessary for the purpose of carrying on business which consists of effecting or carrying out a contract or is personal data which relates to a data subject who is not a party to the contract or seeking to become a party to the contract and can reasonably be carried out with the consent of the data subject.
Again, as above, processing can be carried out without obtaining consent of the data subject where we cannot be reasonably expected to obtain consent for the processing of that information for instance a nominated beneficiary of a contract who does not know that they have been nominated. OMLACSA can process the data subject's personal data when OMLACSA is not aware of you withholding consent.
OMLACSA uses the services of third parties to provide services on its behalf, which does include processing personal data about you.
Your personal data may be transferred to another country, which may also include countries outside of the EEA. Most notably South Africa is not considered to be an equivalent jurisdiction for the transfer of personal data.
In those cases where the relevant country has been checked to ensure it has an equivalent level of data protection by the European Commission, or we need to make the transfer to perform a contract in your interests, we will ensure that the transferred personal data is protected by a data transfer contract. Further details can be obtained by making a request in writing to our Data Protection Officer (DPO). We can provide you with copies of any data transfer agreements on request.
To ensure we are only transferring data to countries which have the correct adequacy ratings we regularly check the EU website.
OMLACSA does not use automated decision-making processes.
When you give information about another person, you confirm that they have appointed you to act for them; they consent to the processing of their personal data, including sensitive personal data; that they consent to the transfer of their information and to receive on their behalf any data protection notices.
OMLACSA may need to collect personal information by law, or under the terms of a contract we have with you.
If you choose not to provide your personal data, it may delay or prevent us from meeting our obligations. It may mean that we cannot perform services to run your contracts which could result in a need to cancel a contract or service you have with us.
Any data collection that is optional would be made clear at the point of collection.
We will retain your personal data in a form which can identify you for seven years after your contract has finished. Reasons to retain data can include:
- Respond to questions or complaints
- To demonstrate we treated you fairly
- Maintain records according to rules that apply to us in our jurisdiction.
Should you wish to have a look at our document retention schedule stating what documents are kept and for how long please contact our DPO who can give you a copy of our document retention schedule.
We may extend retention periods if we are required to preserve personal data in connection with investigations, proceedings, and litigation.
You have a right of access to your information completely free of charge (if it is a simple request). If we do need to charge you, we will confirm what the charge is and why it is necessary to charge you. Usually, we will only charge if the information is clearly unfounded or excessive. Therefore, if you keep requesting information then it may be necessary to charge you. We will take into consideration the cost of obtaining your information and the length of time it will take to respond to your request. If you request additional copies we can also charge for the additional copies.
Should you wish to have access to your personal data you can write to the DPO to request copies. This is called a subject access request. If you wish to have more details as to how this works please contact our DPO.
If you request information that is too much or if we hold a lot of information about you, we will ask you to be specific about the information you are looking for in order that we can locate it and get it to you.
If we consider that you are asking for too much information, we do have the right to say no. If we do consider your request to be excessive, we will send you a letter or an email setting out why.
For your protection we may ask for identification confirming that it is you asking for the information. If you request copies of your information, we must provide you with your information within one month from the date we receive your identification documents.
You have a right to an electronic copy of your personal data which we can send to you encrypted.
If your request to have a copy of your personal data adversely affects the rights and freedoms of others, we will not be able to provide this however we will send a letter to you confirming this.
You have the right to question any information we have about you that you think is wrong or incomplete.
We will endeavour to ensure that all information we retain for you is accurate, complete, and up to date. Please do let us know if you have a change of personal details such as surname or contact details and help us keep your details up to date. If you become aware that the information, we hold is incorrect and have let us know we will take every reasonable step to ensure that your personal data is rectified without delay. It is a good idea to regularly check the information we have for you.
What if you want us to stop using your personal information?
You have the right to object to our use of your personal information, or to ask us to delete, remove or stop using your personal information. This is your ‘right to object’ or ‘right to be forgotten’. However, in doing so this may stop us being able to provide you with your contract or disrupt our service levels to you.
There may be circumstances where we are able to restrict the use of your data, i.e. restrict its use to certain things, such as legal claims or to exercise legal rights. In these circumstances, we would not use or share your information for other purposes while restricted.
- It is not accurate
- It has been used unlawfully but you do not want us to delete it
- It is not relevant anymore, but you want it to be retained for use in legal claims
- You have already requested your data to not be used but you are waiting for us to tell you if we can continue to use it
- You can request the restriction or objection to the processing of your personal data by sending the request in writing to our DPO
You can withdraw your consent for us holding your personal information at any time. Should you withdraw your consent this may impact your contracts, the service we provide, or stop us being able to assist you with your contract.
You can lodge complaints about our processing of your personal data with our DPO in writing.
Old Mutual Isle of Man is a Branch of OMLACSA, 5A Village Walk, Onchan, Isle of Man IM3 4EB, British Isles.
Or via E-mail: firstname.lastname@example.org
Should your complaint about our processing of your personal data not be resolved to your satisfaction you can then send your complaint to the Office of the Data Protection Authority following this link. Make a Complaint · ODPA
You may visit our offices in South Africa where we operate CCTV. We have CCTV cameras for security reasons for the protection of our staff and visitors. We do not record sound and so your voice will not be captured.
CCTV images are held for three months after which they automatically delete.
We do have the capacity to ‘hold a playback’ which means we can keep the information for longer should there be an incident. The CCTV images may then be used to defend any legal claims. Should your image be held we will inform you.
We have an internal policy for our CCTV which regulates how we use it and the images it stores which is tested by regular internal audits which are carried out on a regular basis.
You can access your information online via your OMLACSA IMS account. This facility provides you with access to your contract details, including valuations etc. When accessing online services, you will be asked to provide some personal data which may include your name and email address.
If you call OMLACSA or OMLACSA calls you, the telephone line may be recorded. The records will be OMLACSA's property and accepted by you as evidence of the orders or instructions given. A copy of the recording will be available on request for a period of seven years.
- The OMLACSA employees who will to take you through security and answer your queries
- the compliance team to check your identification documents and protect you against fraudulent claims
- the OMLACSA employees who will deal with surrendering your contract or to assist making a claim
- the IT department who provides IT services to all OMLACSA employees which includes backing up information and as such will process your data by backing up our systems
If you chose to cash in your contracts, surrender your contracts or no longer wish to use our services we will retain your information for seven years. After the seventh-year anniversary of the surrender or you leave us we will completely delete your data and we will no longer be able to provide any copies should you wish to review your personal data that we held.
We do not use your personal data to directly market our products to you
If you are not yet 18 years old, you can ask us to give you copies of information we hold about you. You can call, write, or email our DPO who will help you. We also have a separate policy which sets out information which you might find clearer and easier to read.
This is our main statement. You will find parts of this statement broken down into smaller sections in our literature and in the General Terms and Conditions. Not all parts of the statement will relate to each client. Therefore, your application forms and literature you receive about us will be tailored to suit you.
The most important thing is that you feel in control of your personal data. We will help you to do this with us as much as we can.
If you are unsure or if you feel something is not clear you can contact our DPO who will be able to answer your questions.
OMLACSA at: PO Box 68, Albert House, South Esplanade, St Peter Port, Guernsey, GY1 3NBY
Or via E-mail: email@example.com