Private Client Services privacy policy

Privacy Policy

To access Private Client Services by Mercer (“PCS”) – Fair Processing Click Here

To access Complaints Handling Procedure Click Here

Private Client Services by Mercer (“PCS”) – Fair Processing Notice

In this document, "PCS", "we", "us", "our" refer to each of PCS entity and/or business division.                        

References to "MMC Group" refers to Marsh & McLennan Companies, Inc. and its affiliates and subsidiaries, including all PCS entities.

PCS regularly collect and use information which may identify individuals ("personal data"), including insured persons or claimants ("you", "your"). We understand our responsibilities to handle your personal data with care, to keep it secure and to comply with applicable local and international data protection laws.

The purpose of this Fair Processing Notice is to provide a clear explanation of when, why and how we collect and use your personal data ("Policy"). We have designed it to be as user friendly as possible, and have labelled sections to make it easy for you to navigate to the information that may be most relevant to you and to allow you to click on a topic to find out more. 

Do read this Notice with care. It provides important information about how we use personal data and explains your legal rights. This Notice is not intended to override the terms of any insurance policy you have with insurers or contract you have with us or any rights you might have available under applicable data protection laws.

We may amend this Fair Processing Notice from time to time for example, to keep it up to date or to comply with legal requirements or changes in the way we operate our business. Please regularly check the Notice for updates. 

CONTENTS

1. WHO IS RESPONSIBLE FOR LOOKING AFTER YOUR PERSONAL DATA?

2. WHAT PERSONAL DATA DO WE COLLECT?

3. WHEN DO WE COLLECT YOUR PERSONAL DATA?

4. WHAT DO WE USE YOUR PERSONAL DATA FOR?

5. HOW DO WE USE PERSONAL DATA?

6. WHO DO WE SHARE YOUR PERSONAL DATA WITH?

7. INTERNATIONAL TRANSFERS

8. DATA ANALYTICS

9. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

10. WHAT ARE YOUR RIGHTS?

11. CONTACT AND COMPLAINTS

APPENDIX 1 - CATEGORIES OF PERSONAL DATA

APPENDIX 2 - LEGAL BASIS FOR PROCESSING

APPENDIX 3 - GLOSSARY

Who is responsible for looking after your personal data?

PCS is the Controller for purposes of complying with General Data Protection Regulation (EU) 2016/679 and laws implementing or supplementing the GDPR following the United Kingdom’s exit from the European Union.

PCS is responsible for looking after your personal data. 

1.   What personal data do we collect?

Policyholders and related parties. In order to advise, arrange, place and administer insurance policies, we collect information about the policyholder and related parties. This may include background and contact information on the policyholder or their representative, and matters relevant to the management of the insurance policy and assessment of risk. The policyholder may be an individual, company or their representative. The level and type of personal data we collect varies depending on the type of policy that you have. In some instances, it is necessary for us to collect and use Special Categories of Data, such as information about health details. We are required to establish a legal exemption to use your Special Categories of Data - see Section 4 for further details. From time to time, you may need to provide us with the personal data of third parties, for example information of members of your family. Wherever possible, you should take steps to inform the third party that you need to disclose their details to us, identifying PCS as your broker and providing them with a copy of this Fair Processing Notice. 

Claimants. If you are making a claim under a policy, we will collect your basic contact details, together with information about the nature of your claim and any previous claims. If you are an Insured Person we will need to check details of the policy you are insured under and your claims history.  Depending on the nature of your claim, it may be necessary for us to collect and use Special Categories of Data, such as details of medical illness. We are required to establish a legal exemption to use your Special Categories of Data - see Section 4 for further details.

For more information on what information we collect, please click here.

2.  When do we collect your personal data? 

Insured Persons

• we will collect information from you directly when you engage us to advise you on your risks and to arrange, place and manage mid-term amendments and changes to insurance policies for you.
• information about you may also be provided to us by other parties such as the insurer(s), other brokers, your employer, a family member or any other third person who may be applying for a policy which names you as the insured.
• we may collect information from other sources where we believe this is necessary to assist in validating claims and/or fighting financial crime. This may include consulting public registers, social media and other online sources, credit reference agencies and other reputable organisations.

Claimant

• we will collect information from you when you notify us of a claim and shall disclose such information to insurers and other third parties such as a loss adjuster, assessors, third party administrators, claims handlers and the relevant insurers.  
• we may also collect information about you if or when the claim is made by another person who has a close relationship with you or is otherwise linked to the claim - for example if the policyholder is your employer.
• we may also be provided with information by your solicitors.
• we may collect information from other sources where we believe this is necessary to assist in validating claims and/or fighting financial crime. This may include consulting public registers, social media and other online sources, credit reference agencies and other reputable organisations. 

3.  What we use your personal data for?

Insured Persons. If you are an insured person we will use your personal data to advise you of your risks and arrange your insurance policies for you. The underwriting process may include Profiling, details of which would be available from your insurer. Once your policy has been incepted, we will use your personal data to administer your policy, deal with your queries, manage mid-term amendments and changes to policies and where applicable, manage the renewal process. We will also need to use your personal data for purposes associated with our legal and regulatory obligations as an insurance intermediary.

Claimants. If you are a claimant we will use your personal data to assess the merits of your claim, and potentially to pay out a settlement. We may also need to use your personal data to evaluate the risk of potential fraud. If you are also an Insured Person, we will use personal data related to your claim to inform the renewal process and potentially any future policy applications.  

4.  How do we use personal data?

We will make sure that we only use your personal data for the purposes set out in Section 3 and in Appendix 2 where we are satisfied that:

• our use of your personal data is necessary to perform a contract or take steps to enter into a contract with you (e.g. to manage your insurance policy), or
• our use of your personal data is necessary to comply with a relevant legal or regulatory obligation that we are subject to, or
• you have provided your consent to us using the data in that way (e.g. to send you marketing materials), or
• our use of your personal data is necessary to support 'legitimate interests' that we have as a business (for example, to improve our products, or to carry out analytics across our datasets), provided it is conducted at all times in a way that is proportionate, and that respects your privacy rights. 

Before collecting and/or using any Special Categories of Data we will establish a lawful exemption which will allow us to use that information.  This exemption will typically be your explicit consent.

PLEASE NOTE. If you provide your explicit consent to permit us to process your Special Categories of Data, you may withdraw your consent to such processing at any time.  However, you should be aware that if you choose to do so we may be unable to continue to provide insurance services to you (and it may not be possible for the insurance cover to continue). This may mean that we will not be able to arrange and place your policies, advise you on your risks, assist you with any policy enquiries or assist you with claims you have made against the policies.  If you choose to withdraw your consent we will tell you more about the possible consequences, including the effects of cancellation, (which may include that you have difficulties finding other cover), as well as any associated cancellation fees.

Please click here to find out more about the information we collect and use about you and why.

5.  Who do we share your personal data with?

We work with many third parties, to help manage our business and deliver services. These third parties may from time to time need to have access to your personal data.

For Insured Persons these third parties may include:

• Brokers, Insurers, Re-insurers and Third Party Administrators who work with us to help manage the underwriting process and administer our policies,
• Service Providers, who help manage our IT and back office systems and processes,
• our regulators, as well as other regulators and law enforcement agencies in the EEA and around the world,
• credit reference agencies and organisations working to prevent fraud in financial services, and
• solicitors and other professional services firms.

For Claimants this may include:

• Third Party Administrators who work with us to help manage the claims process,
• Loss Adjusters and claims experts and other professionals who help us assess and manage claims,
• Service Providers, who help manage our IT and back office systems and processes,
• Assistance Providers, who can help provide you with assistance in the event of a claim,
• credit reference agencies and organisations working to prevent fraud in financial services, and
• solicitors, who may be legal representatives for you, us or a third party claimant.

We may be under legal or regulatory obligations to share your personal data with courts, regulators, law enforcement or in certain cases other insurers. Also, if we were to sell part of our businesses we would need to transfer your personal data to the purchaser of such businesses.

6.  International transfers

From time to time, we may need to share your personal data with another PCS entity located in another country. Depending on the services we provide to you, we may also transfer your personal data to Insurers, Reinsurers, our Service Providers or Assistance Providers, who may be located outside the country that PCS is located. 

We will always take steps to ensure that any international transfer of information is carefully managed to protect your rights and interests:

• we will only transfer your personal data to countries which are recognised as providing an adequate level of legal protection, or
• transfers within the MMC Group of companies will be covered by contractual clauses which gives specific contractual protections designed to ensure that your personal data receives an adequate and consistent level of protection wherever it is transferred within the MMC Group, or
• where the personal data of EEA subjects have been provided to us in the EEA and you have informed us as such,  transfers to Insurers, Reinsurers, Service Providers, Assistance Providers and other third parties will always be protected by contractual commitments such as signing the appropriate contractual clauses with them or where appropriate further assurances. 

7. Data analytics 

We routinely analyse information in our various systems and databases to help improve the way we run our business, to provide a better service and to enhance the accuracy of our risk models.  We take steps to protect privacy by aggregating and where appropriate anonymising data fields (particularly in relation to policy information and claim details) before allowing information to be available for analysis.

8. How long do we keep your personal data?

We will retain your personal data for as long as is reasonably necessary for the purposes listed in Section 3 of this Notice. In some circumstances, we may retain your personal data for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax or accounting requirements.will retain your personal data for as long as is reasonably necessary for the purposes listed in Section 3 of this Notice. In some circumstances, we may retain your personal data for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax or accounting requirements.

In specific circumstances, we may also retain your personal data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal data or dealings.

In specific circumstances, we may also retain your personal data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal data or dealings.

We maintain a data retention policy which we apply to records in our care. Where your personal data is no longer required, we will ensure it is either securely deleted or stored in a way which means it will no longer be used by the business.

9. What are your rights?

You have a number of rights in relation to your personal data. 

Where you are a data subject, you may request access to your data, correction of any mistakes in our files, erasure of records where no longer required, restriction on the processing of your data, objection to the processing of your data, data portability and various information in relation to any Automated Decision Making and Profiling or the basis for international transfers.  You may also exercise a right to complain to your Supervisory Authority. These are set out in more detail as follows:   

To exercise your rights you may contact us as set out in Section 10. Please note the following if you do wish to exercise these rights:

• Identity. We take the confidentiality of all records containing personal data seriously, and reserve the right to ask you for proof of your identity if you make a request.
• Fees. We will not ask for a fee to exercise any of your rights in relation to your personal data, unless your request for access to information is unfounded, repetitive or excessive, in which case we will charge a reasonable amount in the circumstances.  We will let you know of any charges before completing your request.
• Timescales. We aim to respond to any valid requests within one (1) month unless it is particularly complicated or you have made several requests, in which case we aim to respond within three (3) months.  We will let you know if we are going to take longer than one (1) month. We might ask you if you can help by telling us what exactly you want to receive or are concerned about.  This will help us to action your request more quickly.
• Exemptions. Local laws provide for additional exemptions, in particular to the right of access, whereby personal data can be withheld from you in certain circumstances, for example where it is subject to legal privilege. 
• Third Party Rights. We do not have to comply with a request where it would adversely affect the rights and freedoms of other data subjects. 

10. Contact and complaints

The primary point of contact for all issues arising from this Notice, including requests to exercise data subject rights, is our Data Protection Contact.  The Data Protection Contact can be contacted in the following ways:

(i) Mail: 

Data Protection Contact

8 Marina View#09-12 

Asia Square Tower 1

Singapore 018960

(ii) Email: PCS_DPO@mercerpcs.com

If you have a complaint or concern about how we use your personal data and/or conduct of our staff, please contact us in the first instance either by mail or email (as provided above) and we will attempt to resolve the issue as soon as possible

APPENDIX 1 - CATEGORIES OF PERSONAL DATA

APPENDIX 2 - LEGAL BASIS FOR PROCESSING

APPENDIX 3 - GLOSSARY

COMPLAINT HANDLING PROCEDURE

Appendix A: Complaints Handling Procedure

1. As soon as any PCS staff becomes aware of a complaint, immediate notice must be given to the Compliance Officer and the COO.
2. Once the complaint has been escalated to the Compliance Officer and the COO, PCS staff involved in the complaint should cease all communication with the bank, banker and client.
3. New complaints which shall be looked into promptly and the complainant shall be informed that the complaint is being looked into, i.e. whenever possible by the next business day and always within two (2) business days.
   • PCS Compliance Officer shall investigate the complaint in accordance with the following process and reply to the complainant within ten (10) business days of the receipt of the complaint:
     • obtain comprehensive details of the complaint; 
     • investigate the circumstances; and
     • formulate, implement and record any necessary corrective action.
     • set out to the complainant the action proposed and/or taken and where appropriate, a request that PCS be advised if the outcome is not satisfactory; 
4. PCS Compliance Officer shall investigate the complaint in accordance with the following process and reply to the complainant within ten (10) business days of the receipt of the complaint:
5. Where the investigation of a complaint cannot be completed within 10 business days, a reply shall be sent to the complainant, explaining the reason for the delay and informing the complainant of an indicative reasonable timeframe for a response. If PCS subsequently cannot reply within the timeframe communicated to the complainant, PCS must write to the complainant again.
   • The COO must be notified of any investigation which cannot be completed within 20 working days.
6. PCS is required to monitor and review all complaints to address any trends identified.
7. Following the investigation, the PCS Compliance Officer is to discuss details and background of the case with the officer involved in the case and report such discussions and finding to the CEO, Group COO and/or Group CEO.
8. If the matter is capable of being resolved with the client and does not involve a potential financial liability, the PCS Compliance Officer shall inform the CEO, Group COO and/or Group CEO of such steps as may be necessary to have the matter satisfactorily resolved.
9. If the matter becomes a compliance violation and the reporting to the regulators is required, the Board of Directors must be informed.
10. If the matter has the potential of resulting in financial obligation on the part of the Company, the matter must be reported to the CEO, Group COO and/or Group CEO, and where appropriate, MMC/Mercer Legal, Compliance and Public Affairs. The PCS Compliance Officer would then be guided by such direction and advice as may be provided by Senior Management.
11. At the conclusion of an incident, an entry to the Complaint Log must be made to indicate the date on which the matter has been resolved.
12. If an incident has escalated to litigation or a review by the regulatory authority, there must always be involvement by the Senior Management.
13. The Complaint shall be notified to the next Board Meeting and Asia Audit Risk Committee Meeting.
14. Complaints Contact 

All complaints are to be directed to the following: 

(i) Mail: 

Private Client Services by Mercer Pte. Ltd.

8 Marina View #09-12

Asia Square Tower 1

Singapore 018960

(ii) Email: PCS_DPO@mercerpcs.com

(iii) Contact no: +65 63336311