Data Protection Notice

WHO WE ARE

Mulberry Insurance Brokers PCC Limited (company registration number C 73395), a company registered in Malta with its registered office at A3 Towers, Tower A3, Level 13, Triq il-Kanonku Karm M. Bologna, Paola PLA 1560, Malta (“Mulberry”), is the controller of the personal data described in this Notice and processes it in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Data Protection Act (Cap. 586 of the Laws of Malta).

Mulberry is enrolled in the Brokers List under the Insurance Distribution Act (Cap. 487 of the Laws of Malta) and is regulated by the Malta Financial Services Authority.

This Notice applies not only to our clients and policyholders but also to insured persons, named drivers, beneficiaries and other persons named under a policy, to claimants (including third-party claimants) and witnesses, and to the directors, officers, shareholders, beneficial owners and authorised representatives of corporate clients. Personal data collected through our website is dealt with in our separate Privacy Policy.

WHY WE PROCESS PERSONAL DATA

We process personal data for the following purposes and on the following legal bases under Article 6 of the GDPR:

arranging and administering insurance products and services, in respect of insured persons, beneficiaries and others who are not the contracting party;
providing quotations being pre-contractual steps taken at your request;
underwriting and risk assessment;
policy administration;
claims handling, including negotiation, defence, settlement, recovery and subrogation, the legitimate interests of the insurer, of other claimants and of Mulberry in the proper handling of claims;
compliance with legal and regulatory requirements, including customer due diligence and sanctions and politically exposed person screening under the Prevention of Money Laundering Act (Cap. 373) and regulations made under it, and record-keeping and reporting under the Insurance Distribution Act (Cap. 487) and applicable MFSA rules;
prevention, detection, investigation and reporting of fraud and other unlawful activities, the legitimate interests of the insurance market in combating fraud;
exercising and defending legal rights, and handling complaints protecting our legal position; and
recording telephone calls, as explained under “Call Recording” below where a record is required of us.

SPECIAL CATEGORIES OF PERSONAL DATA AND CRIMINAL OFFENCE DATA

In arranging cover and handling claims we may process special categories of personal data, in particular data concerning health, and personal data relating to criminal convictions and offences.

Where we process special categories of personal data we do so on the basis of one or more of the conditions in Article 9(2) of the GDPR, namely: that the processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)); your explicit consent, where we ask for it and you give it (Article 9(2)(a)); that the processing is necessary for reasons of substantial public interest on the basis of Union or Maltese law (Article 9(2)(g)); or that the processing is necessary to protect vital interests where you are physically or legally incapable of giving consent (Article 9(2)(c)).

Where we process personal data relating to criminal convictions and offences we do so only in accordance with Article 10 of the GDPR and applicable Maltese law, and only where it is necessary for the assessment of a risk, the handling of a claim, the prevention and detection of fraud, or our regulatory and anti-money laundering obligations.

Data of these categories is subject to enhanced access restrictions within our business. Where the processing of such data is necessary in order for cover to be arranged or a claim to be handled and we are unable to process it, we may be unable to act for you, and we will tell you if that is the case.

SHARING OF PERSONAL DATA

For the purposes outlined above, we may share personal data with:

insurers;
insurance intermediaries and agents;
surveyors and assessors;
loss adjusters;
repairers and service providers;
investigators;
credit reference agencies;
professional advisers;
banking institutions;
insurance associations;
public authorities and regulators where required.
our information technology, hosting, document management, communications and archiving service providers; and
a purchaser or prospective purchaser in connection with a transfer of all or part of our business or portfolio.

Recipients may be located both within and outside Malta and may form part of international organisations or group structures. Where a recipient processes personal data on our behalf it acts as a processor, on our documented instructions and under a written contract meeting the requirements of Article 28 of the GDPR. Insurers and certain other recipients determine their own purposes and act as controllers in their own right, in which case their own data protection notices apply; we will tell you who they are on request.

Where personal data is transferred outside the European Economic Area, we ensure that the transfer is made on the basis of an adequacy decision under Article 45 of the GDPR, of the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) (supplemented, where a transfer impact assessment shows this to be necessary, by additional measures), of binding corporate rules, or of an applicable derogation under Article 49. You may obtain a copy of the relevant safeguards from our Data Protection Officer.

SOURCES OF PERSONAL DATA

Personal data may be collected directly from you or obtained from third-party sources, including:

insurers and insurance databases;
public registers;
the Electoral Register;
Transport Malta systems;
authorised representatives;
service providers involved in the insurance process.

PROVISION OF INFORMATION

Provision of certain personal information is necessary for us to assess risk and provide suitable insurance products and services.

Failure to provide requested information may restrict our ability to offer, administer or maintain insurance cover.

You are also requested to notify us promptly of any material change in risk or alteration to your personal information.

YOUR RIGHTS

You have the following rights under applicable data protection legislation:

Right to information;
Right of access;
Right of rectification;
Right to erasure;
Right to restriction of processing;
Right to data portability;
Right to object to processing;
Right to withdraw consent where processing is consent-based;
Rights relating to automated decision-making and profiling.

Your right to object to direct marketing is unqualified: if you exercise it we will stop, without any balancing exercise.

The other rights are not absolute. In particular, we are frequently unable to erase personal data, or to stop processing it, because we are required to retain it under the Insurance Distribution Act (Cap. 487) or under anti-money laundering legislation, or because it is required for the establishment, exercise or defence of legal claims. Where we decline a request we will tell you why and explain your right to complain.

AUTOMATED DECISION-MAKING AND PROFILING

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.

Automated sanctions and politically exposed person screening is carried out where required by law, and any positive match is reviewed by a member of our staff before any action is taken. Where any automated decision within the meaning of Article 22 of the GDPR is introduced, we will inform you, explain the logic involved and the significance and envisaged consequences of the processing, and you will have the right to obtain human intervention, to express your point of view and to contest the decision.

DATA RETENTION

Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and contractual obligations.

Without prejudice to applicable legal requirements, client and policy records are retained for not less than ten (10) years from the expiry, cancellation or termination of the relevant insurance product or service, reflecting the prescriptive periods within which claims may be brought. Records obtained for customer due diligence purposes and records of transactions are retained for the period prescribed by anti-money laundering legislation, generally five (5) years from the end of the business relationship or from the transaction. Claims records are retained for 10 years. Records of advice and of demands and needs are retained for 10 years. Telephone calls are not recorder but should calls start to be recorded they will be retained for such period as prescribed by the applicable legislation..

Where a complaint, claim, investigation or legal proceedings is pending, we retain the relevant records until the matter is concluded and the applicable prescriptive period has elapsed. At the end of the applicable period personal data is securely destroyed or irreversibly anonymised.

Data is stored securely and protected through appropriate organisational and technical safeguards.

EXERCISING YOUR RIGHTS

Requests concerning personal data should be addressed in writing to:

The Data Protection Officer
michelle@mulberrybrokers.com

Requests should clearly identify the data subject and the nature of the request.

We will respond within one month of receipt. That period may be extended by up to two further months where a request is complex or where we have received a number of requests, in which case we will tell you within the first month. No fee is payable unless a request is manifestly unfounded or excessive, and we may ask you for information to confirm your identity.

CALL RECORDING

Please note that telephone calls made to and received from company telephone systems may be recorded for:

training purposes;
quality assurance;
complaint handling;
fraud prevention;
regulatory compliance.

You will be informed at the beginning of the call that it is being recorded. If you do not wish a call to be recorded, please tell us and we will offer you an alternative means of communication where we are able to do so. Recordings are accessible only to those who need them for the purposes set out above, and are retained for the period stated under “Data Retention” above.

You may request a copy of a recording of a call to which you were a party, subject to the rights of other participants and to our obligations to them.

COMPLAINTS

If you are dissatisfied with the way your personal data has been handled, please contact our Data Protection Officer first so that we can investigate. You also have the right to lodge a complaint with:

Office of the Information and Data Protection Commissioner (IDPC)
Level 2, Airways House
Triq il-Kbira (High Street)
Sliema SLM 1549
Malta
Telephone: +356 2328 7100 | Website: idpc.org.mt

Complaints about our services, as distinct from the handling of your personal data, are dealt with under our complaints procedure and may, if not resolved to your satisfaction, be referred to the Office of the Arbiter for Financial Services.

FURTHER INFORMATION

For additional information regarding this Data Protection Notice or the processing of personal data, please contact Mulberry’s Data Protection Officer. The Data Protection Officer may be contacted at michelle@mulberrybrokers.com or by post at A3 Towers, Tower A3, Level 13, Triq il-Kanonku Karm M. Bologna, Paola PLA 1560, Malta.