Privacy Policy

Lawful basis for our processing of sensitive personal information 

As mentioned previously, there will be occasions where we’ll hold and process information which is defined as ‘sensitive’ or ‘special’. Data privacy laws only allow us to use this type of information if we can rely on a further lawful basis, in addition to the one’s shown above.

Depending on the specific purpose, we rely on one of the following lawful bases:

• for reasons of substantial public interest which includes insurance purposes comprising:
• the ability to provide suitable advice – for example, using health information to be able to determine the most suitable annuity product;
• the ability to detect and investigate fraudulent claims – for example, using criminal records data to help to prevent and detect unlawful acts, and
• for the establishment, exercise or defence of legal claims – for example, using health or criminal records as required to establish, exercise or defend legal claims;
• it’s necessary to protect the vital interests of you or another party – for example, where an individual is either physically or legally incapable of giving consent.

Sharing your personal information
Our service providers

We’ll share personal information with selected service providers that carry out certain functions on our behalf. These include companies that provide services such as:

• technology services, including IT administration and support, software vendors, testing and production support, platform providers.
• management of both inbound and outbound communications and scanning of correspondence.
• providers of marketing, research or advertising services.
• banking and payroll services.
• tracing of customers who we’ve lost contact with, identifying customers who have deceased etc.

For those organisations that are carrying out services on our behalf, we’ll only share information where we have a lawful basis for doing so, as described above. We’ll only share with them the appropriate level of personal information necessary to enable them to carry out the service. We contractually require all our service providers:

• to keep the information safe and protected at all times, and
• to only act on our explicit instructions and not use the data for their own purposes, unless it has been suitably anonymised so it’s no longer personal information.

Other parties we may share data with

It’s often necessary for us to share personal information with other third parties where we have a lawful basis to do so, such as:

• regulatory bodies such as the Information Commissioners Office (ICO), Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), HMRC, Financial Ombudsman Service (FOS) and the Pensions Regulator.
• product providers who administer your product.
• your employer (this could be both past and present) and any party that provides services to your employer relating to the governance, administration and/or evaluation of their pension scheme, including providing advice to their members. Information, such as statistics, may be provided to your employer regarding the scheme’s efficiency, for example, to evaluate pension savings.
• trustees or administrators of a trust or pension scheme to facilitate the administration of the trust/scheme.
• other parts of the Aegon Group.
• organisations such as credit management companies, solicitors, accountants etc who are acting on your behalf.
• credit reference agencies.
• sanction-checking providers, financial crime detection agencies, financial services organisations and other parties who assist with fraud investigations and/or maintain fraud detection databases. • Financial or Pensions Ombudsman, where you’ve asked them to investigate a matter with us.
• government agencies, such as the police and courts, who may request information relating to you – we’ll release data if there’s a lawful reason to do so.
• general practitioners and other medical professionals in relation to advice we are providing. For example, obtaining medical reports to send on to product providers for the purposes of arranging and underwriting of certain products.

Additional data sharing obligations

Except for the above, we won’t disclose your personal information to any third parties, except:

• to the extent that we’re required to do so by law;
• when protecting your interests or the interests of others or for reasons of substantial public interest;
• in connection with any legal proceedings (including prospective legal proceedings);
• in order to establish or defend our legal rights;
• if we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer; or
•  if we, or substantially all of our assets are acquired by a third party, we may disclose your personal information to that third party in connection with the acquisition.

Financial crime prevention

We may disclose your information to credit, fraud and financial crime prevention agencies to enable us to verify your identity and make decisions regarding the service Origen will provide. This will be undertaken during the initial process and on an ongoing basis. Our enquiries or searches may be recorded and these agencies may supply us with financial and/or other personal information.

If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. We and other organisations may also access and use this information to prevent fraud, money laundering, tax evasion and terrorist financing.

We and other organisations may access and use the information recorded by credit, fraud, and financial crime agencies from other countries.

Automated decision making

Origen will not make automated decision making during its service to you.

Retention

We keep personal information for as long as is reasonably required for the purposes in which it was collected. Under certain circumstances, we may have to retain your personal information for longer. This is to make sure that we meet our legal, regulatory and accounting needs as set out by regulatory bodies such as the FCA and others.   

In some limited circumstances, we’re required to keep some specific information for longer, for example, pension transfer information. We’ll also retain files if we have reason to believe there’s the possibility of litigation.

We have in place and maintain a retention schedule and regularly review our obligations to make sure we don’t keep personal information longer than we’re legally obliged to. 

Your rights

You have several rights under data protection laws – you’ll find details of each of these below.

If you chose to exercise any of your rights with regards to your personal information, to make sure that we’re dealing with you, we may ask for evidence of identity. Where you have authorised a third party to act on your behalf, we’ll conduct the necessary checks to make sure the appropriate authorisations have been received. This is to make sure that we only disclose information to the correct and, where applicable, authorised individual or organisation. 

In line with our data protection obligations, we aim to respond to all valid requests relating to your personal information within one month. There may be some occasions where it will take us longer, for example, if the request is exceptionally complex. However, in these situations, we’ll let you know as soon as possible and provide details of when we’ll be in a position to respond.

There may be occasions where we don’t have to (fully) comply with a request. In these situations, we’ll explain why we’re unable to do this.   

Right of access

The right to request a copy of the personal information we hold about you, along with certain information relating to the processing of your personal information. When you request this information, this is known as making a Subject Access Request (SAR). In most cases, this will be free of charge, however in some limited circumstances, for example, repeated requests for further copies, we may apply an administration fee.

Right of data portability

The right, in certain circumstances, to have personal information that you have provided directly to us about you, transferred securely to another service provider in electronic form. This right is only applicable where:

• the processing of your personal information is based either on your consent or in line with the performance of a contract with you, and
• the processing of your personal information is carried out by automated (for example, electronic) means.

Right of rectification

The right to have any inaccurate personal information we hold about you corrected.

Right of erasure (‘Right to be forgotten’)

The right to have any out-of-date personal information deleted once there’s no legal requirement or business need for us to retain it. This isn’t an absolute right as we may need to consider other legal and regulatory requirements which could result in us having to retain your personal information for a specific period of time. 

Right to restrict processing

The right to restrict some processing, in limited circumstances, and where we don’t have legitimate grounds for processing your personal information. 

Right to object

The right to object to your personal information being used to send you marketing material. You can remove or add your consent at any time.

You can also object where you have grounds relating to your particular circumstances and we rely on ‘legitimate interests’ as our lawful basis for processing your personal information. However, where we believe we have compelling legitimate grounds, we’ll continue to process it. 

Exercising your rights

To exercise any of these rights, please contact our Data Protection Officer.

Sending data outside of the UK and European Economic Area (EEA)

The personal information that we or those acting on our behalf process, may be transferred outside of the UK or EEA, in connection with the above uses.

Where any such transfer occurs, we take the necessary steps to make sure that your personal information is protected to the same standard as if it were in the UK. This will include measures such as the adoption of contractual agreements with the other party to make sure that adequate safeguards are put in place.

For any transfers to another part of the Aegon group, these will be covered by an agreement which also obliges the other group member to make sure that adequate safeguards are put in place.   

Making a complaint

If you believe we haven’t processed your personal information in accordance with our data protection obligations, and that you’ve been affected by this, you can make a complaint by contacting our Data Protection Officer. You also have the right to ask us to escalate your complaint to our Group Data Protection Officer if you don’t think it’s been handled appropriately. 

If you’re not satisfied with our response, you can also raise a complaint with the Information Commissioner’s Office, the UK’s independent authority set up to enforce the Data Protection Regulations.

You can contact them at:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk/global/contact-us/
Phone: 0303 123 1113

Security

We’re committed to making sure your information is protected and held securely in accordance with our obligations under data protection law. However, the internet isn’t a secure medium and we can’t accept responsibility for the security of an email during transmission or for non-delivery of an email.

There are a few simple steps you can take to protect your computer and internet connection – view our tips here.

We’ve put security policies, rules and technical measures in place to protect the personal information that we have under our control from:

• unauthorised access;
• improper use or disclosure;
• unauthorised modification, and
• unlawful destruction or accidental loss.

All our employees and service providers who have access to personal information, are obliged to protect it and keep it confidential.

Links

This website may contain links to other websites. If you use the links to leave this website and visit a website operated by a third party, then we don’t have any control over that website. We can’t be held responsible for the protection and privacy of any information that you provide while visiting such websites.

Updates to this notice

We update our Privacy notice regularly to make sure it continues to reflect our business activities and use of personal information. You can find the date this was last updated at the beginning of this notice.

Last updated January 2024