Privacy Notice

At Old Mutual we are committed to protecting your privacy and to ensure that your personal information is collected and used properly, lawfully and transparently.

This Notice explains how we obtain, use and disclose your personal information and aims to inform you of your rights and how to exercise them.

This Notice sets out:

• What is the purpose of this policy?
• Who does the policy apply to?
• What risks are managed by this policy?
• What risk appetite statements apply to this policy?
• What are the minimum mandatory requirements of this policy?
• Changes to Privacy Policy
• How to reach us
• Supervisory Authority Details

1. What is the purpose of this policy?

Welcome to the Old Mutual Insurance Rwanda Data Privacy Policy. The Old Mutual Insurance Rwanda respects your privacy and is committed to protecting your personal data. This Privacy Policy will inform you as to how the Old Mutual Insurance Rwanda Plc collects, uses, discloses, transfers and stores your personal data when you interact with us and tells you about your privacy rights and how the law protects you. Since we want to empower you to make the best decisions about your privacy and personal data, we have made this Privacy Policy as clear and transparent as possible to let you know how the law protects you. It is therefore important that you read this Privacy Policy and understand what we intend to do with your personal data.

2. Who does the policy apply to?

The Old Mutual Insurance Rwanda comprises is among Old Mutual Group and provide various products or services related to General Insurance. This Privacy Policy is applicable to Old Mutual insurance Rwanda Plc and responsible for processing your personal data when you purchase a product or service from us, or otherwise interact with us.

3. What risks are managed by this policy?

Regulatory Compliance risk is defined as the risk of breaching laws, regulations or regulatory directives, resulting in possible fines, regulatory sanctions, reputational damage and/or financial loss. For the purposes of this Policy the following definitions are used:

• Privacy Risk: The risk of a Data Breach or the use of Personal Information in an inappropriate manner, contrary to applicable legal and/or regulatory obligations.
• Data Breach: The loss or theft of Personal Information or unauthorised access to Personal Information.
• Employee: The term includes direct employees, agents, other permanent staff such as fixed term or independent contractors, as well as any temporary staff including temporary contractors or service providers that are in service of the Old Mutual Group.
• Notice: A declaration or notification by a legal entity of the Old Mutual Group setting out the role of the entity, what will be done with the Personal Information and with whom it will be shared.
• Personal Information: Personal data or information related to an identifiable living individual.

4. What risk appetite statements apply to this policy?

We have Low preference for any information security breach in which significant amounts of confidential data affecting our clients, and/or proprietary information has been compromised that can result in regulatory notification, reputational damage, customer impact or financial impact, reporting impact or legal impact.

We have a Low or limited appetite for Regulatory Compliance risks. We are committed to complying with regulatory requirements in both the spirit and the letter of the law. We acknowledge that noncompliance may occur from time to time, but have Zero appetite for deliberate non-compliance.

Where Regulatory Compliance risks arise we will take appropriate steps to mitigate these.

5. What are the minimum mandatory requirements of this policy?

The Group has put in place the following policies and processes to ensure that the personal information and sensitive personal information is collected, stored and used in line with the requirements of the applicable data protection laws:

5.1 Collection

Personal data means any information relating to an identified or identifiable natural person. The personal data that we collect will depend on the context of our relationship with you. We may collect, use, store and transfer different kinds of personal data about you or persons connected to you which we have grouped together as follows:

• Identification information such as name, date and place of birth, national identity card number, passport number, Rwanda Revenue Authority Taxpayer identification number (TIN), photo, marital status, title, nationality, gender, and specimen signature.
• Contact information such as email address, postal address, physical address, residential address and telephone number.
• Financial information such as bank account details, payment card details, mobile money statements, income, credit history, credit worthiness, bank statements, details about payments to or from you and other details of products and services you have purchased from us.
• Information relevant to your insurance policy or relevant to your claim or your involvement in the matter giving rise to a claim.
• Information about the nature of your business and commercial assets.
• Employment information such as the name of the employer, position in the organization and office address.
• Children’s personal data such as the name, date of birth and gender.
• Sensitive personal information such as marital status, property details, health status and family details (such as next of kin and beneficiaries).
• Marketing and communications information including your preferences in receiving marketing information from us and communication from us.
• Online data whenever you use our products and services through our website, mobile applications such as cookies, login data, IP address (your computer’s internet address), browser type and version, ISP or operating system, domain name, access time, page views, location data, how you frequently use our online insurance, banking and other services, our mobile applications or visit our website.
• Profile data such as your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.

If we need information about other people connected to you, we may request you to provide the information in relation to those people. If you are providing information about another person, we expect you to ensure that they know you are doing so and are content with their information being provided to us. It might be helpful to show them this Privacy Policy and if they have any concerns, please contact us on the same.

The list below shows you the various ways we may collect your personal information (please note that this list is not exhaustive):

We may collect personal data directly from you

In most instances, we collect personal data directly from you when you fill in forms or communicate with us through our contact details. This includes personal data you provide when you:

• Apply for our products or services;
• Make enquiries;
• Create an account on our website;
• Register for our products offered through mobile and online platforms;
• Request marketing information to be sent to you;
• Give us feedback or contact us;
• Provide goods or services to us as a supplier or contractor; or
• Interact with our website. We collect this personal data by using cookies and similar technologies.

We may collect your personal data from a number of third parties or publicly available sources

In some instances, we will receive your personal data from various third parties or publicly available sources including:

• Identity and contact data from the Government of Rwanda’s e-citizen and Integrated Population Registration Services platforms;
• Identity and contact data from publicly available sources such as the Companies Registry and the Business Registration Service
• Contact, financial and transaction data from land registries, industry databases such as credit reference agencies, fraud prevention agencies and providers of technical, payment and delivery services;
• Medical professionals and hospitals;
• Social media. If you are a potential candidate for employment with Old Mutual Insurance Rwanda, we may have received your personal data from third parties such as recruiters or external websites.
• Directly from an individual or employer (or your employer’s service provider) who has a policy with us under which you are insured.
• Directly from an employer which funds a cover that we administer where you are a beneficiary.
• Directly from a person who is making a claim or application and they include information about you which is related to their claim or application.
• From your family members when they make enquiries about purchasing a product for you or including you on their insurance, when you ask them to make a claim on your behalf, or where you may be incapacitated or otherwise unable to provide information yourself when we need it;
• Your insurance broker if you have one.
• Third parties who assist us in checking that claims are eligible for payment.

Personal data relating to a child

Where we collect personal data relating to a child, we will only process it on the basis of consent provided by the child’s parent or guardian, or as otherwise permitted by relevant law and regulation.

Personal data relating to health

Processing of any personal data relating to your health shall only be done by or under the responsibility of a health care provider or by a person bound by the obligation of professional secrecy under any law.

5.2 Choice and consent

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with an insurance policy or to provide you with banking services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case within reasonable time.

Where we rely on consent as a legal basis for processing your personal data, you have the right to withdraw your consent to our processing of your personal data at any time but please note, that your withdrawal will not affect the lawfulness of our processing which was based on prior consent before your withdrawal or which is based on other legal basis for processing your personal data. Please however note that in some instances, we will not be able to provide our products and services if you withdraw your consent.

5.3 Use of personal data

We will only use your personal data when the law allows us. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• To assess whether you are eligible for our products and services.
• Where you consent to our use of your personal data.
• Where we need to comply with or fulfil legal or regulatory obligations and protecting ourselves and our clients against fraud.
• Where we need to protect your vital interests and the vital interests of third parties (for example when paying out sums to beneficiaries under your policies).
• Where it is necessary for our legitimate interests (or those of a third party) such as maintaining our records, developing, assessing and improving our products and services, risk evaluation, underwriting, managing arrangements with reinsurers, managing claims, improving our customer administration and engagement as well as complying with our Know Your Customers (KYC) requirements.
• To establish, exercise or defend our legal rights such as when we are faced with any legal claim or where we want to pursue any legal claims.
• To advertise and market to you our latest products and services (please note that if you do not want to receive our marketing information you may opt-out or withdraw your consent anytime by contacting us).
• To send you important notices such as changes to our terms, conditions and policies or unusual activity with respect to any of your accounts with us.
• If you apply for an employment position at Old Mutual Insuranc or we note that you are a potential candidate for employment, we may use your personal data in evaluating your candidacy and to contact you about the employment opportunity.
• Where we receive your personal data from third parties, we may use it to validate the information you have provided to us or for fraud prevention purposes.
• To enable you use the services available through our website and mobile and online applications including registering you for our services and verifying your identity and authority to use our services.
• To address fraud or safety concerns, or to investigate complaints or suspected fraud or illegality.
• To monitor and analyse the use of our products and services for system administration, operation, testing and support purposes.
• To cooperate with, respond to requests from, and to report transactions and/or other activity to, government, tax or regulatory bodies, financial markets, brokers or other intermediaries or counterparties, courts or other third parties.
• To conduct compliance activities such as audit and reporting, assessing and managing risk, maintenance of accounting and tax records, fraud and anti-money laundering (AML) prevention and measures relating to sanctions and anti-terrorism laws and regulations and fighting crime. This includes know your customer (KYC) screening (which involves identity checks and verifying address and contact details), politically exposed persons screening (which involves screening client records against internal and external databases to establish connections to ‘politically exposed persons’ (PEPs) as part of client due diligence and onboarding) and sanctions screening (which involves the screening of clients and their representatives against published sanctions lists).
• To record and/or monitor telephone conversations so as to maintain service quality and security, for staff training and fraud monitoring and to deal with complaints, disputes and potential and/or actual criminal activity. To the extent permitted by law, these recordings are our sole property.

5.4 Retention and disposal

We will only retain your personal data for as long as may be reasonably necessary to fulfil the purpose we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting information.

• We may retain your personal data for a longer period if the retention is:
• Required or authorised by law.
• Required by a contract concluded between the parties.
• Reasonably necessary for a lawful purpose.
• Authorised or consented by you.
• Is necessary for purposes of responding to a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
• For carrying out research authorized by a relevant authority.

5.5 Access

It is important that the personal data we hold about you is accurate and the most recent. We encourage you to keep us informed in case of any changes of your personal data during your relationship with us. You have the right to establish what personal data we hold about you and to request access to it.

5.6 Third Party Disclosure

Subject to your rights and the applicable laws, we may share your personal data with the third parties set out below:

• Entities comprising the Old Mutual Group or their affiliates.
• Public authorities or governments when required by law, public interest, national security, regulation, legal process or enforceable governmental request.
• Our third-party service providers who help us manage our products and services including those service providers who maintain our IT and office systems and provide marketing and advertising services.
• To service providers that provide application processing, fraud monitoring, call center and/or other customer services, hosting services and other technology and business process outsourcing services.
• Persons or entities that you explicitly request us to transfer your personal data to them.
• Your relatives, guardians or persons acting on your behalf where you are incapacitated or for the purposes of paying out claims to your beneficiaries.
• Financial advisers, business partners and third party administrators who help us manage our products and services.
• Banks or financial institutions within the country and outside the country where you either transfer or receive payments from the said banks or financial institutions.
• Insurers, reinsurers and brokers who help us manage and underwrite our products and provide us with reinsurance and insurance services.
• Our professional advisers such as auditors, tax advisers, insurers, reinsurers, medical agencies, legal advisers who act on our or your behalf, or who represent another third party.
• Loss adjusters and claims experts who help us handle claims.
• Medical institutions and professionals where we may require accessing your health records and assessments for the purpose of arranging or facilitating your claim.
• Third parties connected with the sale, transfer or disposal of our business.
• To counterparty banks, payment infrastructure providers and other persons from whom we receive, or to whom we make, payments on our clients’ behalf.
• Debt collection agencies, credit reference agencies, fraud detection agencies and other agencies that we will contract to provide services to us.

5.7 Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

5.8 Cross Border Transfer of Personal Data

Where we will make a transfer of your personal data outside Rwanda, we will ensure that adequate steps are taken to protect your privacy rights and your personal data, including existence of appropriate safeguards for protection of personal data that is being transferred across country borders. Where your personal data is transferred to our affiliates located outside the country, we have entered into agreements governing transfers of personal data with our affiliates to ensure that your personal data receives an adequate and consistent level of protection.

We will only transfer your sensitive personal data outside Rwanda where we have obtained your consent and on confirmation of appropriate safeguards. Such safeguards may include placing the third party to whom the personal data is transferred under contractual commitments to protect the personal data as well as transferring the personal data to jurisdictions with commensurate levels of protection to ours.

5.9 Your Legal Rights

You have the right to:

• Be informed of the use to which your personal data is to be put as we have endeavoured to outline in this Privacy Policy;
• Request access to your personal data that we hold about you;
• Object to or restrict the processing of all or part of your personal data;
• Request correction of inaccurate, false or misleading data that we hold about you;
• Request deletion of data that we hold about you;
• Request transmission of your data to another person or entity, where technically feasible;
• Not to be subject to a decision based solely on automated processing which may produce legal consequences or significant consequences to you;
• Designate, in your will, an heir to your personal data; and
• Withdraw consent at any time (the withdrawal of consent shall not affect the lawfulness or processing based on prior consent before its withdrawal).

5.10 Automated Decision Making

• information on the automated decision making you carry out will including profiling information about the logic involved in the automated decision making,
• the significance and the envisaged consequences of such processing personal data for the data subject

5.11 Managing Cookies

Cookies are small files created on your computer when certain websites are loaded via your browser. They allow useful pieces of information to be provided to website owners, which enable you to use websites more efficiently and to save time (for example, by not having to input your details each time you visit the site).

We use cookies to collect standard information on website usage which includes information about how you logged on and from our website, including your IP address, information about your visit, your device information and how you use our website. This will include the capture of information on your approximate location.

By using our website, you agree that we can place cookies on your computer or other device. You may refuse the use of cookies on www.oldmutual.rw by selecting the appropriate settings in your browser, but you may lose some useful functionality. For more information about cookies, please visit the https://allaboutcookies.org/ website which gives details on how to delete cookies from your computer.

6. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We shall inform you when it was last updated at the beginning of the Privacy Policy so that you are aware when we make changes to it. We therefore encourage you to keep checking this Privacy Policy often to remain informed on how we protect your personal data.

7. How to reach us

We have appointed a data protection officer who is responsible for overseeing questions in relation to this Privacy Policy.

If you have any concerns about the use of your personal data, questions about this Privacy Policy including any requests to exercise your legal rights under the law, please contact us using the details set out below:

Email address: ominsurance@oldmutual.rw

Postal address: BP 6644 Kigali, Rwanda

Physical address: Grand Pension Plaza, 7th Floor

Telephone number: +250 788 168 000

We will respond to your questions or concerns within seven (7) days of receipt of the query.

8. Supervisory Authority Details

You have the right to make a complaint to the National Cyber Security Authority in relation to the handling of your personal data, or to appeal any decision regarding your personal data.

If you have any concerns on the management of your data and you need to contact the National Cyber Security Authority in relation to your legal rights, you can contact the regulator using the details below.

Email: info@ncsa.gov.rw

Phone: +250 791 445 224