Privacy Notice - Health & Benefits and Pensions Brokerage

Last Updated: April 2018

PRIVACY NOTICE

This privacy notice describes how Willis Towers Watson collects and processes Personal Information when we provide Health & Benefits transactional and advisory services ("Services") to our clients.

Willis Towers Watson operates worldwide through subsidiary and affiliate companies (collectively, “Willis Towers Watson,” “we,” “us,” or “our”).

In providing the Services, we may be required to process Personal Information of individuals that are employees of our clients or their family members, or that otherwise have an interest under or in relation to any insurance policy or benefits programme which we manage for our clients as part of the Services. This privacy notice applies to any individual whose Personal Information we process in the course of providing the Services (each a "data subject" or "you").

1. SCOPE OF THIS PRIVACY NOTICE

This privacy notice describes how Willis Towers Watson collects and processes Personal Information in the course of providing the Services, and it applies to all Personal Information we collect or process about you.

2. PERSONAL INFORMATION WE COLLECT

“Personal Information” is information that identifies you as an individual or relates to an identifiable individual.

We may collect your Personal Information in the following ways:

• Our client may provide your Personal Information to us. Our client, your employer, is also a controller in respect of your Personal Information and you may wish to consult with them in the first instance if you have any questions about the processing of Personal Information.
• You may provide your Personal Information directly to us if you are making or involved in a claim that we are handling for a client.
• You may provide your Personal Information directly to us if you submit underwriting information (such as forms or questionnaires) or information required during the insurance period (such as the appointment of beneficiaries in case of death).
• The insurer may provide your Personal Information to us, when sending claims payment information and claims reports to us.

The Personal Information we may collect about you may include:

• name and contact information;
• demographic information (such as gender, age, date of birth, marital status, nationality, employment details, family composition, and dependents);
• personal identification documentation and related information such as passport numbers and employee identification numbers;
• financial and payment data such as bank account numbers and transaction information;
• information related to the provision of the Services, such as policy information, claims information, benefits selections and payment records;
• salary data;
• statements made by or about you;
• records of communications; and
• human resources data, such as job title; benefits and compensation information; dependent/beneficiary information; union memberships.

Depending on the Services we are providing, all or some of the above categories of Personal Information may be provided to, or made available to us, by our clients.

Some of the categories of information that we collect are special categories of Personal Information ("Sensitive Personal Information"). These include your health records (such as your medical history and reports on medical diagnoses, injuries and treatment); information about your personal characteristics and circumstances of a sensitive nature such as your mental and physical health and genetic information.

3. LEGAL BASES FOR PROCESSING PERSONAL INFORMATION

We must have a legal basis to process your Personal Information. In most cases the legal basis will be one of the following:

• for our legitimate interests, for example to provide Services to our clients, to ensure that the Services we provide are appropriate to our clients' requirements, to improve our Services, manage our risks, maintain accurate transaction records, and manage our business in an efficient way;
• for the legitimate interests of our clients and other third parties (for example, to investigate and assess claims made against policies held or underwritten by them and to prevent and detect suspicions of fraud); or
• to comply with our legal obligations such as due diligence and reporting

We process Sensitive Personal Information on the following legal bases:

• your consent. The client may obtain your explicit consent to collect and use the data for the purposes described in this Policy Notice. You may withdraw your consent at any time by contacting us using the details at the end of this privacy notice;
• to establish, exercise or defend legal claims; or
• where legislation otherwise permits us to process Sensitive Personal Information (for example, where the processing is necessary for insurance purposes).

4. HOW WE MAY USE YOUR PERSONAL INFORMATION

We may use your Personal Data:

• to provide the Services and fulfill our contractual obligations to clients;
• to conduct data analysis;
• for fraud monitoring and prevention;
• to help develop new services and to enhance, improve or modify our Services;
• to operate and expand our business activities;
• to carry out background checks and conduct due diligence;
• to perform administrative activities in connection with our Services;
• to exercise, defend or protect our legal rights or the rights of our clients or third parties; and
• to comply with legal and professional obligations and to cooperate with regulatory bodies.

We may also aggregate or anonymise information about you. Aggregated or anonymised data is not capable of being used to identify individuals and is not treated as Personal Data under this Data Protection Notice.

5. DISCLOSURE OF YOUR PERSONAL INFORMATION

We may share your Personal Information with third parties under the following circumstances:

• to any Willis Towers Watson group company for the uses and purposes set out above;
• to our clients, intermediaries, advisers and business partners (such as insurance companies, tax and legal advisers) for the purposes of fulfilling our contractual obligations to clients, for example to deliver our Services and to arrange insurance products for clients;
• to service providers such as entities providing customer service, email delivery, auditing, hosting our website and other services;
• to any court, regulator, law enforcement agency, government body or professional body if we are obliged to do so under applicable law or regulation, which may include applicable laws or regulations outside your country of residence; and

When we share Personal Information with third parties, we take all reasonable steps to ensure that appropriate security measures and confidentiality undertakings are in place to protect the information shared.

6. SECURITY AND RETENTION

Willis Towers Watson maintains appropriate technical and organizational security measures to protect the security of your data against loss, misuse, unauthorized access, disclosure or alteration. These measures are aimed at ensuring the ongoing integrity and confidentiality of Personal Information. We evaluate these measures on a regular basis to ensure the security of the processing.

We will retain your Personal Information for as long as is necessary for the provision of Services to our clients. When we no longer need your personal information in connection with the Services, we will then retain your Personal Information for a period of time that reasonably allows us to:

• Maintain business records for analysis and/or audit purposes;
• Comply with record retention requirements under applicable law or regulation;
• Comply with any legal or other regulatory obligations;
• Defend or bring any existing or potential legal claims; and
• Deal with any complaints regarding our

We will delete your Personal Information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

7. CROSS-BORDER TRANSFER

Because we operate as a global business, your Personal Information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for Personal Information under European Union law.

When we transfer such Personal Information outside the European Economic Area, we put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details provided under the ‘Contact & Comments’ section below.

8. CHOICES AND ACCESS

Willis Towers Watson and the client are each controllers responsible for the Personal Information we collect and process.

If you would like to review, correct, update, suppress, object to, or restrict the processing of your Personal Information or request a copy of Personal Information about you, you may contact us by sending us an email at dataaccessrequest@wtwco.com or sending your request by postal mail to the address provided in the “Contact & Comments” section below.

In your request, please make clear what Personal Information you would like to have changed, whether you would like to have your Personal Information removed from our database or otherwise let us know what limitations you would like to put on our use of your Personal Information. For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the Supervisory Authority at dataprotection (in Romania).

9. CHANGES TO OUR PRIVACY NOTICE

You may request a copy of this privacy notice from us using the contact details set out below.

We may modify or update this privacy notice from time to time by notifying or providing a revised version to our clients. Where changes to this privacy notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will ask that our clients give you sufficient advance notice of these changes so that you have the opportunity to exercise your rights (e.g. to object to the processing).

10. CONTACT & COMMENTS

If you have any questions or comments regarding this privacy notice, your personal data and the manner in which we use and process such data, or for the purposes of exercising your statutory rights, please contact us on +40 21 231 91 69, by electronic mail at wtw-ro.secretariat@wtwco.com or dataaccessrequest@wtwco.com, or by postal mail at 15 - 17 Ion Mihalache Str, 1st floor, District 1, Code 011171, Bucharest.