Updated December 2019

THIS PRIVACY NOTICE DESCRIBES HOW United Family Association, ITS AFFILIATES ('WE', 'US') MAY COLLECT, HANDLE AND PROCESS PERSONAL INFORMATION IN RELATION TO YOUR ACCESS TO OR USE OF THE SERVICES.

This privacy notice applies to all of the services, websites and apps offered by United Family Association (collectively, the "Services"), but excludes Services which have separate privacy notices that do not incorporate this privacy notice.

United Family Association company which provides each Service is primarily responsible for the personal information collected and held in relation to that Service. A description of United Family Association Services available and contact details for us is available here: www.unitedfamilyassociation.com/contact.php

1. PERSONAL INFORMATION WE USE

We may collect personal information about you from a variety of sources, including information we collect from you directly (e.g., when you contact us) and from other sources, described below.

Note that we may be required by law to collect certain personal information about you, or as a consequence of any contractual relationship we may have with you. Failure to provide this information may prevent or delay the fulfillment of these obligations. We will inform you at the time your information is collected if the provision of certain personal information is compulsory and the consequences of the failure to provide such personal information.

1.1. Information we collect directly from you

Depending on the service, website or app that you are using, the categories of information that we may collect directly from you include:

• personal details (e.g., name, date of birth);
• contact details (e.g., phone number, email address, postal address or mobile number);
• government issued identification details (e.g., social security and national insurance numbers, passport details);
• health and medical details (e.g., health certificates);
• policy details (e.g., policy numbers and types);
• bank details (e.g., payment details, account numbers and sort codes);
• driving license details;
• online log-in information (e.g., username, password, answers to security questions);
• information relating to any claims;
• other information we receive from you on applications or required questionnaires (e.g., occupation, current employer); and
• information we collect automatically from you (e.g., click stream data, personal information and other data collected using cookies and other device identifying technologies ('Cookies')). Further information about our use of Cookies is available at Annex A below.

We do collect personal information about your online activities over time and across third party websites or online services. When we see a browser set to "do not track", signals transmitted from web browsers do not apply to our sites, and we do not alter any of our data collection and use practices upon receipt of such a signal.

1.2. Information we collect from other sources:

The categories of information that we may collect about you from other sources are:

• personal details (e.g., name, date of birth);
• contact details (e.g., phone number, email address, postal address or mobile number);
• bank details (e.g., account numbers and sort codes);
• financial information from consumer-reporting agencies for the purpose of ascertaining credit history; and
• policy details (e.g., policy numbers and types).

We may receive such information via other insurers, consumer-reporting agencies, our affiliated companies, or other third parties in the course of conducting our business.

1.3. Sensitive personal information

We may also collect certain information about you which is considered more sensitive under local applicable laws, such as:

• information about your race, ethnic origin, religious views and philosophical beliefs, membership of professional or trade associations, gender identity or sexual orientation for diversity and statutory monitoring purposes where appropriate; and
• health, biometric or disability information required to administer policies or process claims.

1.4. COPPA

We do not knowingly collect online information from children under the age of 13. Our services are marketed towards adults. If we are notified that we have collected personal information, as defined by the Children’s Online Privacy Protection Act ("COPPA"), of a child under the age of 13, we will delete the information as expeditiously as possible.

2. HOW WE USE YOUR PERSONAL INFORMATION AND THE BASIS ON WHICH WE USE IT

We may use your personal information to:

• provide, maintain, protect and personalize our services including our insurance products, consulting and broking services;
• deal with your enquiries and requests;
• perform system administration and to report aggregate statistical information to our advertisers;
• cooperate with regulators and law enforcement bodies;
• contact you with marketing and offers relating to products and services offered by us (unless you have opted out of marketing, or we are otherwise prevented by law from doing so);
• personalize the marketing messages we send you to make them more relevant and interesting and to customize and enhance your website or app experience;
• resolve complaints, as well as handle requests for data access or correction;
• protect your, our or others' rights and interests; and
• communicate with you regarding your account or changes to our policies, terms and conditions.

Some jurisdictions require a legal basis to use or process your personal information. In most cases the legal basis will be one of the following:

• to fulfill our contractual obligations to you in connection with your policy or contract with us, for example using your contact details to reply to your requests. Failure to provide this information may prevent or delay the fulfillment of these contractual obligations;
• in order to comply with our legal obligations, for example to keep records of the services we provide you with as required by applicable law or regulation, or to comply with any governmental, quasi-governmental or court orders or subpoenas;
• where there is a public interest in the processing, for example where it is necessary in order to prevent and detect fraud; and
• to meet our or a third party's legitimate interests, for example to understand how you use our services and to enable us to derive knowledge from that to develop new services, to protect our rights or the rights of third parties, or to resolve any disputes. When we process personal information to meet our legitimate interests, we put in place robust safeguards to help ensure that your privacy is protected and that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

We may also obtain your consent to collect and use certain types of personal information, including when we are required to do so by law (for example, in certain jurisdictions where consent is always required to collect personal information, or in relation to our direct marketing activities or use of Cookies and Tracking Technologies, or when we process sensitive personal information about you). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this privacy notice.

3. YOUR RIGHTS OVER YOUR PERSONAL INFORMATION

You may have certain rights regarding your personal information, subject to local law. These include rights in certain circumstances to:

• access your personal information;
• request proof of the authorization or previous consent given to us to perform the collection and processing of the personal information;
• rectify the information we hold about you;
• erase your personal information;
• restrict our use or disclosure of your personal information;
• object to our use or disclosure of your personal information;
• request information about the use and processing of your personal information by [United Family Association Group];
• receive your personal information in a usable electronic format and transmit it to a third party (right to data portability);
• revoke the consent given by you for the processing of your personal information; or
• lodge a complaint with your local data protection authority.

If you would like to discuss or exercise such rights, as applicable under local law, please contact us at the details below.

We encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate. We will contact you if we need additional information from you in order to honor your requests.

4. AUTOMATED DECISIONS ABOUT YOU

We may automatically process your personal information to make decisions or conduct 'profiling' about you. This may involve using software that is able to evaluate your personal aspects and predict risks or outcomes. We may carry out this automatic processing for general business purposes including, for example, advertising, risk assessment or fraud prevention. The processing may involve decisions about you that relate to products that we sponsor or your eligibility to use the Services. The significance of our actions in this connection is that it may have legal or similar effects for you, namely, availability of access to services. The logic involved may be related to our cookies policy, or it may be related to specific underwriting software, for example.

We will only make these kinds of automated decisions about you where:

• such decisions are necessary for entering into a contract. For example, we may decide not to offer Services to you, or we may decide on the types or amount of Services that are suitable for you, or how much to charge you for our Services based on your credit history and other financial or related information we have collected about you;
• such decisions are required or authorized by law, for example for fraud prevention purposes; or
• you give your consent to us carrying out automated decision-making.

Subject to local legal requirements and limitations, you can contact us to request further information about automated decision-making, object to our use of automated decision-making, or request an automated decision to be reviewed by a human being.

We also may make automated decisions about you based on your personal information in the circumstances such as: to select personalized offers, discounts or recommendations to send you based on your shopping history or browsing history, subject to any applicable laws or regulations.

These types of decisions will not have legal or similar effects for you, but you can still contact us for further information.

5. INFORMATION SHARING

We may share your personal information with third parties for the purposes described in this privacy notice under the following circumstances:

• Service providers and business partners. We may share your personal information with our service providers and business partners that perform marketing services and other business operations for us. For example, we may partner with other companies to process secure payments, fulfill orders, optimize our services, send newsletters and marketing emails, support email and messaging services and analyze information.
• Our group companies. We work closely with other businesses and companies that fall under United Family Association, its affiliates and subsidiaries. We may share your personal information with other United Family Association companies for marketing purposes (subject to applicable laws or regulations), internal reporting and other purposes as described in this privacy notice. Click to view a general description of United Family Association
• Law enforcement agency, court, regulator, government or quasi-governmental authority or other third party. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, to enforce or apply any agreements between us and you, to resolve any disputes, or otherwise to protect our rights or the rights of any third party.
• Asset purchasers. We will not sell your personal information to third parties other than to the extent reasonably necessary to proceed with the consideration, negotiation, or completion of a merger, reorganization, or acquisition of our business, or a sale, liquidation, or transfer of some or all of our assets. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this privacy notice.
• Online ad technology firms. We may transfer information about you to ad technology firms so that they may recognize your devices and deliver interest-based content and advertisements to you. The information may include your name, postal address, email, device ID, or other identifier in encrypted form These firms may collect additional information from you, such as your IP address and information about your browser or operating system; may combine information about you with information from other companies in data sharing cooperatives in which we participate; and may place or recognize their own unique cookie on your browser.

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the Services). See the section on "International Data Transfer" below for more information.

When required by applicable law, when we share personal information with corporate third parties we will ensure that such third parties maintain a comparable level of protection of the personal information as set out in this privacy notice by using contractual or other means. To the fullest extent permitted by applicable law, we exclude all liability arising from the use of your personal information by third parties. When required by applicable law, data transfers will be logged and documented, identifying the recipient of the data, the purpose of the transmission, and the type of data that was transmitted. Where required by law to do so, we can on request confirm the name of each third party that personal information is, or will be, transferred to.

6. INFORMATION SECURITY AND STORAGE

We implement technical, organizational, administrative and physical measures to help ensure a level of security appropriate to the risk to the personal information we collect, use, disclose and process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to help ensure the security of the processing. Please be aware that, despite our ongoing efforts, no security measures are perfect or impenetrable.

We restrict access to your personal information to those who require access to such information for legitimate, relevant business purposes.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

• maintain business records for analysis and/or audit purposes;
• comply with record retention requirements under the law;
• defend or bring any existing or potential legal claims; and
• deal with any complaints regarding the Services.

We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the personal information.

6.1. Secure communications

Live chat sessions on our site are encrypted to encode information that you share with our operators. By contrast, be aware that e-mail messages sent in clear text over the public internet can be observed by an unintended third party. Non-encrypted Internet e-mail communications may be accessed and viewed by other internet users without your knowledge and permission while in transit to us. If you wish to keep your information private, please do not use electronic mail to communicate information to us or request information from us that you consider to be confidential and/or proprietary. If you wish, you may contact us instead via telephone at the phone number provided: www.unitedfamilyassociation.com/contact.php

6.2. Third-party vendors

For certain services on our website, such as live chat or webcasts, we will ask for information about you such as your name, business, and e-mail address. In cases where we use a third-party vendor to provide online services, the vendor has agreed to keep your information confidential. For example, transcripts of live chat sessions may be archived in a database by our vendor for review by our operators.

7. LINKS TO OTHER SITES

We may provide links to other websites not owned or controlled by us that we think might be useful or of interest to you. We are not, however, responsible for the privacy practices used by other website owners or the content or accuracy contained on those other websites. Links to other websites do not constitute or imply endorsement by us of those web sites, any products or services described on those websites or any other material contained in them. We advise that you contact any third party websites directly for their individual privacy policies.

8. INTERNATIONAL DATA TRANSFER

We may transfer certain personal information across geographical borders to our subsidiaries or service providers (working in conjunction with us or on our behalf) worldwide. Such transfers are made in accordance with applicable law.

Where you are based in the European Union you should be aware that your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information under European Union law.

Where you are based outside of the European Union, you should be aware that your personal information may be transferred to, stored, and processed in a jurisdiction that is not your home jurisdiction. You consent to the transfer, disclosure, storage and/or processing of your personal information outside the jurisdiction in which the information was originally collected.

We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your personal information is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

9. CALIFORNIA PRIVACY RIGHTS

The provisions below up to Section 10 (Contact Us) relate solely to residents of the State of California (for purposes of this Section 9 (California Privacy Rights), “consumers” or “you”). We included this section to comply with the California Consumer Privacy Act of 2018 (CCPA) and any terms defined in the CCPA have the same meaning when used in this section.

9.1. Applicability of the CCPA

9.1.1. United Family Association as a service provider

Our group of companies is in the business of assisting individuals and companies with insurance related solutions through insurance placement, risk management, and consulting services. In our role as an insurance broker or agent, we act as a service provider on behalf of our clients and insurance carriers. To this end, if not stated otherwise in this section or in a separate disclosure, we process your CCPA Covered Personal Information in the role of a service provider (as defined by the CCPA) on behalf of a customer (and/or its affiliates) or an insurance carrier who is the responsible business (as defined by the CCPA) for your CCPA Covered Personal Information. When acting as a service provider, we will only collect, use, and otherwise process your CCPA Covered Personal Information as directed by our customers and as otherwise permitted by the CCPA and applicable law. If your data has been submitted to us by you, and you wish to exercise your consumer rights under the CCPA, please direct your request to the insurance carrier (business) who placed insurance coverage for you. If your data has been submitted to us on behalf of a commercial customer and you wish to exercise any CCPA consumer rights you may have under applicable data protection laws because you are or were employed by that commercial customer, please direct your requests to exercise any rights to the applicable commercial customer directly. If you submit your request directly to us, consistent with the CCPA, we will inform you that you should submit the request directly to the commercial customer or insurance carrier on whose behalf we process the information; where feasible, we will provide you with contact information for that business.

We are not responsible for, and have no control over, the privacy and data security practices of our customers, which may differ from those set forth in this Privacy Policy. For detailed privacy information related to our collection and use of your data on behalf of a customer who uses our products and services, please contact the respective customer directly.

9.1.2. United Family Association as a business

In some limited circumstances and in some of our corporate functions, we may act as a CCPA business, rather than as a CCPA service provider. Where we act as a business, we will fulfill your verifiable consumer request as described below.

9.1.3. CCPA exemptions

This Section 9 (California Privacy Rights) does not apply to:

• Publicly available information from government records.
• De-identified or aggregated consumer information.

For purposes of this section, personal information does not include:

• Until January 1, 2021, information regarding job applicants, employees, owners, directors, officers, or contractors, emergency contact information from the same, and information necessary for us to administer benefits to the same.
• Until January 1, 2021, information we obtain from a consumer acting on behalf of a company and whose communications with us occur solely within the context of us conducting due diligence regarding, or providing or receiving a product or service to or from another company.
• Information or organizations excluded from the CCPA’s scope, including medical information governed by the California Confidentiality of Medical Information Act (CMIA), protected health information collected by a covered entity or business associate governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), or personal information collected, processed, sold, or disclosed pursuant to certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994 (DPPA).
• Publicly available information from government records.
• De-identified or aggregated consumer information.

Under the limited circumstances where we are acting as a business, and your personal information is not otherwise excluded as set forth above, the following information applies to how we collect, use, and share your personal information.

9.2. Information we collect when we are acting as a business

As a business, we collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or device (“CCPA Covered Personal Information”). In particular, we have collected the following categories of CCPA Covered Personal Information from consumers within the last twelve (12) months:

• For all of the above categories collected, we collect this information directly from you, as described in Section 1.1. (Information we collect directly from you).
• For all of the above categories collected, we collect this information from third parties, as described in Section 1.2. (Information we collect from other sources).
• For Categories A (identifiers) and F (internet or other similar network activity information), we collect this information indirectly from you, as described in Annex A – Cookies Policy.

• We use all of the above categories of CCPA Covered Personal Information collected to:
  • Fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question, we will use that CCPA Covered Personal Information to respond to your inquiry.
  • Provide, support, personalize, and develop our Website, products, and services.
  • Create, maintain, customize, and secure your account with us.
  • Provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
  • Personalize your Website experience and to deliver content and product and service offerings relevant to your interests for United Family Association’s affiliates and subsidiaries, including targeted offers and ads through our Website, third-party sites, and via email or text message (with your consent, where required by law). We may share your CCPA Covered Personal Information with other United Family Association companies for marketing purposes (subject to applicable laws or regulations), internal reporting and other purposes as described in this privacy notice. Click to view a general description of United Family Association
  • Help maintain the safety, security, quality, and integrity of our Website, products and services, databases and other technology assets, and business, including to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity, and to debug to identify and repair errors that impair existing intended functionality.
  • Respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
  • Evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which CCPA Covered Personal Information held by us about our website or application users is among the assets transferred.

• We use Categories A (identifiers), B (categories listed in the California Customer Records statute), and D (commercial information) information collected to process your requests, purchases, transactions, and payments and prevent transactional fraud.
• We use Categories A (identifiers) and F (internet or similar network activity) information for:
  • Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with applicable law.
  • Short-term, transient use to provide contextual customization of ads shown as part of your interaction with our Website.
  • Partnering with third party advertising networks and exchanges to serve our advertising on other sites.
  • Testing, research, analysis, and product development and demonstration, including to develop and improve our Website, products, and services.

• For all of the above categories of CCPA Covered Personal Information collected, as described to you when collecting your CCPA Covered Personal Information or as otherwise set forth in the CCPA.

• The categories of CCPA Covered Personal Information we collected about you.
• The categories of sources for the CCPA Covered Personal Information we collected about you.
• Our business or commercial purpose for collecting that CCPA Covered Personal Information.
• The categories of third parties with whom we share that CCPA Covered Personal Information.
• The specific pieces of CCPA Covered Personal Information we collected about you (also called a data portability request). Note that the law prohibits us from disclosing at any time a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answers.

• Complete the transaction for which we collected the CCPA Covered Personal Information and take actions reasonably anticipated within the context of our ongoing business relationship with you or our client.
• Detect bugs or errors in our Website or service, detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information as permitted by law or that are compatible with the context in which we collected it.

• Emailing us at help@unitedfamilyassociation.com
• Completing the CCPA request webform here Delete My Data; or
• Calling us at 1-833-668-0038

• Requests for access to categories of personal information. Where you or your Authorized Agent submit a request for disclosure of categories of personal information we as a business have collected about you, we will verify your request to a “reasonable degree of certainty.” This may include matching at least two data points that you would need to provide with data points we maintain about you and that we have determined to be reliable for the purposes of verification.
• Requests for specific pieces of personal information (portability request). Where you or your Authorized Agent submit a request for disclosure of specific pieces of personal information we as a business have collected about you, we will verify your request to a “reasonably high degree of certainty.” This may include matching at least three data points that you would need to provide with the data points we maintain about you and that we have determined to be reliable for the purposes of verification. We will also require you to submit a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
• Requests to delete. Where you or your Authorized Agent submit a request for deletion of your personal information we as a business have collected about you, we will verify your request to a “reasonable degree” or a “reasonably high degree of certainty” depending on the sensitivity of the personal information and the risk of harm to the consumer posed by unauthorized deletion.

• estimate our audience size and usage pattern;
• store information about your preferences, and so allow us to customize our site according to your individual interests;
• speed up your searches; and
• recognize you when you return to our site.

• Google Analytics (“GA”) and Google Tag Manager: We use GA to better understand how customers are using our Sites and to assist in managing the performance and design. Google stores the information collected via the cookies. For more information about GA, please see Google’s Privacy Policy and Help Pages.
• Sitecore: We use content management systems to manage the website content and use cookies and tags to improve the website experience and provide customization and personalization capabilities. For more information about Sitecore see Sitecore’s Privacy Policy and Help Pages.
• Watson Campaign Automation: We use a marketing automation platform to assist with our marketing, and anonymous cross-site tracking. For more information about Watson Campaign Automation see IBM’s Privacy Policy and Help Pages.
• Lotame: We use a Data Management Platform to assist with marketing and targeted advertising. For more information about Lotame see Lotame’s Privacy Policy and Help Pages.
• You may refuse to accept cookies by activating the setting on your browser which may allow you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of our site. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site unless otherwise prohibited by applicable law.
• We do not use cookies to track or report on activity when you are not on our website or to provide such information to other parties for their own marketing use. We do not use cookies to collect personal information such as your e-mail address, and we do not combine information collected through cookies with your personal information. We make no attempt to look at or examine other cookies or information that may be stored on your computer.