Privacy Notice: Delegated Contract Manager Platform (DCM)
Effective date:

116 April 2021

Introduction

This notice describes how Lloyd’s, in its capacity as a data controller, collects, uses, shares andretains the personal data provided when using DCM and informs you about your choices regardinguse, access, rights and correction of your personal data. Lloyd’s is committed to ensuring that any
personal data it receives is protected and handled in accordance with applicable data protectionlaws.
For the purposes of this Privacy Notice, references to “we”, “us” or “our” shall refer to Lloyd’s.
About DCM: DCM is a centralised platform provided by Lloyd’s for market participants to register allbinding authority contracts in accordance with the Intermediaries Byelaw, as may be amended,
updated or replaced from time to time. DCM allows registered users to register and draft the binding
authority contracts and communicate and collaborate with stakeholders.
2Who we are

The Society of Lloyd’s, incorporated by Lloyd’s Acts 1871 by the name of Lloyd’s, whose principal
place of business is at One Lime Street, EC3M 7HA.
3What personal data we process about you
Personal data we process
about you
Contact details (name, phone
number, job title, business emailaddress) of:(a) Individual users of DCM;
and(b) Individuals named inbinding authorities (e.g.
those authorised tounderwrite insurance undera binding authority, orsignatories to such bindingauthorities).

Purposes why we process yourpersonal data
To allow Lloyd’s to run andmanage DCM for the benefit ofmarket participants and todischarge its regulatory andmarket supervisory functions. This
includes but is not limited to:(a) onboarding users and accountset-up for DCM;(b) ensuring Lloyd’s registers allbinding authorities andmaintains a central register ofall such binding authorities inaccordance with Lloyd’sregulations;(c) providing DCM to enable
market participants to have theability to communicate andcreate binding authorities andLawful basis forprocessing by Lloyd's
Lloyd's legitimate
interests for onboarding
users, monitoring DCM,
sending notifications andto de-identify personal
data for onward use foranalytics.
Compliance with Lloyd’slegal and regulatory
obligations in relation toregistration of binding
authorities andmaintaining a central
register for all suchbinding authorities.

1
Classification: Unclassifiedother ancillary market services,
including monitoring the use of
DCM, reporting and sending
notifications; and(d) de-identifying personal data inorder that the de-identified
data can be used for statisticalanalytics.

4

Who we are sharing your data with

We will share personal data with those of our third-party service providers who provide DCM,
however this is limited to the purposes we process your personal data set out above in paragraph 3.
We require all our service providers to respect the confidentiality and security of personal data.
Third party service
providerAccenture (UK) Limited

Accenture Solutions
Private Limited (India)
Pegasystems Ltd

Service Provided
Provision of DCM Platform, including
integration of Pegasystems and Adobe
technology.
Sub-processors of Accenture UK
LimitedDCM Platform

Microsoft

Host documents created on /uploaded
to DCM Platform

Adobe

Provision & hosting of Document
Generation and Signature software

Service Now UK
LimitedProvision and hosting of service
support portal (ticketing solution)

Relevant Locations /TransfersUKIndiaUK (primary and backup
datacentre).
Support provided from subprocessors located in multiple
locations globally, including
the US.
UK (primary and backup)
Support provided from subprocessors located in multiple
locations globally.
UK hosted except for one
component (PDF to Word)
which is US hosted.
Support provided from subprocessors located in multiple
locations globally.
UK hosted with secondary
backup in the EU.
Support provided from subprocessors located in multiple
locations globally.

2
Classification: Unclassified

5How long we keep your data

We retain your personal data for as long as is reasonably necessary to fulfil the relevant purposes
set out in this Privacy Notice.
We maintain and update regularly our data retention policy with a detailed retention schedule. Wewill securely delete or erase your personal data if there is no valid business or regulatory reason forretaining your data. In exceptional circumstances, we may retain your personal data for longer
periods of time if we reasonably believe there is a prospect of litigation, in the event of any
complaints or there is another valid business reason the data will be needed in the future.
6International transfers

We may make disclosures of your personal information overseas, for example if we receive a legal orregulatory request from a foreign law enforcement body. In addition to this, the Table in paragraph 4
above sets out the countries where your data may be processed.
We take steps to ensure that any international transfer of information is carefully managed to protect
your rights and interests:• We will only transfer your personal information to countries which are recognised as providing
an adequate level of legal protection or where we can be satisfied that alternativearrangements are in place to protect your privacy rights.
• Transfers within the Lloyd’s overseas offices will be covered by standard contractual clauses,adopted by the European Commission which gives specific contractual protections designed
to ensure that your personal information receives an adequate and consistent level ofprotection.
• Transfers to service providers and other third parties will always be protected by contractual
commitments and where appropriate further assurances.
• Any requests for information we receive from law enforcement or regulators will be carefully
checked before personal information is disclosed and we will ensure that we have the lawfulauthority to disclose that data.
7Your rights

You have certain rights as an individual which you can exercise in relation to the data we hold aboutyou. If you make a request to exercise any of your rights, we reserve the right to ask you for a proofof your identity. We aim to acknowledge your request as soon as possible and will address yourquery within one month from your request.
You have the following rights:
The right to access
You are entitled to a confirmation whether we are processing your data, a copy of your data, andinformation about purposes of processing, who do we disclose it to, whether we transfer it abroadand how we protect it, how long we keep it for, what rights you have, where we got your data fromand how you can make a complaint.

3Classification: Unclassified

The right to rectification
If you believe the personal data we hold about you is inaccurate or incomplete you can request for it
to be rectified.
The right to erasure
If you withdraw your consent, terminate a contract with us or you believe the personal information isno longer necessary for the purposes for which it was collected, you may request your data to bedeleted. However, this will need to be balanced against other factors, for example there may becertain regulatory obligations which mean we cannot comply with your request.
The right to restriction of processing
You can ask us to restrict (i.e. keep but not use) your personal data, but only where:••••

Its accuracy is contested, to allow us to verify its accuracy; orThe processing is unlawful, but you do not want it erased; or
It is no longer needed for the purposes for which it was collected, but we still need it to establish,
exercise or defend legal claims; orYou have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal data following a request for restriction, where we have yourconsent; to establish, exercise or defend legal claims; or to protect the rights of another natural or
legal person.
The right to data portability
If we collected your information under a contract or your consent, you can request from us to transfer
your personal information to provide it to another third party of your choice.
The right to object
You have the right to object at any time to processing of your personal data where processing isnecessary for the performance of a task carried out in the public interest, or in the exercise of an
official authority vested in the controller. You may also object where the processing is necessary forthe purposes of the legitimate interests, except where such interests are overridden by your interests
or fundamental rights and freedoms, in particular where you are a child.
8Contact details of the Data Protection Officer

If you have any questions relating to data protection that you believe we will be able to answer,
please contact our Data Protection Officer:
Data Protection Officer
Lloyd’s
1 Lime Street
EC3M 7HA, London
Email: data.protection@lloyds.com

4
Classification: Unclassified

9Complaints

If you are not satisfied with our response or believe we are not processing your personal data inaccordance with legal requirements you can make a complaint to the relevant Data Protection
Authority. Our Authority is the UK Information Commissioner’s Office (https://ico.org.uk/concerns/).

5
Classification: Unclassified