Privacy Notice: SecureShare
Effective date:

1June 2021

Introduction

This notice describes how Lloyd’s, in its capacity as a data controller, collects, uses, shares andretains the personal information you provide when you use SecureShare and informs you about yourchoices regarding use, access and correction of your personal information. Lloyd’s is committed toensuring that any personal data it receives is protected and handled in accordance with applicabledata protection laws.
For the purposes of this Privacy Notice, references to “we”, “us” or “our” shall refer to Lloyd’s.
About SecureShare
SecureShare is a platform for transferring files and documents from Lloyd’s to market entities andvice versa.

2Who we are

The Society of Lloyd’s, incorporated by Lloyd’s Acts 1871 by the name of Lloyd’s, whose principal
place of business is at One Lime Street, EC3M 7HA.
3

What personal information we process about you
Personal Data we process
about you

Why we process it

Lawful basis forprocessing by Lloyd's

Contact details (name, phone
number, email address)••

Legitimate interest•

Legitimate interest•

Legitimate interest

For auditing of systemprocessing records and use inauthentication/authorisation tothe system

IP Address•

4For auditing of systemprocessing records

Who we are sharing your data with

We will share personal data with third party supplier, [System name] (“processor”) and they may
supply it to their sub-processors, who are at present:

pg. 1

Classification: Unclassified

Lloyd’s processors:
Microsoft Corporation UK (as hosting providers of Azure and Micrsoft 365 services)
Should these sub-processors change, we will let you know by changing this Privacy Notice.
To help manage our business and deliver services we may share your personal information withadditional third party service providers such as IT suppliers. We require all our service providers torespect the confidentiality and security of personal data

5How long we keep your data

We retain your personal information for as long as is reasonably necessary to fulfil the relevant
purposes set out in this Privacy Notice, and for processing done by SecureShare system information
your personal data will be deleted 365 days from the last system event in the audit logs.
We maintain and update regularly our data retention policy with a detailed retention schedule. We willsecurely delete or erase your personal information if there is no valid business reason for retaining
your data. In exceptional circumstances, we may retain your personal information for longer periodsof time if we reasonably believe there is a prospect of litigation, in the event of any complaints orthere is another valid business reason the data will be needed in the future.

6International transfers

We may allow selected service providers, who may be located outside the EU, access to your personal
information. We may also make other disclosures of your personal information overseas, for example
if we receive a legal or regulatory request from a foreign law enforcement body.
We will always take steps to ensure that any international transfer of information is carefully managed
to protect your rights and interests:••••

We will only transfer your personal information to countries which are recognised as providing
an adequate level of legal protection or where we can be satisfied that alternativearrangements are in place to protect your privacy rights.
Transfers within the Lloyd’s overseas offices will be covered by standard contractual clauses,
adopted by the European Commission which gives specific contractual protections designed
to ensure that your personal information receives an adequate and consistent level ofprotection.
Transfers to service providers and other third parties will always be protected by contractualcommitments and where appropriate further assurances.
Any requests for information we receive from law enforcement or regulators will be carefully
checked before personal information is disclosed.

Information relating to the safeguards in place for all international transfers can be obtained bywriting to the DPO, whose details can be found in section 9.
7

Your rights

Privacy Notice: [System name]Classification: Unclassified

Page 2 of 4

You have certain rights as an individual which you can exercise in relation to the data we hold aboutyou. If you make a request to exercise any of your rights we reserve the right to ask you for a proof ofyour identity. We aim to acknowledge your request as soon as possible and will address your querywithin one month from your request.
You have the following rights:
The right to access
You are entitled to a confirmation whether we are processing your data, a copy of your data, andinformation about purposes of processing, who do we disclose it to, whether we transfer it abroadand how we protect it, how long we keep it for, what rights you have, where we got your data fromand how you can make a complaint.
The right to rectification
If you believe the personal data we hold about you is inaccurate or incomplete you can request for it
to be rectified.
The right to erasure
If you withdraw your consent, terminate a contract with us or you believe the personal information is
no longer necessary for the purposes for which it was collected, you may request your data to bedeleted. However, this will need to be balanced against other factors, for example there may becertain regulatory obligations which mean we cannot comply with your request.
The right to restriction of processing
You can ask us to restrict (i.e. keep but not use) your personal data, but only where:••••

Its accuracy is contested, to allow us to verify its accuracy; or
The processing is unlawful, but you do not want it erased; or
It is no longer needed for the purposes for which it was collected, but we still need it to establish,
exercise or defend legal claims; orYou have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal data following a request for restriction, where we have yourconsent; to establish, exercise or defend legal claims; or to protect the rights of another natural orlegal person.
The right to data portability
If we collected your information under a contract or your consent, you can request from us to transfer
your personal information to provide it to another third party of your choice.
The right to object
You have the right to object at any time to processing of your personal data where processing isnecessary for the performance of a task carried out in the public interest, or in the exercise of an
official authority vested in the controller. You may also object where the processing is necessary forthe purposes of the legitimate interests, except where such interests are overridden by your interests
or fundamental rights and freedoms, in particular where you are a child.

Privacy Notice: [System name]Classification: Unclassified

Page 3 of 4

8Contact details of the Data Protection OfficerIf you have any questions relating to data protection that you believe we will be able to answer,
please contact our Data Protection Officer:
Data Protection Officer
Lloyd’s
1 Lime Street
EC3M 7HA, London
Email: data.protection@lloyds.com
9Complaints

If you are not satisfied with our response or believe we are not processing your personal data inaccordance with legal requirements you can make a complaint to relevant Data Protection Authority.
Our Lead Authority within the European Union is the UK Information Commissioner’s Office(https://ico.org.uk/concerns/).

Privacy Notice: [System name]Classification: Unclassified

Page 4 of 4