Privacy Notice
We are committed to protecting personal information that we receive when we provide our products and services to ourclients or where we provide finance for products. We maintain transparent practices about the collection, processing, andsharing of that information. Protecting individuals’ privacy is very important to us.
This privacy notice is designed to explain how and why the Reinsurance Group of America, Incorporated, and its
subsidiaries and affiliates (“RGA”, "we" or "us") collect personal information and how we use it where we have a financial
and legal interest over your mortgage.
We have designed this privacy notice to be user friendly – please click on a topic in the list below to found out more.

Who is RGA?
RGA is a group of companies which operate globally focusing primarily on life- and health-related reinsurance solutions,such as life reinsurance, living benefits reinsurance, group reinsurance, and health reinsurance.
The headquarters of Reinsurance Group of America, Inc. is located in St. Louis, Missouri, United States of America.
RGA UK Services Limited located in London, United Kingdom.
RGA Americas Reinsurance Company Ltd. and RGA UK Services Limited are the controllers responsible for the personal
information we collect and process in the course of providing loans to lenders in the United Kingdom so they can provide
mortgages to homeowners like you.

Application of privacy laws
This privacy notice is designed to provide compliance with relevant laws in the United Kingdom where RGA’s LTM products
and services operate.
RGA handles personal information in accordance with multiple local privacy laws at the place where the personal
information is collected and processed. If applicable laws provide for a lower level of protection of personal information
than that established by this privacy notice, then this privacy notice shall prevail

What do we mean by “personal information”?
Personal information means information, or a combination of pieces of information, that could reasonably allow anindividual to be identified.

Who this Privacy Notice applies to?
This privacy notice applies to anyone who applies for or has an existing mortgage with a lender to whom we are providing
financing.

How do we collect personal information?
When you apply for a mortgage, we obtain your personal information directly from the lender that we finance.

We currently provide funds to:oooo

Canada Life, a link to their privacy notice is https://www.canadalife.co.uk/data-protection-notice/
Hodge Lifetime, a link to their privacy notice is https://hodgebank.co.uk/privacy/
Just Retirement, a link to their privacy notice is https://www.wearejust.co.uk/definedbenefit/privacypolicy/
More2Life, a link to their privacy notice is https://www.more2life.co.uk/legal/privacy-policy

We may collect personal information directly from you, when you decide to get in touch with us by sending your enquiry
or data subject request. If you require further information on who do we obtain your personal information from, pleasecontact us at the details contained in the "Contact us" section below.

What types of personal information do we collect and process?
The type of information we collect and process about you may vary. It will depend on the type of mortgage you have but
will generally include:••••

Personal information: Your name, date of birth, age, gender, marital status, nationality, date of death.
Property details: the address, postcode, title number, property insurance and information about property suchas the type of property, the value provided by the surveyor engaged by your lender and the number ofbedrooms.
Loan related information: Your lender, the reference number, the amount you borrowed, the amountoutstanding and the interest rate, your credit position.
Other Information: We may obtain more information from your lender if you breach the terms and conditionsof the mortgage so that we can determine the most appropriate action. This might include information about
your health or other people living in your property.

If you get in touch with us by sending your enquiry or, data subject request, we will collect the following personal
information:••

Name and contact details: Your name, email address, date of birth, address, postcode.
Enquiry related information: Information about your mortgage (lender, reference number), nature of request.

Do we process any sensitive personal information?
Some of the categories of information we obtain are special categories of personal information. These are generally only
provided by your lender if you are in breach of terms and conditions••

Health records: Your medical history, letters from your doctor or nursing home provider.
Criminal record data: Any criminal record or sanctions information

For what purposes do we use your personal information?
We use the personal information provided by our clients for the following purposes:•to make sure we understand the risk in our portfolio of mortgages where we have a financial interest.

•••to value of a loan for financial reporting purposes;
to provide funds for mortgages and where necessary to work with the lender if there is a breach of the terms andconditions where we may need to enforce our rights
to audit our lenders.

If we decide to sell these loans to another provider like us or to securitise the loans we would share basic information
about the mortgages to the potential purchaser or rating agency.
We use the personal information provided by you directly to respond to your enquiry.
We do not use your personal information to advertise our services and products to you.

Do we use personal information for profiling and automated decision making?
For the purposes of risk assessment, fraud prevention and detection, and to report to our clients as part of providing ourservices to clients we may process your personal information using software that is able to evaluate certain personal
aspects about you and predict risks or outcomes. This means that the processing of your personal information may involve
profiling and automated decision making. For example, we may analyse personal information about age and marital status
to predict mortality.
Since we only provide funds to your lender, we do not make any decisions about your ability to obtain the loan or yourinterest rates. However, the outcome of your personal information analysis may be shared with your lender.

What are the legal bases on which we use your personal information?
We are committed to processing your personal information fairly and lawfully and only to the extent necessary to achieve
the purposes listed above.
We must have a legal basis to process your personal information. Our ability to obtain and process your personal
information is based on the following legal bases:••

Processing your personal information is necessary to comply with our legal obligations, such as due diligenceand reporting obligations, and responding to requests from your lender or our regulators; andProcessing your personal information is necessary to meet our legitimate interests and the legitimate interestsof our clients, for example to provide our products and services to clients, to improve our services, to ensure we
price our products appropriately, to manage risk and our business efficiently, to perform audits, and to maintainaccurate records.

Where we rely on this legal ground, we make sure that such processing is not unnecessarily intrusive, and we only
process the minimum amount of personal information necessary and for the minimum amount of time. Our legitimate
interests include: making sure we understand the risks in our portfolios of mortgages, in particular that they are not
becoming more risky, reviewing our portfolio of loans to make sure we do not continue to lend if there are material
breaches
If it is necessary that we process special categories of personal information for one of the purposes listed above, we will
only do so where the following applies:•

We are authorized by local law to protect substantial public interest, whilst fulfilling regulatory requirements
relating to unlawful acts and dishonesty.

With whom do we share personal information?
Depending on the circumstances relevant to the processing of your personal information, we may share your personal
information with the following parties:•••••

RGA group companies. We operate as a global business, so we may share your personal information with group
entities who may use this information for the purposes described in this privacy notice.
Service providers. We may share your personal information with service providers that perform certain services
and business operations for us, for example, IT system and software providers.
Professional advisors. We may share your personal information with professional advisors that provideprofessional assurance and support necessary to carry out our services, for example, rating agencies, auditors,
consultants and law firms.
Any law enforcement agency, court, regulator, government authority or professional body. We may share yourpersonal information with these parties where we believe this is necessary to comply with a legal or regulatory
obligation, or otherwise to protect our rights or the rights of any third party.
Asset purchasers. We may share your personal information with any third party that purchases, or to which wetransfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use
reasonable efforts to ensure that the entity to which we transfer your personal information uses it in a mannerthat is consistent with this privacy notice and you are notified about such changes.

If you require further information on who your personal information is shared with, please contact us at the details
contained in the "Contact us" section below.

What rights do individuals have in relation to the information we hold?
You have certain rights regarding your personal information, subject to circumstances relating to the processing of yourpersonal data.
Your rights include the right to:• access your personal information and details relating to the processing of your personal information;• correct the information we hold about you;• delete your personal information;• restrict our use of your personal information;• object to our use of your personal information;• receive your personal information in a usable electronic format and transmit it to a third party (right to data
portability); and• lodge a complaint with your local data protection authority.
Since we receive your personal information directly from your lender, you should contact the lender first if you would liketo exercise your rights. We would encourage you to inform the lender if your personal information needs to be correctedor updated (and you may be under a legal duty to do so).
If the lender has not resolved your request or concern, or if you would like to contact us directly to discuss or exercise
your rights, you may contact us via our online contact form, or using the contact details provided in section ‘Contact Us’below.

We are committed to working with you to obtain a fair resolution of any request, complaint or concern about privacy. If,
however, you believe that we have not been able to assist with your request, complaint or concern, you have the right tomake a complaint to the Information Commissioner’s Office (‘ICO’). Contact details of the ICO are available at the following
link: https://ico.org.uk/

How do we protect personal information?
We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal
information we process. These measures are aimed at ensuring the on-going availability, integrity and confidentiality ofpersonal information. We evaluate these measures on a regular basis to ensure the security of the processing.

How long do we keep personal information for?
We will normally keep your personal information for as long as we are required to retain it to manage our business for thepurposes described above.
More specifically, in line with our data retention schedule, we keep your personal information until your loan terminates.
Beyond that, we retain personal information for a period of time that reasonably allows us to investigate, commence ordefend legal claims brought by or against us or our clients. Additionally, we keep your personal information for anextended period of time where we are required to comply with our regulatory obligations relating to, for example,reporting obligations.
If you would like to know more about the retention of your personal information, please contact us at the details containedin the "Contact us" section below.
We securely destroy personal information when its retention period has expired. However, we may decide to aggregate
or anonymise data (which is not treated as personal information under this privacy notice) and retain it for longer.

Where do we process your personal information?
Because we operate as a global business, your personal information may be transferred to, stored, and processed by RGA
entities in other countries, which may include countries that are not regarded as ensuring an adequate level of protection
for personal information under the law of United Kingdom. To keep your data safe, RGA will utilise Standard Contractual
Clauses (SCCs) as approved by the EU.
If we need to transfer your personal information to service providers or other parties located outside United Kingdom, wewill make sure that adequate safeguards are in place with those parties. For more information on the safeguards in place,please contact us at the details contained in the "Contact us" section below.

Contact us
If you have questions or concerns regarding this privacy notice or the way in which your personal information has been
used, please e-mail us at privacy@rgare.com or call or write to us.
Our United States postal address is:
Reinsurance Group of America, Inc.
Attn.: Global Privacy Office

Our United States telephone number is:+1 (636) 736-7000

16600 Swingley Ridge Road
Chesterfield, Missouri 63017-1706
Our Bermuda postal address is:
RGA Americas Reinsurance Company Ltd.
c/o Marsh Management Services (Bermuda) Ltd.
7 Par-la-Ville RoadHamilton, Bermuda HM11, Bermuda
Our United Kingdom Postal address is:
RGA International Reinsurance Company dac, UK Branch Office
RGA UK Services Limited
5th Floor, 24 Chiswell StreetLondon, EC1Y 4TY

Our Bermuda telephone number is:+1 (441) 292-4402

Our United Kingdom telephone number is:+44 20 7710 6700

For all other postal addresses, please see rgare.com
If you would like to exercise a data subject right, you may use our online contact form.
RGA’s Data Protection Officer for the United Kingdom is Dean Scotson.
Should you have any questions or concerns for our DPO regarding the way in which your personal information has been
used, please contact him via email at dpo@rgare.com.

How do we make changes to this privacy notice?
You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update
this privacy notice from time to time. If we make a significant change to this privacy notice, we will post a notice about
this on our website, and we may ask the lenders we work with to notify you on our behalf.
Last Updated: December 2022