Privacy notice

QUORIN Specialty Limited is a wholesale facultative reinsurance managing general agent. We are the controller of the personal data described in this notice.

Legal entity

QUORIN Specialty Limited

Company number

16640752, registered in England and Wales

Registered office

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Regulatory status

Appointed Representative of Bluefriars Brokers Limited (Firm Reference Number 604987), who are authorised and regulated by the Financial Conduct Authority. Our own Firm Reference Number is 1061542.

Data protection contact

kaspar@quorinspecialty.com

ICO registration

ZC237858

We deal with businesses, not consumers. We do not underwrite insurance for individuals and we hold no consumer or retail customer records.

Our counterparties are insurance and reinsurance brokers, cedants, reinsurers and service providers. The personal data we hold is therefore almost entirely the business contact information of individuals acting for those organisations, together with information about individuals that appears incidentally in the risk and claims documentation those organisations send to us.

That distinction matters, but it is not the same as holding no personal data at all. Where we hold information that identifies a living individual, this notice applies to it. Specifically, we may hold personal data about:

• individuals working for brokers, cedants, reinsurers, loss adjusters and other market participants we deal with, in their professional capacity;
• individuals named in submissions, slips, surveys, statements of values and loss records sent to us by brokers and cedants, such as directors, signatories, site contacts and risk engineers;
• individuals who notify a claim, make a complaint or otherwise contact us through this website;
• our own personnel and applicants for roles with us.

We only use personal data where the law allows us to. In practice we rely on the following bases.

Our legitimate interests

Most of what we do rests on our legitimate interest in conducting and administering a reinsurance business with our counterparties: assessing and underwriting risks presented to us, placing and administering contracts, handling claims, managing the relationships behind them, and analysing our own portfolio and performance. We have considered whether those interests are overridden by the interests and rights of the individuals concerned, and, because the data is business contact information used for the professional purpose it was provided for, we have concluded they are not. You can ask us for more detail on that assessment.

Legal and regulatory obligations

We are subject to obligations that require us to collect and keep personal data, including financial crime and sanctions screening under the Money Laundering Regulations 2017, record-keeping under the Financial Conduct Authority’s rules, complaint records under those rules, and accounting and tax records under the Companies Act 2006 and general tax law.

Performance of a contract

Where an individual is themselves our counterparty or is entering into arrangements with us in their own name, we process their data to perform that contract or to take steps at their request before entering into it.

Special category and criminal offence data

We do not routinely hold sensitive personal data. Where information about a person’s health or injuries reaches us within claims documentation, we rely on the substantial public interest condition for insurance purposes in paragraph 20 of Part 2 of Schedule 1 to the Data Protection Act 2018. Where our financial crime and sanctions screening touches information about criminal offences or alleged offences, we rely on the corresponding conditions in that Schedule.

We may share personal data with:

• Bluefriars Brokers Limited, as our principal, which is responsible for the regulated business we conduct and oversees it;
• the reinsurers and capacity providers carrying the risks we place, and their delegated claims and audit functions;
• the brokers and cedants in the chain of the placement concerned;
• loss adjusters, surveyors, lawyers, accountants, auditors and other professional advisers instructed on a risk or a claim;
• regulators, law enforcement and other authorities where we are required or permitted to disclose;
• technology suppliers who process data on our behalf under written terms that restrict what they may do with it.

We do not sell personal data and we do not share it for third-party marketing.

All personal data we hold is processed in the United Kingdom.

Our platform, its databases, its document storage and the artificial intelligence models it uses all run on infrastructure hosted in the United Kingdom. We do not routinely transfer personal data outside the United Kingdom.

Where a transfer outside the United Kingdom becomes necessary, we make it only where the destination is covered by United Kingdom adequacy regulations or where an appropriate safeguard recognised under United Kingdom data protection law, such as the International Data Transfer Agreement or the United Kingdom Addendum to the European Commission standard contractual clauses, is in place.

We use artificial intelligence in our underwriting and claims work, to read and extract information from documents, to prepare analysis and to draft correspondence for review.

No decision that produces legal effects concerning an individual, or that similarly significantly affects them, is taken by us solely by automated means.

Human review is built into every stage of our underwriting workflow. An identified person makes the underwriting and claims decisions, and our systems record which decisions were made by a person and which analysis was machine-generated. We describe our approach further in our statement on the governance of artificial intelligence.

We keep personal data only for as long as we need it. Because reinsurance liabilities are long-tail, and because the classes we write include construction and engineering risks where a claim may emerge many years after the risk expired, the periods below are longer than they would be in many industries. They are set by reference to the period during which a legal claim could still be brought against us or against those we act for.

Underwriting records

Submissions, quotations, declinatures, slips, placements and the correspondence around them: 15 years from expiry of the risk.

Claims records

15 years from the closure of the claim.

Complaints

15 years from the date the complaint was received, against a regulatory minimum of three years.

Financial crime records

Customer due diligence and sanctions screening records: five years from the end of the business relationship or the completion of the transaction, after which we are required to delete the personal data unless we have a specific legal ground to keep it.

Accounting records

Six years from the end of the financial year they relate to.

Website enquiries

Enquiries and form submissions that do not lead to a business relationship: 24 months.

The 15-year periods reflect the longest period in which a claim founded on negligence may be brought under the Limitation Act 1980, which sets an overriding time limit of 15 years, and the 12-year period that applies to contracts executed as a deed. Where a claim, dispute, regulatory matter or investigation is live when a period would otherwise end, we keep the relevant records until it is concluded.

We also use information about the business we write for analysis, modelling and reporting. Where we want to keep that information indefinitely for those purposes, we anonymise it first, so that it no longer identifies anyone. Anonymised information is not personal data and this notice does not restrict how long we keep it.

Access to our systems is restricted to identified users, authenticated individually, and limited to what each role needs. Actions taken in our platform are recorded in audit logs that cannot be edited after the fact. Data is encrypted in transit and at rest. Our suppliers are engaged under written terms that require equivalent protection.

Subject to conditions and exemptions in the law, you have the right to ask us to give you a copy of the personal data we hold about you; to correct it if it is inaccurate; to erase it; to restrict how we use it; to object to our use of it where we rely on our legitimate interests; and to receive it in a portable form where we rely on your consent or on a contract with you and process it by automated means. Where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, write to us at kaspar@quorinspecialty.com or at the registered office above. We will respond within one month, and will tell you if we need longer because the request is complex.

Some of these rights are limited where we are required to keep records by law or regulation, or where we need the information to establish, exercise or defend a legal claim. Where we cannot do what you have asked, we will explain why.

If you are unhappy with how we have handled your personal data, please tell us first, using the contact details above, so that we have the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data protection regulator, at any time.

Information Commissioner

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline

0303 123 1113

Online

ico.org.uk/make-a-complaint

If your complaint is about our conduct more generally rather than about data protection, our complaints procedure explains how to raise it.

We review this notice when our business or our processing changes, and at least annually. The date at the top of the page is the date of the current version.