1. Introduction

The Employers’ Liability Tracing Office (ELTO or “we”) operate a service, introduced by the insurance industry, that makes it easier to search for Employers Liability (EL) insurance policies using a central database - containing all new and renewed EL insurance policies from April 2011, policies written before 2011 which have had a claim made against them and voluntary historic policies which have been uploaded.

This Privacy Policy (together with our Terms of Use and any other documents referred to in it) sets out the basis on which any personal data ELTO collects from you, or that is provided to ELTO, will be processed by us. Please read the following carefully to understand ELTO’s views and practices regarding your personal data and how we will treat it.

The Employers’ Liability Tracing Office (ELTO) is the controller responsible for the personal data collected from you in connection with this website and the services.

2. The Personal Data we collect about you

The data we process about you, and how it is used, is detailed in the table below:

3. How We Collect Your Personal Information

3.1 We may collect personal data from you when you interact with or use our website or where you choose to correspond with us in connection with our products or services.

3.2 You are required to provide any personal data we reasonably require to enable us to meet our obligations in connection with the services we provide to you, including any statutory or contractual obligation. Where you are unable to provide us with personal data we reasonably require to meet our obligations, we may be unable to offer services to you and we may have to terminate any existing services with immediate effect.

3.3 Where you provide personal data about other third-party individuals, such as your spouse, civil partner, children, dependants or emergency contacts, where appropriate, you should direct these individuals to this Notice to ensure they understand how we collect and use their personal data.

3.4 In addition to collecting personal data from you directly, we may also collect information about you from other third parties, such as employers, insurers solicitors or an employee’s personal representative. This information may be sourced prior to or whilst we are making arrangements to provide services to you.

4. How we use your Information

The personal data that we collect will be used for the following purposes:

• Enquirer information will be collected for the purpose of communication, and statistical analysis. This information will be used for responding to the results of an enquiry, and analysis into the use of the website, to recommend annual account use if appropriate
• The data will be used for the purpose of identifying the insurer of the employer of the Claimant. The data will also be used for statistical and analytical purposes. To enable the insurer to identify other insurers in cases of joint and several liability:
• To ensure that content from our website is presented in the most effective manner for
  you and for your computer.
• To offer and administer the service we provide to you.
• To carry out our obligations arising from any contracts entered into between you and us.
• To allow you to participate in interactive features of our service, when you choose to do so.
• To notify you about changes to our service.

5. Legal bases for Processing Your Information

5.1   We rely on the following legal bases to collect and use your personal data.

• To pursue our legitimate interests or a third party's legitimate interests to provide the services in the most appropriate way. This means that we will process and share your personal data to carry out some ancillary activities in connection with the services you have requested, such as performing identity and due diligence checks, monitoring communications for training and quality purposes, identity verification, claims investigation and administration, fraud and crime prevention, research and management information to identify trends and to assist resource allocation, business administration and debt administration and recovery of losses from liable parties.
• To fulfil our obligations in connection with any contract that we may have with you or take appropriate steps prior to entering into a contract with you. This means that we will process and share your personal data to provide any services you have requested and fulfil our contractual obligations, including responding to any prospective enquiries that you make about our services.
• To comply with a legal obligation. This means that we share and use your personal data and when we are subject to laws that require us to do so.

5.2  We rely on the following condition to process special category personal data:

• For an insurance purpose- this includes advising on, arranging, underwriting or administering an insurance contract, administering a claim under an insurance contract or exercising a right, or complying with an obligation, arising in connection with an insurance contract.

6. Who We Share Your Information With

We share your personal data with the following third parties:

• ABI, member insurers
• Law enforcement bodies
• HMRC and other government departments
• Local authorities
• Anti fraud organisations and or their agents and other public or private bodies, where we are obliged or permitted by law to do so.

We may also disclose your personal data to third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Data Protection Privacy Notice. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

7. Accuracy of Your Information

We rely on the availability of accurate personal data to enable us to provide the services to you and operate our business. You should therefore notify us of any changes to your personal data that may affect the proper management and administration of the services we provide to you.

8. Overseas Transfers of Your Information

Personal data may be transferred to any country, including countries outside the European Economic Area (“EEA”) where the transfer is necessary for the purposes of establishing, exercising or defending legal rights, obtaining legal advice, or in connection with any legal proceedings, or is otherwise permitted by law. ELTO takes steps to ensure that data transferred outside the EEA is in accordance with the principles of adequacy or appropriate safeguards as required by law.
The data that we collect may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the provision of services, the processing of personal details and the provision of support services. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with the General Data Protection Regulations and the Data Protection Act 2018.

9. Retention of Your Information

ELTO will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
Enquirer / Claimant information will be held for a period of 2 years from the date of the relevant enquiry. After which it will be securely disposed of, in accordance with the General Data Protection Regulations and the Data Protection Act 2018.
In some circumstances ELTO may anonymise personal data (so that it can no longer be associated with an individual) for research or statistical purposes in which case ELTO may use this information indefinitely without further notice to you.

10. Your Information Rights

You have the following rights in relation to the personal data we hold about you.

• The right to access and inspect your personal data or be provided with a permanent copy of the information we hold about you.
• The right to request inaccurate personal data about you is rectified, particularly if it is factually inaccurate.
• The right to request your personal data is erased in certain circumstances, e.g. if it is no longer necessary for us to retain the information.
• The right to object to the use of your personal data, particularly where you feel there are no longer sufficient grounds for us to continue processing the information or we rely on the legitimate interests lawful basis to carry out the processing.
• The right to request the restriction of your personal data from further processing, e.g. where the personal data is inaccurate and you request the restriction of the information until it is corrected.
• The right to request that some aspects of your personal data be provided to you or a third party of your choice in electronic form to enable its reuse.
• The right to refuse direct marketing communications or ask to stop sending you direct marketing communications.
• The right to withdraw your consent, where you have previously given your consent for us to collect and process your personal data.
• The right to object to a decision which is based solely on automated processing and which creates legal or other significant effects.
• The right to complain to the data protection supervisory authority if you have concerns about the way we collect and use your personal data.

Please note that some of the rights described above may be limited in certain circumstances, such as where exemptions or legal obligations apply or there is an overriding legitimate interest in continuing to process the personal data. If we are unable to fulfil a request from you to exercise one of the above rights, we will contact you to explain the reason for our refusal. If you wish to exercise your rights or have concerns about the way we collect and process your personal data please contact us at: dsar@mib.org.uk.

11. Cookies

We use cookies on our websites. Cookies are small data files sent from a website to your web browser. They are stored in your web browser’s cache and allow a website or a third party to recognise your browser or mobile device. We collect information about you automatically when you visit our website by using cookies and other tracking technology. For more information about cookies, and other tracking technology including how to turn them off, please see our Cookie Notice

12. Service Complaints

If you wish to make a complaint or enquire about any aspect of the services we provide, please contact us at:
Customer Services
Motor Insurers Bureau
Linford Wood House
6-12 Capital Drive
Milton Keynes
MK14 6XT

email: feedback@mib.org.uk

13. Data Protection Complaints

If you wish to make a complaint about the way we use your personal data you should contact us in the first instance at:
Data Protection Officer
Motor Insurers Bureau
Linford Wood House
6-12 Capital Drive
Milton Keynes
MK14 6XT
email: privacy@mib.org.uk

If you are not satisfied with the way we have handled your data protection complaint you may refer your complaint to the UK data protection supervisory authority at:
Information Commissioner's Office
Wycliffe House,
Water Lane,
Wilmslow,
SK9 5AF
Website: www.ico.org.uk

14. Changes to this Notice

We will update this Notice from time to time to ensure it continues to reflect the way we collect and use your personal data. Any changes to this Notice will be posted here and notified to you via email and such changes will become effective as soon as they are posted. You should therefore periodically review this notice to ensure you understand how we collect and use your personal data.