Search
Log in
Privacy Notice
Business and Corporate Clients
What this section covers
This section of our Privacy Notice covers our business and corporate healthcare plans.
Our business and corporate healthcare plans aim to make it easier for your employees to get healthier and reward them when they do. The business and corporate healthcare plans are an annual insurance contract which means that the premiums, benefits, terms and conditions can change at each annual renewal data.
Who Vitality are
Vitality is part of the discovery Group of companies and is owned by Discovery limited, a financial services firm based in South Africa.
In this privacy notice, ‘we’, ‘us’ and ‘our’ mean Vitality. The Vitality group consists of Vitality Corporate Services Limited, Vitality Health Limited, Vitality Life Limited and Vitality Healthy Workplace Limited. Visit https://www.vitality.co.uk/legal to find out more about the companies that handle your information based on the products and services you access or use.
Within Vitality we provide private medical insurance (PMI), life insurance, income protection, serious illness cover, mortgage protection, stocks and shares, junior ISA, retirement plans, and car insurance, claims management for corporate Trusts. As well as, access to partners and rewards that you can benefit from when you make positive lifestyle choices.
Depending on which of our products and services you ask us about, buy or use, different companies within our organisation will process your information.
In this privacy notice, ‘we’, ‘us’ and ‘our’ mean Vitality. The Vitality group consists of Vitality Corporate Services Limited, Vitality Health Limited, Vitality Life Limited and Vitality Healthy Workplace Limited. Visit https://www.vitality.co.uk/legal to find out more about the companies that handle your information based on the products and services you access or use.
Within Vitality we provide private medical insurance (PMI), life insurance, income protection, serious illness cover, mortgage protection, stocks and shares, junior ISA, retirement plans, and car insurance, claims management for corporate Trusts. As well as, access to partners and rewards that you can benefit from when you make positive lifestyle choices.
Depending on which of our products and services you ask us about, buy or use, different companies within our organisation will process your information.
Data Controller
One of the key elements in the General Data Protection Regulation and the Data Protection Act 2018 is accountability. Firms are responsible for, and must be able to demonstrate compliance, with data protection laws. However, compliance means different things for the data controller and the data processor. So, it’s imperative that firms are able to determine their own role, and the role of their vendors, to fully understand their legal obligations.
The definition of a vendor as a data processor depends on their role and how much control they possess over the personal data. Vitality’s position as Data Controller is set out in our Terms and Conditions and for this reason we do not enter into Data Processing Agreement as we are not a data processor for those clients.
As an independent data controller, Vitality is responsible for protecting the rights of the data subject, and Vitality controls the overall purpose and means, or the ‘why’ and ‘how’ the data is to be used. In short, it is Vitality who decides:
To find out how we handle your employee’s data please refer to the relevant privacy notice which provides information to your employees on:
The definition of a vendor as a data processor depends on their role and how much control they possess over the personal data. Vitality’s position as Data Controller is set out in our Terms and Conditions and for this reason we do not enter into Data Processing Agreement as we are not a data processor for those clients.
As an independent data controller, Vitality is responsible for protecting the rights of the data subject, and Vitality controls the overall purpose and means, or the ‘why’ and ‘how’ the data is to be used. In short, it is Vitality who decides:
- to collect the personal data and has the legal basis for doing so;
- which items of personal data to collect;
- to modify the data;
- the purpose or purposes the data are to be used for;
- whether to share the data, and if so, with whom;
- how long to retain the data.
To find out how we handle your employee’s data please refer to the relevant privacy notice which provides information to your employees on:
- How we use their information
- What type of information do we collect?
- How we share their information
- Marketing
- International Transfers
- How long we keep their information for
- Their rights
- How to contact us
- Changes to this Privacy Policy.
Our Data Processing Addendum can be found here
Data Protection Addendum for Corporate, Business and SME’s.
Between The Client; and Vitality Health Limited, the respective supplier engaged by the Client on the basis of the terms and condition of Service.
DATA PROTECTION
Both parties are Independent Data Controllers of the Share Personal Data.
Vitality also receives personal and/or special category data of Employees and/or their Dependents directly from those Employees and/or their Dependants. This personal data and/or special category data is not Shared Personal Data. As such, this data falls outside of this Agreement and is governed by Vitality’s own Privacy Notice available at: www.vitality.co.uk/privacy
Agreed Terms
1. Interpretation
The following definitions and rules of interpretation apply in these terms and conditions (the “Agreement”).
1.1 Definitions: For the purposes of these this Agreement:
“Agreed Purposes” means the setting up, management and administration of private medical insurance pursuant to the Client’s Plan to the Client’s Employees and Employee Dependents;
“Client” shall mean the party which discloses Shared Personal Data to Vitality;
“Data Controller” means any party insofar as they are acting as a controller within the meaning of applied GDPR Art 4.7;
“Data Discloser” means the Client who agrees to share the Shared Personal Data with the Data Receiver;
“Data Receiver” means Vitality who agrees to use the Personal Data on the terms set out in this Agreement;
“Dependent” mean the husband, wife, partner or any dependent child of an Employee where added to the Plan by the Group Secretary;
“Employee” shall mean each individual with the benefit of private medical insurance cover under the Plan. “Personal data”, “Special Categories of data/Sensitive Data”,
“Group Secretary” means the person in control of the Client’s Plan;
“Plan” means the private medical insurance scheme underwritten by Vitality;
“Process/processing”, “Controller”, “Processor”, “Data Subject” and
“Supervisory Authority” shall have the same meaning as in the UK Data Protection Act 2018. For the purposes of this Agreement references to a “data subject” shall mean the Client’s Employees/Employee Dependents;
“Shared Personal Data” means the personal data to be shared between the parties, as further outlined at clause 2.4;
“UK Data Protection Laws”, all applicable data protection and privacy laws in force from time to time in the UK, including the UK General Data Protection Regulation, the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.
2. Purpose
2.1 This Agreement sets out the framework for the sharing of Shared Personal Data between the parties as independent Data Controllers.
2.2 The parties consider this data sharing initiative necessary as part of the provision of private medical insurance. The aim of the data sharing initiative is to make it easier for the Clients Employees and/or Dependents to get healthier and reward them when they do. It will serve to benefit the Client, Employees and/or Dependents of the Client’s Plan.
2.3 Each party acknowledges and agrees that:
a. The Client will regularly disclose to Vitality the Shared Personal Data collected by the Client for the Agreed Purposes;
b. Vitality provides private medical insurance directly to each of the Client’s individual Employees and any Employee Dependants who qualify for cover under the Client’s Plan. Accordingly Vitality determines the ways and means of its processing of the Shared Personal Data and does not act on the instructions of the Client in relation to the processing of the Shared Personal Data.
2.4 The following types of Shared Personal Data will be shared between the parties during the term of this agreement:
a. Name
b. Date of Birth
c. Designation
d. Email contact details
e. Address
f. Telephone number
Special categories of Personal Data will not be shared between the parties.
3. Lawful, fair and transparent processing
3.1 Each party shall ensure that it processes the Shared Personal Data fairly and lawfully in accordance with clause 3.2.
3.2 Each party shall ensure that it has legitimate grounds under the Data Protection Laws for the processing of Shared Personal Data.
3.3 The Data Discloser shall, in respect of Shared Personal Data, ensure that it provides clear and sufficient information to the data subjects, in accordance with the Data Protection laws, of the purposes for which it will process their personal data, the legal basis for such purposes and such other information as is required by Article 13 of the applied GDPR including:
a. if Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the data subject to understand the purpose and risks of such transfer; and
b. if Shared Personal Data will be transferred outside the EEA pursuant to clause 0 of this Agreement, that fact and sufficient information about such transfer, the purpose of such transfer and the safeguards put in place by the controller to enable the data subject to understand the purpose and risks of such transfer.]
3.4 The Data Receiver undertakes to inform the Data Subjects, in accordance with the Data Protection laws, of the purposes for which it will process their personal data, the legal basis for such purposes and such other information as is required by Article 14 of the applied GDPR including:
a. if Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the data subject to understand the purpose and risks of such transfer; and
b. if Shared Personal Data will be transferred outside the EEA pursuant to clause 0 of this Agreement, that fact and sufficient information about such transfer, the purpose of such transfer and the safeguards put in place by the controller to enable the data subject to understand the purpose and risks of such transfer. This information is contained in our privacy notice www.vitality.co.uk/privacy
4. Rights of Data Subjects
4.1 Each party agrees to have processes in place to comply with requests from Data Subjects to exercise their rights under the Data Protection Laws within the time limits imposed by the Data Protection Laws.
5. Data Retention and Deletion
5.1 The Data Receiver shall not retain or process Shared Personal Data for longer than is necessary to carry out the Agreed Purposes.
5.2 Notwithstanding clause 5.1, the parties shall continue to retain Shared Personal Data in accordance with any statutory or professional retention periods applicable in their respective countries and/or industry.
5.3 The Data Receiver shall ensure that any Shared Personal Data are destroyed in accordance with its deletion procedure in the following circumstances:
a. on termination of this Agreement;
b. on expiry of the Term of this Agreement;
c. once processing of the Shared Personal Data is no longer necessary for the purposes it was originally shared for.
6. Transfers
6.1 For the purposes of this clause, transfers of personal data shall mean any sharing of Shared Personal Data by the Data Receiver with a third party, and shall include, but is not limited to, the following:
a. subcontracting the processing of Shared Personal Data;
b. granting a third party controller access to the Shared Personal Data.
6.2 If the Data Receiver appoints a third party processor to process the Shared Personal Data it shall comply with Article 28 and Article 30 of the applied GDPR.
6.3 The Data Receiver may not transfer Shared Personal Data to a third party located outside the EEA unless it:
a. complies with the provisions of Articles 26 of the applied GDPR (in the event the third party is a joint controller); and
b. ensures that:
i. the transfer is to a country approved by the European Commission as providing adequate protection pursuant to Article 45 of the applied GDPR;
ii. there are appropriate safeguards in place pursuant to Article 46 of the applied GDPR; or
iii. one of the derogations for specific situations in Article 49 of the applied GDPR applies to the transfer.
6.4 The Data Receiver is part of the Discovery Group of companies and is owned by Discovery Limited, a financial services firm based in South Africa. As part of this relationship, Discovery undertake a number of business processes on behalf of the Data Receiver. Such processes include underwriting and claims administration services. The delivery of such services requires the Data Receiver to share data relating to its customers with Discovery and is undertaken in accordance with Article 46 of the applied GDPR.
7. Security and training
7.1 The parties undertake to have in place appropriate technical and organisational security measures to:
a) prevent:
i. unauthorised or unlawful processing of the Shared Personal Data; and
ii. the accidental loss or destruction of, or damage to, the Shared Personal Data;
b) ensure a level of security appropriate to:
i. the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage; and
ii. the nature of the Shared Personal Data to be protected.
7.2 It is the responsibility of each party to ensure that
(i) its staff members are appropriately trained to handle and process the Shared Personal Data in accordance with the technical and organisational security of that party together with any other applicable national data protection laws and guidance and
(ii) have entered into confidentiality agreements relating to the processing of personal data.
8 Personal data Breaches and reporting procedures.
8.1 The parties shall each comply with its obligation to report a Personal Data Breach to the appropriate Supervisory Authority and (where applicable) data subjects in accordance with Article 33 of the applied GDPR.
8.2 Where appropriate Vitality will provide all reasonable information to the Client to enable them to manage their employee expectations, and will aim to do so within 72 hours, to ensure that any actions do not prejudice any internal investigations or those by the police/Regulator.
9. Resolution of disputes with data subjects or the Supervisory Authority.
9.1 In the event of a dispute or claim brought by a data subject or the Supervisory Authority concerning the processing of Shared Personal Data against either or both parties, the parties will inform each other about any such disputes or claims, where appropriate, and will cooperate with a view to settling them amicably in a timely fashion.
9.2 The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the Supervisory Authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.
9.3 Each party shall abide by a decision of a competent court of the Data Receiver's country of establishment or of the Supervisory Authority.
10. Warranties
10.1 Each party warrants and undertakes that it will:
a. Process the Shared Personal Data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments that apply to its personal data processing operations.
b. Make available on request to the data subjects who are third party beneficiaries a copy of this Agreement, unless the Agreement contains confidential information.
c. Respond within a reasonable time and as far as reasonably possible to enquiries from the relevant Supervisory Authority in relation to the Shared Personal Data.
d. Respond to Subject Access Requests in accordance with the Data Protection Law.
e. Where applicable, pay the appropriate fees with all relevant Supervisory Authorities to process all Shared Personal Data for the Agreed Purpose.
f. Take all appropriate steps to ensure compliance with the security measures set out in clause 0 above.
10.2 The Data Discloser warrants and undertakes that it is entitled to provide the Shared Personal Data to the Data Receiver and it will ensure that the Shared Personal Data are accurate.
10.3 The Data Receiver warrants and undertakes that it will not disclose or transfer Shared Personal Data outside the EEA unless it complies with the obligations set out in clause 6.
10.4 Except as expressly stated in this Agreement, all warranties, conditions and terms, whether express or implied by statute, common law or otherwise are hereby excluded to the extent permitted by law.
11 Indemnity
11.1 The Data Discloser and Data Receiver undertake to indemnify each other and hold each other harmless from any cost, charge, damages, expense or loss which they cause each other as a result of their breach of any of the provisions of this Agreement, except to the extent that any such liability is excluded under clause 12.2.
11.2 Indemnification hereunder is contingent upon:
a. the party(ies) to be indemnified (the “indemnified party(ies)”) promptly notifying the other party(ies) (the “indemnifying party(ies)”) of a claim,
b. the indemnifying party(ies) having sole control of the defence and settlement of any such claim, and
c. the indemnified party(ies) providing reasonable co-operation and assistance to the indemnifying party(ies) in defence of such claim.
12. Limitation of liability
12.1 Neither party excludes or limits liability to the other party for:
a. fraud or fraudulent misrepresentation;
b. death or personal injury caused by negligence;
c. a breach of any obligations implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982; or
d. any matter for which it would be unlawful for the parties to exclude liability.
12.2 Subject to clause 12.1 neither party shall in any circumstances be liable whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, for:
a. any loss (whether direct or indirect) of profits, business, business opportunities, revenue, turnover, reputation or goodwill;
b. loss (whether direct or indirect) of anticipated savings or wasted expenditure (including management time); or
c. any loss or liability (whether direct or indirect) under or in relation to any other contract.
12.3 Clause 12.2 shall not prevent claims, for:
a. direct financial loss that are not excluded under any of the categories set out in clause 12.2 (a); or
b. tangible property or physical damage.
13. Third party rights
13.1 Except as expressly provided in clause 4 (data subjects rights) a person who is not a party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
13.2 The rights of the parties to terminate, rescind or agree any variation, waiver or settlement under this Agreement are not subject to the consent of any other person.
14. Direct marketing
14.2 If the Data Receiver processes the Shared Personal Data for the purposes of direct marketing, each party shall ensure that:
a. the appropriate level consent has been obtained from the relevant data subjects to allow the Shared Personal Data to be used for the purposes of direct marketing in compliance with the Data Protection Law; and
b. effective procedures are in place to allow the data subject to "opt-out" from having their Shared Personal Data used for such direct marketing purposes.
15. Variation
15.1 No variation of this Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).
16. Waiver
16.1 No failure or delay by a party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.
17. Severance
17.1 If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this agreement.
17.2 If any provision or part-provision of this agreement is deemed deleted under clause 17.1, the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
18. Changes to the applicable law
18.1 If during the duration of this Agreement the Data Protection Law changes in a way that this Agreement is no longer adequate for the purpose of governing lawful data sharing exercises, the parties agree that the parties will negotiate in good faith to review the Agreement in the light of the new laws.
19. No partnership or agency
19.1 Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between any of the parties, constitute any party the agent of another party, or authorise any party to make or enter into any commitments for or on behalf of any other party.
19.2 Each party confirms it is acting on its own behalf and not for the benefit of any other person.
20. Entire agreement
20.1 This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.
20.2 Each party acknowledges that in entering into this Agreement it does not rely on, and shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement.
20.3 Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misrepresentation based on any statement in this Agreement.
21 Further assurance
21.1 At its own expense, each party shall, and shall use all reasonable endeavours to procure that any necessary third party shall, promptly execute and deliver such documents and perform such acts as may reasonably be required for the purpose of giving full effect to this Agreement.
Between The Client; and Vitality Health Limited, the respective supplier engaged by the Client on the basis of the terms and condition of Service.
DATA PROTECTION
Both parties are Independent Data Controllers of the Share Personal Data.
Vitality also receives personal and/or special category data of Employees and/or their Dependents directly from those Employees and/or their Dependants. This personal data and/or special category data is not Shared Personal Data. As such, this data falls outside of this Agreement and is governed by Vitality’s own Privacy Notice available at: www.vitality.co.uk/privacy
Agreed Terms
1. Interpretation
The following definitions and rules of interpretation apply in these terms and conditions (the “Agreement”).
1.1 Definitions: For the purposes of these this Agreement:
“Agreed Purposes” means the setting up, management and administration of private medical insurance pursuant to the Client’s Plan to the Client’s Employees and Employee Dependents;
“Client” shall mean the party which discloses Shared Personal Data to Vitality;
“Data Controller” means any party insofar as they are acting as a controller within the meaning of applied GDPR Art 4.7;
“Data Discloser” means the Client who agrees to share the Shared Personal Data with the Data Receiver;
“Data Receiver” means Vitality who agrees to use the Personal Data on the terms set out in this Agreement;
“Dependent” mean the husband, wife, partner or any dependent child of an Employee where added to the Plan by the Group Secretary;
“Employee” shall mean each individual with the benefit of private medical insurance cover under the Plan. “Personal data”, “Special Categories of data/Sensitive Data”,
“Group Secretary” means the person in control of the Client’s Plan;
“Plan” means the private medical insurance scheme underwritten by Vitality;
“Process/processing”, “Controller”, “Processor”, “Data Subject” and
“Supervisory Authority” shall have the same meaning as in the UK Data Protection Act 2018. For the purposes of this Agreement references to a “data subject” shall mean the Client’s Employees/Employee Dependents;
“Shared Personal Data” means the personal data to be shared between the parties, as further outlined at clause 2.4;
“UK Data Protection Laws”, all applicable data protection and privacy laws in force from time to time in the UK, including the UK General Data Protection Regulation, the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.
2. Purpose
2.1 This Agreement sets out the framework for the sharing of Shared Personal Data between the parties as independent Data Controllers.
2.2 The parties consider this data sharing initiative necessary as part of the provision of private medical insurance. The aim of the data sharing initiative is to make it easier for the Clients Employees and/or Dependents to get healthier and reward them when they do. It will serve to benefit the Client, Employees and/or Dependents of the Client’s Plan.
2.3 Each party acknowledges and agrees that:
a. The Client will regularly disclose to Vitality the Shared Personal Data collected by the Client for the Agreed Purposes;
b. Vitality provides private medical insurance directly to each of the Client’s individual Employees and any Employee Dependants who qualify for cover under the Client’s Plan. Accordingly Vitality determines the ways and means of its processing of the Shared Personal Data and does not act on the instructions of the Client in relation to the processing of the Shared Personal Data.
2.4 The following types of Shared Personal Data will be shared between the parties during the term of this agreement:
a. Name
b. Date of Birth
c. Designation
d. Email contact details
e. Address
f. Telephone number
Special categories of Personal Data will not be shared between the parties.
3. Lawful, fair and transparent processing
3.1 Each party shall ensure that it processes the Shared Personal Data fairly and lawfully in accordance with clause 3.2.
3.2 Each party shall ensure that it has legitimate grounds under the Data Protection Laws for the processing of Shared Personal Data.
3.3 The Data Discloser shall, in respect of Shared Personal Data, ensure that it provides clear and sufficient information to the data subjects, in accordance with the Data Protection laws, of the purposes for which it will process their personal data, the legal basis for such purposes and such other information as is required by Article 13 of the applied GDPR including:
a. if Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the data subject to understand the purpose and risks of such transfer; and
b. if Shared Personal Data will be transferred outside the EEA pursuant to clause 0 of this Agreement, that fact and sufficient information about such transfer, the purpose of such transfer and the safeguards put in place by the controller to enable the data subject to understand the purpose and risks of such transfer.]
3.4 The Data Receiver undertakes to inform the Data Subjects, in accordance with the Data Protection laws, of the purposes for which it will process their personal data, the legal basis for such purposes and such other information as is required by Article 14 of the applied GDPR including:
a. if Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the data subject to understand the purpose and risks of such transfer; and
b. if Shared Personal Data will be transferred outside the EEA pursuant to clause 0 of this Agreement, that fact and sufficient information about such transfer, the purpose of such transfer and the safeguards put in place by the controller to enable the data subject to understand the purpose and risks of such transfer. This information is contained in our privacy notice www.vitality.co.uk/privacy
4. Rights of Data Subjects
4.1 Each party agrees to have processes in place to comply with requests from Data Subjects to exercise their rights under the Data Protection Laws within the time limits imposed by the Data Protection Laws.
5. Data Retention and Deletion
5.1 The Data Receiver shall not retain or process Shared Personal Data for longer than is necessary to carry out the Agreed Purposes.
5.2 Notwithstanding clause 5.1, the parties shall continue to retain Shared Personal Data in accordance with any statutory or professional retention periods applicable in their respective countries and/or industry.
5.3 The Data Receiver shall ensure that any Shared Personal Data are destroyed in accordance with its deletion procedure in the following circumstances:
a. on termination of this Agreement;
b. on expiry of the Term of this Agreement;
c. once processing of the Shared Personal Data is no longer necessary for the purposes it was originally shared for.
6. Transfers
6.1 For the purposes of this clause, transfers of personal data shall mean any sharing of Shared Personal Data by the Data Receiver with a third party, and shall include, but is not limited to, the following:
a. subcontracting the processing of Shared Personal Data;
b. granting a third party controller access to the Shared Personal Data.
6.2 If the Data Receiver appoints a third party processor to process the Shared Personal Data it shall comply with Article 28 and Article 30 of the applied GDPR.
6.3 The Data Receiver may not transfer Shared Personal Data to a third party located outside the EEA unless it:
a. complies with the provisions of Articles 26 of the applied GDPR (in the event the third party is a joint controller); and
b. ensures that:
i. the transfer is to a country approved by the European Commission as providing adequate protection pursuant to Article 45 of the applied GDPR;
ii. there are appropriate safeguards in place pursuant to Article 46 of the applied GDPR; or
iii. one of the derogations for specific situations in Article 49 of the applied GDPR applies to the transfer.
6.4 The Data Receiver is part of the Discovery Group of companies and is owned by Discovery Limited, a financial services firm based in South Africa. As part of this relationship, Discovery undertake a number of business processes on behalf of the Data Receiver. Such processes include underwriting and claims administration services. The delivery of such services requires the Data Receiver to share data relating to its customers with Discovery and is undertaken in accordance with Article 46 of the applied GDPR.
7. Security and training
7.1 The parties undertake to have in place appropriate technical and organisational security measures to:
a) prevent:
i. unauthorised or unlawful processing of the Shared Personal Data; and
ii. the accidental loss or destruction of, or damage to, the Shared Personal Data;
b) ensure a level of security appropriate to:
i. the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage; and
ii. the nature of the Shared Personal Data to be protected.
7.2 It is the responsibility of each party to ensure that
(i) its staff members are appropriately trained to handle and process the Shared Personal Data in accordance with the technical and organisational security of that party together with any other applicable national data protection laws and guidance and
(ii) have entered into confidentiality agreements relating to the processing of personal data.
8 Personal data Breaches and reporting procedures.
8.1 The parties shall each comply with its obligation to report a Personal Data Breach to the appropriate Supervisory Authority and (where applicable) data subjects in accordance with Article 33 of the applied GDPR.
8.2 Where appropriate Vitality will provide all reasonable information to the Client to enable them to manage their employee expectations, and will aim to do so within 72 hours, to ensure that any actions do not prejudice any internal investigations or those by the police/Regulator.
9. Resolution of disputes with data subjects or the Supervisory Authority.
9.1 In the event of a dispute or claim brought by a data subject or the Supervisory Authority concerning the processing of Shared Personal Data against either or both parties, the parties will inform each other about any such disputes or claims, where appropriate, and will cooperate with a view to settling them amicably in a timely fashion.
9.2 The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the Supervisory Authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.
9.3 Each party shall abide by a decision of a competent court of the Data Receiver's country of establishment or of the Supervisory Authority.
10. Warranties
10.1 Each party warrants and undertakes that it will:
a. Process the Shared Personal Data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments that apply to its personal data processing operations.
b. Make available on request to the data subjects who are third party beneficiaries a copy of this Agreement, unless the Agreement contains confidential information.
c. Respond within a reasonable time and as far as reasonably possible to enquiries from the relevant Supervisory Authority in relation to the Shared Personal Data.
d. Respond to Subject Access Requests in accordance with the Data Protection Law.
e. Where applicable, pay the appropriate fees with all relevant Supervisory Authorities to process all Shared Personal Data for the Agreed Purpose.
f. Take all appropriate steps to ensure compliance with the security measures set out in clause 0 above.
10.2 The Data Discloser warrants and undertakes that it is entitled to provide the Shared Personal Data to the Data Receiver and it will ensure that the Shared Personal Data are accurate.
10.3 The Data Receiver warrants and undertakes that it will not disclose or transfer Shared Personal Data outside the EEA unless it complies with the obligations set out in clause 6.
10.4 Except as expressly stated in this Agreement, all warranties, conditions and terms, whether express or implied by statute, common law or otherwise are hereby excluded to the extent permitted by law.
11 Indemnity
11.1 The Data Discloser and Data Receiver undertake to indemnify each other and hold each other harmless from any cost, charge, damages, expense or loss which they cause each other as a result of their breach of any of the provisions of this Agreement, except to the extent that any such liability is excluded under clause 12.2.
11.2 Indemnification hereunder is contingent upon:
a. the party(ies) to be indemnified (the “indemnified party(ies)”) promptly notifying the other party(ies) (the “indemnifying party(ies)”) of a claim,
b. the indemnifying party(ies) having sole control of the defence and settlement of any such claim, and
c. the indemnified party(ies) providing reasonable co-operation and assistance to the indemnifying party(ies) in defence of such claim.
12. Limitation of liability
12.1 Neither party excludes or limits liability to the other party for:
a. fraud or fraudulent misrepresentation;
b. death or personal injury caused by negligence;
c. a breach of any obligations implied by section 12 of the Sale of Goods Act 1979 or section 2 of the Supply of Goods and Services Act 1982; or
d. any matter for which it would be unlawful for the parties to exclude liability.
12.2 Subject to clause 12.1 neither party shall in any circumstances be liable whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, for:
a. any loss (whether direct or indirect) of profits, business, business opportunities, revenue, turnover, reputation or goodwill;
b. loss (whether direct or indirect) of anticipated savings or wasted expenditure (including management time); or
c. any loss or liability (whether direct or indirect) under or in relation to any other contract.
12.3 Clause 12.2 shall not prevent claims, for:
a. direct financial loss that are not excluded under any of the categories set out in clause 12.2 (a); or
b. tangible property or physical damage.
13. Third party rights
13.1 Except as expressly provided in clause 4 (data subjects rights) a person who is not a party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.
13.2 The rights of the parties to terminate, rescind or agree any variation, waiver or settlement under this Agreement are not subject to the consent of any other person.
14. Direct marketing
14.2 If the Data Receiver processes the Shared Personal Data for the purposes of direct marketing, each party shall ensure that:
a. the appropriate level consent has been obtained from the relevant data subjects to allow the Shared Personal Data to be used for the purposes of direct marketing in compliance with the Data Protection Law; and
b. effective procedures are in place to allow the data subject to "opt-out" from having their Shared Personal Data used for such direct marketing purposes.
15. Variation
15.1 No variation of this Agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).
16. Waiver
16.1 No failure or delay by a party to exercise any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.
17. Severance
17.1 If any provision or part-provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of this agreement.
17.2 If any provision or part-provision of this agreement is deemed deleted under clause 17.1, the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
18. Changes to the applicable law
18.1 If during the duration of this Agreement the Data Protection Law changes in a way that this Agreement is no longer adequate for the purpose of governing lawful data sharing exercises, the parties agree that the parties will negotiate in good faith to review the Agreement in the light of the new laws.
19. No partnership or agency
19.1 Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between any of the parties, constitute any party the agent of another party, or authorise any party to make or enter into any commitments for or on behalf of any other party.
19.2 Each party confirms it is acting on its own behalf and not for the benefit of any other person.
20. Entire agreement
20.1 This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.
20.2 Each party acknowledges that in entering into this Agreement it does not rely on, and shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Agreement.
20.3 Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misrepresentation based on any statement in this Agreement.
21 Further assurance
21.1 At its own expense, each party shall, and shall use all reasonable endeavours to procure that any necessary third party shall, promptly execute and deliver such documents and perform such acts as may reasonably be required for the purpose of giving full effect to this Agreement.
How we use their personal information
If you have a service with us or you are considering getting a service with us, we collect information about you to keep your profile up-to-date where you have an account with us.
We only collect information that is relevant and necessary for us to provide the services and to provide you with rewards, discounts, offers or other benefits.
If you contact us by telephone, we may record calls for training and monitoring purposes to help improve our service and to detect and prevent fraud.
We only collect information that is relevant and necessary for us to provide the services and to provide you with rewards, discounts, offers or other benefits.
If you contact us by telephone, we may record calls for training and monitoring purposes to help improve our service and to detect and prevent fraud.
What type of information do we collect?
Personal information provided by you or your employer:
- Name
- Address
- Contact details
- Date of birth
- Joining date
- Reporting classifications (e.g. which department you are in)
- Leave data (if relevant)
- Your employee ID Number, and
- Activation code, and
- Vitality Health/Life number (if applicable)
- Questionnaires (about your health and wellbeing)
- Devices and wearable’s
- Data of birth
- Post Code; and
- An authorisation token allocated to you.
- Payment details
- Transactions and payments made for your plan.
- Health information including medical conditions and your doctor/hospital details.
| Why do we use your information | Our lawful bases for processing | Our legitimate business interest, where applicable | Indicative retention period |
|---|---|---|---|
| To provide you with a quote. Assessing your application for insurance and, if we can, the price and other terms we can offer. | Personal Information:
|
To price our products based on your insurance risk and to set plan acceptance parameters to determine when we want to insure certain risks. |
13 months if no other Vitality relationship exists. |
To administer and manage your plan
|
Personal Information:
|
|
7 years from end of the last active plan across Vitality Group as per standards. |
To handle claims made against an insurance plan
|
Personal Information:
|
|
7 years from end of the last active plan across Vitality Group as per standards. |
To resolve any complaints you may have
|
Personal Information:
|
|
3 years from date of closure. 5 years for investment complaints. |
To recover any debt that you owe to us
|
Personal Information:
|
|
7 years after debt recovered or end of plan whichever is longer. |
To prevent, detect and investigate fraud or money laundering
|
Personal Information:
|
|
Civil cases & criminal cases: 6 years
On sentence 3 years after length of sentence. |
For management information purposes and internal analysis of products and services
|
Personal Information:
|
|
7 years after which personal data removed. |
| Management Reports to Corporate Entities on employee engagement. | Aggregated data only: No Personal Information.
|
To provide Corporate clients insight into employee engagement with service. | Indefinite. |
For training purposes to improve your customer experience
|
Personal Information:
|
|
Call recordings 3 years. |
Fraud prevention and detection
Applying for a quote, holding an insurance plan with us and making a claim: In certain circumstances, where we suspect fraudulent behaviour, we will carry out checks with fraud prevention agencies and databases. We also conduct searches with publicly available sources of information including internet searches and social media searches.
If we suspect fraudulent behaviour, we may not offer you insurance, we may void your plan or we may not be able to accept your claim. We investigate potentially fraudulent claims and where appropriate, we will use surveillance to assist our investigation. We appoint fraud investigation and surveillance suppliers to conduct these investigations on our behalf.
We will keep a record of individuals and any associated investigations to prevent and detect future fraud or money laundering.
Fraud prevention agencies and databases: When we check your details against fraud prevention agencies and databases, we will use a range of databases and agencies including other insurers' databases. If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies, fraud databases and other insurers. Law enforcement agencies may access and use this information.
We access and use the information recorded by fraud prevention agencies or fraud databases to prevent fraud and money laundering. These checks are done to identify, predict, investigate and evaluate potentially fraudulent behaviour.
We use the following fraud prevention agencies and databases:
- CIFAS (National Fraud Database)
- CUE (Claims and Underwriting Exchange)
- IFB (Insurance Fraud Bureau)
- IFIG (Insurance Fraud Investigators Group)
- IFED (Insurance Fraud Enforcement Agency)
- IFR (Insurance Fraud Register)
- NFIB (National Fraud Intelligence Bureau)
- NCA (National Crime Agency)
- OFSI (Office of Financial Sanctions Implementation)
- LexisNexis
Automated Decisions
Some of our reasons for processing will involve automated decision making. These decisions are set out below. You have a right to obtain human intervention for any of our automated decisions. If you object to an automated decision, we may not be able to offer you an insurance quotation or renewal.
Offering an insurance plan and pricing: We ask you a series of questions when you obtain a quote for insurance from us. This is so we can understand the insurance risk that we are being asked to consider and make an underwriting assessment and decision. The information you provide along with other information helps us to decide whether we can offer you a quote and the price you will need to pay for insurance.
We use lots of factors to assess whether we can provide insurance cover, the price of your plan and any other terms of your plan. These factors include, but are not limited to, your age, your health/lifestyle, your geographical location, claims history, the past performance of the insurance product, etc.
Based on this information, an automated decision will be produced on acceptability of cover, the price you will need to pay for your plan and any other terms we need to apply.
Offering an insurance plan and pricing: We ask you a series of questions when you obtain a quote for insurance from us. This is so we can understand the insurance risk that we are being asked to consider and make an underwriting assessment and decision. The information you provide along with other information helps us to decide whether we can offer you a quote and the price you will need to pay for insurance.
We use lots of factors to assess whether we can provide insurance cover, the price of your plan and any other terms of your plan. These factors include, but are not limited to, your age, your health/lifestyle, your geographical location, claims history, the past performance of the insurance product, etc.
Based on this information, an automated decision will be produced on acceptability of cover, the price you will need to pay for your plan and any other terms we need to apply.
How we share their information
In order to sell, manage and provide our products and services, prevent fraud and comply with legal and regulatory requirements, we may need to share your information with third parties, including:
Our re-insurers
Re-insurance is insurance that is purchased by an insurance company. It allows insurance companies to remain solvent after major claims events and is sometimes used for tax mitigation and other reasons.
We may need to share your personal health or medical data provided by you with our re-insurers in order for them to do the following:
Our auditors (for management information purposes)
Vitality will only share your personal data with other companies or organisations where there is a legitimate reason for doing so. For example we are obligated to provide information to specific Government departments such as HM Revenue and Customs and to regulatory bodies who govern our activity such as:
We may also share your personal data where we conduct further investigations with law enforcement and fraud prevention agencies and databases, our regulators (such as the FCA, PRA and ICO) as well as other insurers, to facilitate the prevention and detection of fraud or crime.
Fraud prevention agencies
Crime prevention agencies, including the police
Sharing your personal data with your authorised representative
If you have appointed an insurance or financial adviser, we may send them copies of correspondence relating to the plan and any renewal documentation. We may disclose information to them if you have made a claim although no medical information will be provided without your consent.
Please be sure to tell us if you authorise a new representative so that we are able to only send your personal data to the right representative so that we send your personal data to the right person.
Our use of other companies to provide our products and services to you
To assist us in the provision of administration, services or benefits for your plan and any claims you make, we use other companies who work under contracts with us. We ensure that the level of security and the quality of service provided by those other companies is equivalent to the standard of services we provide to you.
We need to advise you that as part of the application process we will share your data with credit reference agencies for security purposes. This check (known as a “soft search” or “quotation search”) will not affect your credit score or be visible to lenders.
Some of the companies who work under contracts with us are located in countries outside of the European Economic Area. Where this is the case we transfer your personal data to them on terms that are approved by the Information Commissioner. This is to ensure the appropriate security for your information, both in the transfer stage and when it is processed, and that your rights and confidentiality are protected in the same way as they would be if your personal data was processed in the UK.
Please click here to see the list of other companies who assist us in the provision of administration services.
Sharing your personal data with benefit providers
The Vitality group’s products are designed to enable you to accrue points related to your fitness and this in turn enables you to access a number of rewards and benefits. The exchange of your personal data, health and medical information will only occur with your consent and only with the benefit providers you choose to engage with.
The full list of benefit and reward providers can be found here.
Vitality Group
Our re-insurers
Re-insurance is insurance that is purchased by an insurance company. It allows insurance companies to remain solvent after major claims events and is sometimes used for tax mitigation and other reasons.
We may need to share your personal health or medical data provided by you with our re-insurers in order for them to do the following:
- to analyse key demographic information;
- to analyse patterns of claims by customers and their claims experiences;
- to analyse the risk they are reinsuring and to set a price for the re-insurance with Vitality;
- to determine the validity of a claim; and
- to set approval limits for claims and underwriting.
Our auditors (for management information purposes)
Vitality will only share your personal data with other companies or organisations where there is a legitimate reason for doing so. For example we are obligated to provide information to specific Government departments such as HM Revenue and Customs and to regulatory bodies who govern our activity such as:
- Information Commissioner’s Office (ICO)
- Financial Conduct Authority (FCA)
- Prudential Regulation Authority (PRA)
- Financial Ombudsman Service (FOS)
We may also share your personal data where we conduct further investigations with law enforcement and fraud prevention agencies and databases, our regulators (such as the FCA, PRA and ICO) as well as other insurers, to facilitate the prevention and detection of fraud or crime.
Fraud prevention agencies
Crime prevention agencies, including the police
Sharing your personal data with your authorised representative
If you have appointed an insurance or financial adviser, we may send them copies of correspondence relating to the plan and any renewal documentation. We may disclose information to them if you have made a claim although no medical information will be provided without your consent.
Please be sure to tell us if you authorise a new representative so that we are able to only send your personal data to the right representative so that we send your personal data to the right person.
Our use of other companies to provide our products and services to you
To assist us in the provision of administration, services or benefits for your plan and any claims you make, we use other companies who work under contracts with us. We ensure that the level of security and the quality of service provided by those other companies is equivalent to the standard of services we provide to you.
We need to advise you that as part of the application process we will share your data with credit reference agencies for security purposes. This check (known as a “soft search” or “quotation search”) will not affect your credit score or be visible to lenders.
Some of the companies who work under contracts with us are located in countries outside of the European Economic Area. Where this is the case we transfer your personal data to them on terms that are approved by the Information Commissioner. This is to ensure the appropriate security for your information, both in the transfer stage and when it is processed, and that your rights and confidentiality are protected in the same way as they would be if your personal data was processed in the UK.
Please click here to see the list of other companies who assist us in the provision of administration services.
Sharing your personal data with benefit providers
The Vitality group’s products are designed to enable you to accrue points related to your fitness and this in turn enables you to access a number of rewards and benefits. The exchange of your personal data, health and medical information will only occur with your consent and only with the benefit providers you choose to engage with.
The full list of benefit and reward providers can be found here.
Vitality Group
Marketing
Your personal data may be used by Vitality to ensure the marketing it sends you is relevant and tailored to you.
International Transfers
We have detailed third parties that we share your information with in the ‘How we share your information’ section. Some of these third parties may be in countries outside of the European Economic Area (EEA).
Under data protection law, when personal information is being transferred outside the EEA, we as data controller, are under an obligation to ensure that such transfers are performed in a manner that ensures that your personal information is adequately protected.
In the event that we transfer your personal information outside of the EEA, we will always put in place adequate safeguards to ensure that your personal information is protected. Adequate safeguards may include placing contractual obligations on the third party that we are transferring your information to or ensuring that the third party is certified to the EU-US Privacy Shield Framework, if we are making transfers to third parties located in the United States.
Under data protection law, when personal information is being transferred outside the EEA, we as data controller, are under an obligation to ensure that such transfers are performed in a manner that ensures that your personal information is adequately protected.
In the event that we transfer your personal information outside of the EEA, we will always put in place adequate safeguards to ensure that your personal information is protected. Adequate safeguards may include placing contractual obligations on the third party that we are transferring your information to or ensuring that the third party is certified to the EU-US Privacy Shield Framework, if we are making transfers to third parties located in the United States.
How long we keep your information for
We only keep your information for as long as is necessary in line with the purposes for which we collected your information. We have set out in our general retention schedule below however in certain circumstances it will be necessary for us to keep your information for longer, for example when we are required to due to legal obligations or to defend or manage legal claims.
In most cases, we will keep your information for 7 years from the expiry date of your entitlement to Healthy Workplace access ends, after which it will be deleted or anonymised.
If we suspect, detect or investigate fraud or money laundering, information will be held on a case by case basis for up to 7 years.
In most cases, we will keep your information for 7 years from the expiry date of your entitlement to Healthy Workplace access ends, after which it will be deleted or anonymised.
If we suspect, detect or investigate fraud or money laundering, information will be held on a case by case basis for up to 7 years.
Your rights
Data protection laws give you certain rights. For details of your data protection rights rights please click here.
How to contact us
We have appointed a Data Protection Officer who is responsible for overseeing how we handle your information. If you have any questions about our Privacy Notice or the information we hold about you, please contact them data.protection@Vitality.co.uk
In the first instance we would ask that you notify us of any concerns you have about how we handle your data but if you are still unhappy then you can contact the Information Commissioners Office https://ico.org.uk/global/contact-us/
In the first instance we would ask that you notify us of any concerns you have about how we handle your data but if you are still unhappy then you can contact the Information Commissioners Office https://ico.org.uk/global/contact-us/
Changes to this Privacy Policy
We reserve the right to update this Privacy Policy from time to time. Such changes may be necessary, for example, due to changes or developments in data protection laws, privacy best practice or the introduction of new technologies. You should check our website periodically to view the most up-to-date Privacy Policy. This Privacy Policy was last updated on 01/04/2021.