Privacy Notice for Third Parties

1. Purpose: This Notice describes how we collect and use personal data about you, during and after your working relationship with us, in accordance with the General Data Protection Regulation (GDPR).

2. Applicability: This Notice applies to all third parties involved in an accident/incident. This Notice does not form part of any contract to provide services. We may update this Notice at any time, subsequent to which, a copy of the updated Notice will be furnished to every third party at the earliest.

3. Relationship and Purpose of Processing Data: WNSA is responsible for deciding how we hold, use and process your personal data. As a service provider, we need to keep and process data about you for accidental claims purposes including incident creation process, credit hire process, sales and marketing, financial and loss capturing process, administration of operational activities, administration of information systems, meeting legal obligations, compliance requirements and other legal and customary business purposes and for providing legal assistance. Processing will include collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, and use, disclosure by transmission, erasure or destruction of your personal data. The data we hold and process will be used for management, operational and administrative purposes only. We will keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately, whilst you are associated with us, at the time when your association ends and after you have left us. This includes using data to enable us to comply with the service requirements and pursue our legitimate interests, protect our workforce and stakeholders against injury, theft, legal liability, fraud, abuse and protect our legal position in the event of legal proceedings and compliance including compliance with government authority requests for information, liens and management compliances. If you do not provide this data or request for the deletion of data we may be unable in some circumstances to comply with our legal obligations and we will tell you about the implications of that decision.

4. Personal data we will process about you:

WNSA may process the following categories of personal data about you:

• Personal details including name, title, addresses, post code, telephone numbers, mobile number, personal/corporate email addresses, date and place of birth, gender, age, insurance policy details, occupation, signatures etc.;
• Accident details including vehicle registration number, repairer’s details etc.;
• Financial information including bank account holder’s name, bank account number, bank name and address, bank sort code, claims settlement amount.

We may also process the following “special categories” of data, wherever applicable in accordance with the laws and requirements of each jurisdictions:

• Medical Information including injury details.

5. How is your personal data collected

WNSA collects personal data about third party through application, forms and calls directly from the third party or sometimes indirectly from other sources including the customer, any witness, etc. We will collect additional personal data in the course of claim-related activities throughout the period you are associated for us. All data collected during the claims process or additional data collected during this course will be used and stored for rendering service as well as for complying with the legal obligations or legitimate interests of WNSA.

6. How will we use personal data about you/Our basis of processing

WNSA will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the services that we have agreed to provide to our customers
• Where we need to comply with a legal obligation
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• Where we need to protect your interests (or someone else’s interests)
• Where it is needed in the public interest (or for official purposes)
• Where we have sought your explicit consent

7. If you fail to provide personal data

If you fail to provide certain data when requested, we may not be able to render the required services to you, or we may be prevented from complying with our legal obligations.

8. Change of purpose

WNSA will only use your personal data for the purposes for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so without undue delay. Please note, that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9. Special categories of data

Special categories of data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data in accordance with Articles 6 and 9 of GDPR. We may process special categories of data in the following circumstances:

• Where processing is necessary for the performance of agreement to which you are a party;
• Where processing is necessary for the purpose of legitimate interest pursued by WNSA or third party with appropriate safeguards;
• Less commonly, we may process this type of data where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public;
• Where processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

10. Data sharing

WNSA will share your personal/special categories of data with the following recipients:

• Third parties with whom we have a contractual relationship, including car rental vendors, garage vendors, motor claim vendors, law firm, medical vendors, sales and marketing vendors, data shredding agency, etc. We require third parties to respect the security of your data and to treat it in accordance with our instructions and as per the law.
• Other WNS entities for internal administrative purposes. We may transfer your personal data outside the EU for processing in accordance with the Standard Contractual Clauses executed between Controller Entity and WNS Global Services Private Limited (India).

11. Transferring personal data outside the EU

WNSA will transfer the personal data that it collects about you to internal group companies located in India, outside the EU, for the purpose of legitimate interests, performance of service and internal administration.

However, to ensure that your personal data does receive an adequate level of protection, we have executed Standard Contractual Clauses with WNS Global Services Private Limited (India) to ensure that your personal data is treated by those WNS entities in a way that is consistent with and which respects the EU and regional laws on data protection.

12. Data security

WNSA has put in place measures to protect the security of your data.

Third parties will only process your personal data on our instructions and where they have agreed to treat the data confidentially and to keep it secure. We do enter into specific agreements with such third parties to ensure compliance.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

13. Data retention

WNSA will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal requirements.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such data without further Notice to you. Once you are no longer associated with the company we will retain and securely destroy your personal data in accordance with [our Data Retention Policy OR applicable laws and regulations].

14. Data Controllers

The following is the list of Data Controllers across WNSA entities which are involved in the processing of your personal data. Depending on the location, any one of the following will act as Data Controller/Joint Controller for the personal data that is being processed by WNSA:

15. Data Protection Officer

WNSA have appointed a Data Protection Officer (DPO) to oversee compliance with this Notice. If you have any questions about this Notice or how we handle your personal data, please contact the DPO at privacy@wns.com. You have the right to make a complaint at any time to the regional supervisory authority for data protection issues.

16. Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

17. Rights Available to you

Your rights in connection with personal data: Under certain circumstances, by law, you have the:

• Right of Access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you.
• Right to Rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Right to be Informed about the collection and use of personal data.
• Right to be Forgotten will enable you to ask us to delete or remove personal data which we process about you subject to limited circumstances in accordance with the GDPR requirements.
• Right to Object to Processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the Restriction of Processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Right of Data Portability/Transfer to another party.
• Right to Withdraw Consent for processing of personal data where explicit consent has been In the limited circumstances, where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please DPO at privacy@wns.com. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
• Right Related to Automated Decision Making Including Profiling. You will have a right not to be subjected to a decision based solely on automated processing including profiling. Such decisions can be made only if, they are necessary for the entry into or performance of a contract or authorized by the Union or member state law applicable to WNSA or based on your explicit consent.

All the above-mentioned rights can be exercised by contacting the DPO at privacy@wns.com.

18. No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you have any questions about this Notice, please contact DPO at privacy@wns.com.