Employee Data Privacy Notice

Chubb Underwriting (DIFC) Limited ("Chubb", "we", "us") values its employees and respects and protects their privacy.

This employee data privacy notice ("Notice") sets out the types of information that Chubb collects about you, the purposes for which it is collected, the basis on which we process it and how Chubb handles your personal data. It is intended to comply with our obligations to provide you with information about Chubb's processing of your personal data under applicable privacy laws.

This Notice principally applies to current employees even after the end of their employment but, where relevant, it also applies to workers, job applicants, interns, agency workers, consultants directors, and third parties whose information is provided to us in connection with the employment or work relationship (for example, referees or emergency contact information). Where we use the term employee or employment then for the purpose of this notice that includes those who work for us on a basis other than employment to the extent it is relevant, but this does not in any way indicate that the individual is an employee of Chubb.

This Notice does not form part of any contract of employment and does not confer any contractual right on you, or place any contractual obligation on us. We may update or otherwise amend this Notice at any time.

If you have any questions regarding the processing of your personal data or if you believe your privacy rights have been violated, please contact dataprotectionoffice.europe@chubb.com.If you are aware of an unauthorised disclosure of data, please also refer this to us for guidance as to the applicable reporting requirements.

Overview

Chubb collects and uses personal details which you provide as part of the recruitment and on boarding processes, together with additional personal data collected throughout the course of your employment or engagement (for instance, in relation to performance reviews, disciplinary processes and participation in voluntary benefit schemes).

The personal data Chubb collects is used primarily for the recruitment process, onboarding employees, managing the workforce and complying with contracts of employment. The data may be stored in systems based around the world, and may be processed by third party service providers acting on Chubb's behalf.

We need your data in order to commence, perform and terminate your employment and for performing the related contractual or statutory obligations. Without this data we will not be able to enter into a contract with you or to perform our obligations under such contract.

It is our policy to comply with our obligations under the DIFC Data Protection Law No.5 of 2020 ("DIFC DP Law") and all other applicable local legislation. But you also have an important role to play in protecting the security of personal data, and you should be careful to whom you disclose personal data, and how you protect your communications and devices. Chubb has in place a robust Information Security Framework which is aligned to industry best practice and compliant with applicable legal and regulatory requirements. This framework includes ongoing information security architecture and engineering, security operations, identity and access management, incident management, promoting awareness of risks and security controls, and monitoring compliance to those controls. Please refer to the Chubb Global Information Security Policy (https://village.chubb.com/docs/DOC- 115912) and the Global Information Security and Privacy Policy and Guidelines (https://village.chubb.com/groups/ispp) for more information about your responsibilities.

You also have certain rights in respect of your personal data, which you can exercise by contacting us using the contact details below.

Email: dataprotectionoffice.europe@chubb.com Write to:

Data Protection Officer, Chubb, 100 Leadenhall Street, EC3A 3BP, London

Types of personal data that Chubb processes

"Personal data" refers to information which relates to an identified or identifiable natural person. An identifiable natural person is an individual who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual. Personal data includes, for example, your contact details and your date of birth.

Chubb processes your personal data. In this context, "processing" means dealing with the data in any way, such as using, disclosing or destroying it.

The types of personal data which we process will vary depending on your role, your location and any terms and conditions of employment or engagement relevant to you. Typically the types of personal data will include, for example, your personal and basic work details and details of your remuneration and benefits.

The types of personal data which we process will include, but may not be limited to, the following:

Your Personal Details - for example your name, date of birth, age, gender, personal contact details (including address, telephone number and email), emergency contact/next of kin details, immigration and eligibility to work data and languages spoken, national identify card copy (Emirates ID);
Basic Work Details - for example your work contact details (corporate email address and telephone numbers), employee number / ID, photograph, job title, job description, assigned business unit or group, reporting lines, primary work location, working hours and your terms and conditions of employment;
Professional Qualifications and Regulatory Data - where applicable, including certifications and unique regulatory identifiers;
Recruitment/Selection Data - for example, any personal data contained in your CV, application form, record of interview or interview notes, records of assessments and vetting and verification documentation;
Remuneration and Benefits Data - for example, details of your pay and benefits package, bank account details, grade, and third party benefit recipient information;
Leave Data - for example your holiday and family related leave records;
Incapacity Data - for example, any personal data contained in your absence records, medical forms, reports or certificates and records relating to accommodations or adjustments;
Disciplinary and Grievance Data - for example, any personal data contained in records of allegations, investigations and meeting records and outcomes;
Performance Management Data - for example, colleague and manager feedback, appraisals, outputs from talent programmes and formal and informal performance management processes;
Equality and Diversity Data - where permitted or required under local law, data regarding gender, age, race (where required as part of the UAE visa application process), nationality, religious belief (where required as part of the UAE visa application process) and sexuality (stored anonymously for equal opportunities monitoring purposes);
Training and Development Data - data relating to training and development needs or training received;
Monitoring Data - where permitted under local law, handset details including IMEI number (for company issued devices), identifiable images contained in CCTV footage, system and building login and access records, keystroke, download and print records, call recordings, data caught by IT security programmes and filters;
Health and Safety Data - personal data in audits, risk assessments and incident reports;
Employee Claims, Complaints and Disclosures Data - personal data in the subject matter of employment based litigation and complaints, employee involvement in incident reporting and disclosures;
Termination Data - for example, dates and reason for leaving, termination arrangements and payments, exit interviews and references; and
Any other personal data which you choose to disclose to Chubb personnel during the course of your employment, whether verbally or in written form (for example, on work emails).

Special categories of personal data

To the extent permitted by applicable laws, Chubb may also collect and process a limited amount of personal data falling into special categories. Within this category, Chubb collects and records information relating to health (including details of accommodations and adjustments which are necessary as a result of any disability or health condition) as permitted by applicable laws. Other than to make reasonable adjustments to account for any disabilities or health conditions, we do not ordinarily collect information on any pre-existing illness which you might have. However, in the event that an employee is suffering from a critical illness which could impact their ability to attend work and perform their role, that employee may elect to provide us with certain information in relation to that illness, to enable us to support them and make any necessary arrangements.

We may also process information relating to racial or ethnic origin, only where you provide this to us and as permitted or required by applicable laws.

Sources of personal data

Primarily the personal data we process about you will have been provided by you, either during your application for employment or engagement, the on boarding process, or on an ad hoc basis during the course of your employment or engagement. This will especially include your personal and basic work details as well as equality and diversity data.

When you apply for a role with us, you may initially provide your personal data to our UK head office resourcing team, who would then share your application information with us, only where it relates to a specific role with Chubb in the DIFC and where you have been shortlisted for an interview. Your personal data would then be used by our MENA resourcing team, including our MENA HR Manager. During the interview process, some of your personal data (such as your CV) may also be shared with the team with which you are interviewing for a role.

During the recruitment process, we may request references from third parties, and carry out screening and vetting processes using third party sources. We carry out such screening and vetting processes only to the extent permitted by applicable laws. These may include reference checks, credit checks, sanctions checks, regulatory references and directorships.

We also receive information which may include your personal data from your line manager (for example, in respect of performance reviews) or, from time to time, from other managers or colleagues (for instance, in the course of conducting an investigation).

We may also receive personal data about you from other third parties, for example clients, tax authorities, benefit providers, brokers and regulatory bodies to the extent permitted by applicable laws.

In some circumstances, data may be collected indirectly from monitoring devices or by other means (for example, building and location access control and monitoring systems, telephone logs and recordings and email and Internet access logs), if and to the extent permitted by applicable laws. In these circumstances, the data may be collected by Chubb or a third party provider of the relevant service. This type of data is generally not accessed on a routine basis but access is possible. Access may occur, for instance, in situations where Chubb is investigating possible violations of Chubb policies such as those relating to travel and expense reimbursement, use of the Internet, or employees conduct generally, or where the data are needed for compliance purposes. More frequent access to such data may occur incidental to an email surveillance program, if and to the extent permitted by applicable laws. Chubb will not use any such collected data for any purpose other than explicitly stated in this Notice.

Where we ask you to provide personal data to us on a mandatory basis, we will inform you of this at the time of collection and in the event that particular information is required by the contract or statute this will be indicated. Failure to provide any mandatory information will mean that we cannot carry out certain HR processes. For example, if you do not provide us with your bank details, we will not be able to pay you. In some cases, it may mean that we are unable to continue with your employment or engagement as Chubb will not have the personal data we believe to be necessary for the effective and efficient administration and management of our relationship with you.

Apart from personal data relating to yourself, you may also provide Chubb with personal data of other third parties, notably your referees, dependents and other family members or friends, for purposes of HR administration and management, including employment verification, the administration of benefits and to contact your next of kin in an emergency. Before you provide such third party personal data to Chubb you must first inform these third parties of any such data which you intend to provide to Chubb and of the processing to be carried out by Chubb, as detailed in this Notice.

Please contact us if you have any questions regarding the source of your personal data or would like more detail than is set out in this Notice.

Purposes of Processing

Your personal data is collected and processed for various business purposes, in accordance with applicable laws and any applicable collective bargaining agreements. Data may occasionally be used for purposes not obvious to you where the circumstances warrant such use (e.g. in investigation or disciplinary proceedings).

Where applicable data protection laws require us to process your personal data on the basis of a specific lawful justification, we generally process your personal data under one of the following bases:

(a) the processing is necessary for the legitimate interests pursued by Chubb (being those purposes described in the section below), except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (DIFC DP Law, Article 10.1(f));

(b) the processing is necessary for compliance with a legal obligation to which Chubb is subject (DIFC DP Law Article 10.1(c)); or

(c) the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract (DIFC DP Law Article 1.1(b)).

We may on occasion process your personal data for the purpose of the legitimate interests pursued by a third party (DIFC DP Law Article 10.1(f)), except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Where this is the case, this is set out in this Notice or will be communicated to you prior to such processing taking place as appropriate.

We process your personal data for recruitment decisions, the performance of the employment contract and the termination of the employment relationship. These purposes each relate to a lawful basis for processing, as required under applicable law. These purposes include:

Purpose for processing

Lawful basis

(a)

Recruitment and selection

This processing is necessary to take steps at the applicant's request to enter a contract of employment or contract of services.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in fully reviewing and deciding on applications for employment or engagement to ensure that only suitable and appropriate candidates are assessed, shortlisted and selected.

(b)

Appropriate vetting for recruitment and team allocation including, right to work verification, relevant employment or engagement history, relevant regulatory status, academic / education checks and professional qualifications and bringing you on-board and creating an employment record.

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in managing its business operations in the most appropriate and effective way and wishes to maintain its world class reputation and continue to attract and appoint high calibre employees.

(c)

Providing and administering remuneration, benefits (such as participation in our group health insurance policy) and incentive schemes and reimbursement of business costs and expenses;

This processing is necessary to perform the contract between you and Chubb and necessary for compliance with legal obligations.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in managing its workforce and operating its business. This includes ensuring that employees are properly rewarded, remunerated as well as remain engaged for the duration of their employment or engagement.

(d)

General employee management, including:

1. allocating and managing duties and responsibilities and the business activities to which they relate;

2. business travel;

3. employee certification, licensing and regulatory requirements;

4. budgeting, financial review and internal business reporting;

5. planning and allocating work and measuring working hours;

6. maintain emergency contact and beneficiary details;

7. manage health and safety at work and investigate and report on incidents.

This processing is necessary to perform the contract between you and Chubb and, where necessary, for compliance with legal obligations.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in managing its workforce and ensuring that each employee undertakes appropriate duties, are properly trained and undertake their roles correctly and in accordance with appropriate procedures.

(e)

Identifying and communicating effectively with employees and other employees, including managing internal directories to facilitate contact and effective working and communication;

This processing is necessary to perform the contract between you and Chubb.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in undertaking normal business operations and maintaining a dialogue with employees to ensure effective management and job satisfaction.

(f)

Managing and operating appraisal, conduct, performance, capability, behavioural, absence and grievance related reviews, allegations (including those received as part of any whistleblowing/speak-up report), complaints, investigations and processes and other informal and formal HR and legal compliance processes and making related management decisions;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in addressing employee related concerns and issues and resolving the same and complying with applicable laws and regulations.

(g)

Training, development, promotion, career and succession planning and business contingency planning;

This processing is necessary to perform the contract between you and Chubb.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in effective employee management to support its long-term business goals and outcomes to ensure it continues to retain as well as attract high calibre employees.

(h)

Consultations or negotiations with employee representatives;

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

(i)

Processing information about absence or medical information regarding physical or mental health or condition in order to: assess eligibility for incapacity or permanent disability related remuneration or benefits; determine fitness for work; facilitate a return to work; make adjustments or accommodations to duties or the workplace;

make management decisions regarding employment or engagement or continued employment or engagement or redeployment; and conduct related management processes;

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in ensuring that employee undertakes appropriate duties, are properly trained, supported by management and undertake their roles correctly and in accordance with appropriate procedures.

(j)

For planning, managing and carrying out restructuring or redundancies or other change programmes including appropriate consultation, selection, alternative employment searches and related management decisions;

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the

purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in making decisions relating to the future of its business in order to preserve its business operations or grow its business.

(k)

Complying with reference requests where Chubb is named by the individual as a referee;

Chubb considers that it is in the legitimate interests of a new employer to receive confirmation of employment or engagement details from Chubb for the purposes of confirming the former employee's employment or engagement history.

(l)

Operating email, IT, internet, social media, HR related and other company policies and procedures. To the extent permitted by applicable laws, Chubb carries out monitoring of Chubb's IT systems to protect and maintain the integrity of Chubb's IT systems and infrastructure; to ensure compliance with Chubb's IT policies and to locate information through searches where needed for a legitimate business purpose;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in managing its workforce and operating its business through IT systems. The HR IT function is essential to ensuring that this can be carried out in the most effective way.

(m)

Protecting the private, confidential and proprietary information of Chubb, its employees, clients and third parties and protecting the security of our sites, systems, employees and visitors;

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in ensuring that its business, clients, employees and systems are protected. This includes protecting our assets and the integrity of our systems; and detecting and preventing loss of our confidential information and proprietary information.

(n)

Complying with applicable laws and regulations (for example, maternity or parental leave legislation, working time and health and safety legislation, taxation rules, other employment laws and regulations);

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

(o)

Planning, due diligence and implementation in relation to a commercial transaction or service transfer involving Chubb that impacts on your relationship with Chubb for example mergers and acquisitions or a transfer of your employment under applicable automatic transfer rules;

This processing is necessary for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb needs to make decisions relating to the future of its business in order to preserve its business operations or grow its business.

(p)

Provision of information to Chubb's owners, investors, asset managers, lenders for use, review, analysis in their capacity as such or pursuant to performance of contract;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in sharing information with its owners, investors, asset managers and lenders in order for them to be able to carry out the necessary reviews and analyses in their capacities.

(q)

For business operational and reporting documentation such as the preparation of annual reports or tenders for work or client team records, including the use of photographic images;

This processing is necessary to perform the contract between you and Chubb.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in ensuring that each employee undertakes appropriate duties and undertaking normal business operations.

(r)

Where relevant, for publishing appropriate internal or external communications or publicity material (including via social media in appropriate circumstances);

This processing is necessary to perform the contract between you and Chubb.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest to support its long-term business goals and outcomes and Chubb wishes to maintain its world class reputation.

(s)

To support HR administration and management and maintaining and processing general records necessary to manage the employment, employees or other relationship and operate the contract of employment or engagement;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb.

Chubb considers that it has a legitimate interest in effective employee management to support its long-term business goals and outcomes.

(t)

To change access permissions ,including creating IT and building access rights;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb.

Chubb considers that it has a legitimate interest in complying with Chubb policies and access controls.

(u)

To provide technical support , including and maintenance for HR information and other IT systems;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in managing its The HR IT function which is essential.

(v)

To enforce our legal rights and obligations, and for any purposes in connection with any legal claims, reports of violations or allegations made by, against or otherwise involving you;

This processing is necessary for the purpose of the legitimate interests pursued by Chubb. Chubb has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that Chubb's legal rights and interests are protected appropriately, to protect Chubb's reputation and to protect Chubb from other damage or loss.

This processing is also necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

(w)

Make decisions on continuation of employment or engagement and administer terminations;

This processing is necessary to perform the contract between you and Chubb and for the compliance with legal obligations to which Chubb is subject.

This processing is also necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in managing its workforce.

(x)

To comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities;

This processing is necessary for the purpose of the legitimate interests pursued by Chubb. Chubb considers that it has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and to defend itself from litigation.

(y)

Other purposes permitted by applicable laws, including legitimate interests pursued by Chubb where these are not overridden by the interests or fundamental rights and freedoms of employees.

This processing is necessary to comply with our legal obligations.

Please note that this not an exhaustive list and we may process your personal data for other purposes that are consistent with the legal basis on which we process your personal data. Further, additional information regarding specific processing of personal data may be notified to you locally or as set out in applicable policies.

Special categories of personal data

In addition, where we process special categories of personal data, this will always be justified on the basis of an additional lawful condition.

The processing of special categories of personal data (for example, data relating to health, sexual life, sexual orientation, racial or ethnic origin, trade union membership, political opinions or religious or philosophical beliefs) will be justified by one of the following special conditions:

processing is necessary for the purpose of carrying out the obligations and exercising the specific rights of a controller (i.e. Chubb) or a data subject (i.e. You) in the context of your employment, including but not limited to recruitment, visa or work permit processing, the performance of an employment contract, termination of employment, the conduct of proceedings relating to employment and the administration of a pension, retirement or employee money purchase benefit scheme (Article 11 (b) DIFC DP Law);
the processing is voluntary and is carried out subject to your explicit consent for one or more specific purposes (Article 11 (a) DIFC DP Law) (for example if you wish to participate in an additional support programme or benefit related to incapacity or health promotion). If we are relying on consent we will be clear about this and will not rely on consent if there is another relevant lawful condition;
the processing is necessary for the establishment, exercise or defence of legal claims (Article 11 (f) DIFC DP Law) (whether a claim is made by you or a third party);
the processing is necessary for an assessment of your working capacity carried out by a health professional (Article 11(h) DIFC DP Law) (for example, an occupational health report);
in exceptional circumstances, the processing is necessary to protect your vital interests and you are incapable of giving consent (Article 11 (c) DIFC DP Law) (for example in a medical emergency).

This may include the following, although this is not an exhaustive list

	Purpose for processing	Lawful basis
(a)	Assess and review eligibility to work for Chubb in the jurisdiction in which you work;	This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or Chubb in the field of employment and immigration laws, to the extent permissible under applicable laws.
(b)	Compliance with employment, health and safety o and or immigration laws. For example, providing any special category personal data required by local authorities for visa and local ID processing purposes. For example, to provide statutory incapacity or maternity benefits, avoid breaching legal duties to you, to ensure fair and lawful management of your employment, avoid unlawful termination of your employment, to administer Chubb's private medical and long term disability schemes, to make reasonable accommodations or adjustments and avoid unlawful discrimination or dealing with complaints arising in this regard;	This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or Chubb in the field of employment and immigration laws, to the extent permissible or required under applicable laws.
(c)	Management and investigation of any complaint under Chubb's grievance policy (or other relevant policies), where such characteristics or information are relevant to the particular complaint, in order to comply with employment law obligations.	This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or Chubb in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.

We may seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your employment or engagement to agree to any request for consent from Chubb.

Retention of personal data

We only retain employee personal data for as long as is required to satisfy the purpose for which it was collected by us or provided by you. We therefore will retain your personal data as a minimum for the duration of your employment with us.

In certain cases, legal or regulatory obligations (for example in the case of tax related matters) require us to retain specific records for a set period of time, including following the end of your employment.

Any personally identifiable candidate data is removed automatically from our recruitment system after a period of 12 months without any activity on the candidate record. Non-identifiable records will be retained for reporting purposes.

For more information about Chubb's data retention practices, including in respect of employee records and applicants' records, please refer to the Chubb Records Management Policy (https://village.chubb.com/docs/DOC-434025).

Disclosures of personal data

Internally your direct and indirect line managers, HR professionals supporting your work area (both within Chubb DIFC and within the Chubb group as some aspect of Chubb’s HR processes are managed central) and in some cases certain colleagues will have access to some of your personal data where relevant to their role.

We routinely share your personal data with other members of the Chubb group where required in order to, for example, run global processes, carry out group wide reporting, or assist with workforce planning.

Certain basic personal data, such as your name, location, job title, contact information and any published skills and experience profile may also be accessible to other staff.

We may also be required to disclose your personal data to third parties. This will include suppliers which help us provide HR services, tax or other authorities, a regulator or a professional adviser.

Examples of third parties with whom your data may be shared include tax authorities, medical/occupational health professionals, regulatory authorities, law enforcement and regulatory bodies, Chubb's insurers, bankers, IT administrators, lawyers, accountants, data centre providers, doctors or other healthcare providers, auditors, notaries, investors, lenders, training providers, landlords, office access providers, social media and marketing suppliers, consultants and other professional advisors, payroll/tax providers, and administrators of Chubb's benefits programs (including our group health insurance policy). Your personal data is also accessed by third parties whom we work together with in connection with IT services, such as hosting, supporting and maintaining the framework of our information systems.

Chubb expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security. Where these third parties act as a "data processor" (for example, a payroll provider), they carry out their tasks on our behalf and upon our instructions for the above mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.

We may also share limited information with clients where you are part of a client team or proposed team in a tender process.

We use a number of third party suppliers to help us provide HR services. These third parties may have access to or merely host your personal data, but will always do so under our instruction and subject to a contractual relationship.

Some third parties to whom we may provide personal data, for instance private health insurance or occupational health providers or professional advisers or regulators, are data controllers in their own right, and you should refer to their own privacy notices and policies in respect of how they use your personal data.

We may also be required to disclose your personal data to third parties in response to orders or requests from a court, regulators, government agencies, parties to a legal proceeding or public authorities, or to comply with regulatory requirements or as part of a dialogue with a regulator.

Your personal data may also be disclosed to advisors, potential transaction partners or interested third parties in connection with the consideration, negotiation or completion of a corporate transaction or restructuring of the business or assets of any part of the Chubb group.

Please contact us if you have any questions regarding recipients of your personal data or would like more detail than is set out in this Notice.

Cross-border Transfers

The global nature of our business means that your personal data may be disclosed to members of the Chubb group outside of the DIFC, particularly in Europe, the USA and Mauritius. Certain suppliers and service providers may also have personnel or systems located outside of the DIFC (such as, for example, our payroll providers and life and health insurance providers). As a result, your personal data may be transferred to countries outside of the country in which you work to countries whose data protection laws may be less stringent than yours.

In this context, your personal data may be transferred outside the DIFC for the purposes set forth in this Notice, to countries that may not offer a level of protection of personal data equivalent to that offered within the DIFC.

The Chubb group has an intra-group data transfer agreement in place which regulates cross-border transfers of your personal data within the group. Where third parties transfer your personal data outside of the DIFC, we will take steps to ensure that your personal data receives an adequate level of protection, including by, for example, entering into data transfer agreements or by ensuring that third parties are certified under appropriate data protection schemes.

You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used by contacting us. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity.

Data Subject Rights

Right to access, correct and delete your personal data

Chubb aims to ensure that all personal data we store are correct. You also have a responsibility to ensure that changes in personal circumstances (for example, change of address and bank accounts) are notified to Chubb so that we can ensure that your data is up-to-date.

You have the right to request access to any of your personal data that Chubb may hold, and ask us to:

Confirm whether we are processing your personal data;
Give you a copy of that data;
Provide you with other information about your personal data such as what data we have, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we have carried out any automated decision making or profiling.

You have the right to request us to rectify any inaccurate personal data relating to you.

You furthermore have the right to request erasure of any irrelevant personal data we hold about you, but only where:

It is no longer needed for the purposes for which it was collected or otherwise processed; or
You have withdrawn your consent (where the data processing was based on consent) and there is no other legal ground for the processing; or
Following a successful right to object; or
It has been processed unlawfully; or
To comply with a legal obligation to which we are subject.

We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary:

For compliance with a legal obligation; or
For the establishment, exercise or defence of legal claims.

There are other certain circumstances in which we are not required to comply with your erasure request, although these two are the most likely circumstances in which we would deny that request.

Additional rights

You also have the following additional rights:

Data portability - where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to Chubb in a structured, commonly used and machine- readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to restriction of processing - you have the right to restrict our processing of your personal data where:

you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
where the processing is unlawful but you do not want us to erase the data;
where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether Chubb has compelling legitimate grounds to continue processing.

Where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.

Right to withdraw consent - where you have provided us with your consent to process data, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can do this in some cases deleting the relevant data from the relevant HR system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our data retention policy).

Right to object to processing justified on legitimate interest grounds - where we are relying upon legitimate interests to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

You also have the right to lodge a complaint with the DIFC’s Commissioner for Data Protection using the details below:

Dubai International Financial Centre Authority Level 14, The Gate Building

+971 4 362 2222

commissioner@dp.difc.ae

If you wish to investigate the exercising of any of these rights, please contact your Data Protection Officer.

Data Protection Officer

Chubb has a Data Protection Officer who is responsible for Chubb's compliance with the DIFC DP Law.

You may contact Chubb's Data Protection Officer or their office securely and confidentially at any time if you have general concerns about the processing of your personal data, or any data protection issue. The DPO's email address is dataprotectionoffice.europe@chubb.com.

Additional Privacy Notices

We may undertake certain processing of personal data which are subject to additional Privacy Notices and we shall bring these to your attention where they engage.

Notice of changes

Chubb may change or update this Privacy Notice at any time.

Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated this Notice so that you know which information we process and how we use this information. This Notice was last updated and reviewed in August 2021.