Privacy Notice
This privacy notice explains how Canopius Group Limited and its subsidiaries (“Canopius,” “we,” “us,” or “our”) collect, use or disclose any personal information we collect about you so that we can provide you with appropriate insurance products and services, settle any valid claims and deal with any concerns you may have. This includes information gathered on websites that expressly link to this privacy notice (“Website”). Depending on which services you use, this may involve us using your personal information (information that can identify you, such as your name, contact details, employment details and details of financial payments) and special personal information (for example, details about your health, race or ethnic background).
Notice to California residents: If you reside in California, please view our California Privacy Notice. It provides details on how we may collect, use, or share your personal information and outlines the rights you have regarding your personal information.
Topics in this document:
- Who we are
- What information we collect about you
- How we collect your information
- How we use your information
- Our Legitimate Interests
- Who we share your information with
- How long we keep your information
- International transfers of personal data
- How we keep your information secure
- Automated Decision Making, Profiling and Artificial Intelligence
- Your rights relating to your information
- Your right to lodge a complaint
- How to contact us
- Third-party websites and applications
- Changes to our privacy notice
1. Who are we
We are Canopius Group Limited (“Canopius”) which is domiciled in Jersey and operates in Australia (see Australia Privacy Notice | Canopius) , Bermuda, Singapore, the UK, the US, Malaysia (Labuan) and China (through Lloyd’s China). The Canopius Group is made up of a number of trading companies and is supported further by its service companies, including Canopius Services Limited. For more information, please visit our website at www.canopius.com.
Our UK entity Canopius Managing Agents Limited is registered with the Information Commissioner’s Office, registration number Z5406784. Our contact details are listed below in ‘how to contact us’.
2. What information do we collect about you
In order to deliver our products and services, and depending on which products and services you use, we may collect the following information:
- Individual Details: such as your name, address, date of birth, email address and phone number, and details of any other people you are including on the proposal or policy and your relationship with them
- Identification Details: E.g. Identification numbers issued by government bodies or agencies, such as your national insurance number, passport number, tax identification number and driving licence number;
- Financial Information: such as your bank account details, tax information and details of income and assets and other financial information;
- Policy Information: includes information about quotes, policies, schemes, relationships you have with intermediaries and claims and any other information relevant to your policy, including renewal dates and policy and claim histories;
- Claims Data: Information about previous and current claims, (including other unrelated insurances), which may include data relating to your health, criminal convictions, or other special categories of personal data.
- Credit and Anti-Fraud Data: Credit history, credit score, sanctions and criminal offences, and information received from various anti-fraud databases relating to you.
- Sanctions Related Data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources such as newspapers and social media sites and information obtained from checks of fraud databases and sanctions lists such as relationships/close associations with politically exposed persons;
- Education and Employment Data: (if relevant) includes your education, vocational and professional qualifications, employment status, job title and employment and educational history;
- Complaints Data – Details of any complaints you make about your policy, claim, Canopius or any parties acting on our behalf
- Technological Data – such as information about your device IP address, browser configuration, geolocation and other technical information about how you react with specific pages on our website. For more information please review our Cookies Policy.
- Vulnerability Data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that we can better meet your needs;
- Children’s Data – We may collect data about children in some limited circumstances, e.g. where a child is insured on an adult’s policy, a beneficiary of a policy, or where a child is a claimant. Our Website is not directed to individuals under the age of 18 (for purposes of this notice only, a “child” or collectively, “children”). If you are a parent or guardian and believe your child has uploaded personal information without your consent, please contact us using our details provided at the end of this privacy notice.
- CCTV – images captured in our offices
- Sensitive Personal Data – We may request or receive sensitive personal data, which includes information about your health, genetic or biometric data, sex life, sexual orientation, racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, and criminal offence data (including allegations, investigations, and penalties). For example, we may need details of an injury to assess a bodily injury claim. We treat this data with the highest level of care.
Types of sensitive data we may process include:
- Health data – such as medical conditions, test results, diagnoses, and treatments
- Criminal data – such as convictions, e.g. driving offences
- Other sensitive data – e.g. where you specify medical treatment preferences, this could reveal religious beliefs or if a product is purchased through your trade union, this could reveal political views.
3. How we collect your information
Depending on which of our services you use, we may collect information about you from various sources, including:
- Directly from you – for example, if you send us a claim form, submit a statement, make an enquiry with us, make a complaint, send us an email or speak to us by phone.
- From Third Parties – for example your employer or representative, such as an insurance broker; other insurance companies; credit-reference agencies; anti-fraud databases, sanctions lists, court judgments and other databases that are available to the public; government agencies such as the DVLA and HMRC (if based in the UK); the open electoral register; or if we receive a claim, third parties, including the other party to the claim (the person making or defending the claim), witnesses, experts (including medical experts), loss adjustors, solicitors and claim handlers.
- Information collected from your devices – for example through mobile applications developed and offered by the Canopius Group; interactions with our website or through Cookies technology. You can find out more in our Cookies Policy.
4. How we use your information
We may use your information for the following purposes.
| Purpose | Legal Basis |
|---|---|
| Quotation and policy inception – to provide quotations, to calculate insurance risk ratings and premiums (this is where our actuaries analyse the information we have available to assess how likely you are to make a claim and so decide how much your premiums should be), and set up your insurance policy. | • Performance of a contract |
| Policy administration – to manage and administer insurance policies. | • Performance of a contract |
| Claims assessment and management of claims – to assess, investigate and where appropriate settle claims. | • Performance of a contract • Legitimate Interests • Substantial Public Interest |
| Complaints Management – to allow us to investigate and respond to any complaints. | • Performance of a contract • Legitimate Interests • Legal obligation |
| Fraud Prevention – to prevent and detect fraud, financial crime, and money laundering. | • Legitimate Interests • Legal obligation • Substantial Public Interest |
| Comply with applicable legal, regulatory and professional obligations – including cooperating with regulatory bodies (e.g. the FCA, PRA and ICO), MIB, ELTO, government authorities and law enforcement agencies and fulfilling Data Subject Rights. | • Legitimate Interests • Legal obligation • Substantial Public Interest |
| Carry out activities that are in the public interest – e.g. we may need to use Personal Information to carry out anti-money laundering checks; | • Legitimate Interests • Legal obligation • Substantial Public Interest |
| Manage our business operations – including by carrying out internal audits, quality assurance and training, financial analysis and accounting, producing management information and performing administrative activities in connection with the products we provide. | • Legitimate Interests • Legal obligation |
| Manage commercial risk – including taking out and maintaining appropriate insurance and reinsurance. | • Legitimate Interests |
| Managing third party relationships – personal information collected is used to administer, manage and service our business agreements. | • Performance of a contract • Legitimate Interests |
| Carry out data analysis – including to ensure data accuracy and quality and for insurance risk modelling and product and pricing refinement. | • Legitimate Interests |
| Buy, sell, transfer or dispose of our business – E.g. To transfer books of business if we are selling or reorganising all or part of our company. | • Legitimate Interests |
| Establish, enforce and defend our legal rights or those of third parties – including enforcing our terms and conditions, pursuing available remedies and limiting our damages. | • Performance of a contract • Legitimate Interests |
| To maintain, improve and protect our website, services and computer systems, ensure our network and information security and business continuity – In some cases it might be necessary to conduct testing on our different systems using data, with strict privacy and security controls in place. | • Legitimate Interests |
| Marketing – to send marketing communications to you based on your preferences and to measure your interest in and engagement with the Website. This helps us offer new products, present promotional offers, and inform you about our products and services, as well as those of others. We may also use your information for short-term, transient purposes, such as customising ads. Additionally, we may also use your personal information to tailor your experience with us and deliver content and ads, including through our Website, as allowed by law. | • Legitimate interests • Consent |
We only collect and process Sensitive Personal Information when we have an additional and specific legal basis to do so. In these cases, we rely on one of the following legal bases:
- Reasons of substantial public interest, such as:
- Insurance purposes: including providing advice, arranging, underwriting, and managing insurance policies; handling claims; and fulfilling rights or obligations under insurance contracts;
- Prevention and detection of unlawful acts: including sharing information with appropriate authorities;
- Fraud prevention: investigating suspected fraudulent activity;
- Establishing, exercising, or defending legal claims: This applies where we are involved in legal proceedings or need to investigate potential claims.
- Explicit Consent: Where you have provided your explicit consent for your data to be used.
- Information made public by you: Where you have clearly and deliberately made the information publicly available.
- Protecting vital interests: In rare occasions, processing is necessary to protect your life or the life of another individual.
5. Our Legitimate Interests
Sometimes we use your personal information because we have a genuine business reason to do so. When we rely on this legal basis—called “legitimate interests”—it’s usually for one of the reasons listed below.
- To set up, manage, and administer your insurance policy and handle claims.
- To resolve complaints and customer service issues.
- To detect, prevent, and investigate fraud or financial crime.
- To recover debts and enforce legal rights.
- To maintain accurate business records and monitor performance.
- To improve our products, services, and pricing models.
- To carry out market research and understand customer needs.
- To protect our computer systems, networks, and data from security threats.
- To ensure business continuity and safeguard our operations.
- To support internal reporting and decision-making.
- To send marketing communications based on your preferences.
- To comply with legal and regulatory obligations.
- To manage business changes like mergers, sales, or restructuring.
6. Who we share your information with
To support the purposes outlined above, we may share your personal information with Canopius Group companies and trusted third parties, including:
- Other companies within the Canopius group.
- Insurance and reinsurance partners such as brokers, other (re)insurers, or companies acting as (re)insurance distributors.
- Third parties who provide services or help administer your policy or claim, including loss adjusters, claims handlers, accountants, auditors, banks, lawyers, building regulations checkers, and medical experts.
- Our regulators including the Prudential Regulation Authority (PRA), Financial Conduct Authority (FCA) Lloyds and the ICO.
- Courts and alternative dispute resolution providers, such as arbitrators, mediators, and the Financial Ombudsman Service.
- The police and other law enforcement agencies.
- Fraud detection agencies and third parties maintaining fraud registers or conducting investigations, including the Motor Insurers’ Bureau (MIB) and Claims and Underwriting Exchange (CUE);
- Credit reference agencies and third parties conducting sanctions checks.
- Industry organisations such as the Association of British Insurers, Lloyd’s Market Association, and Employers’ Liability Tracing Office.
- Third-party service providers, including IT suppliers, actuaries, auditors, lawyers, document management firms, business process outsourcers, procurement providers, subcontractors, and tax advisers.
- Marketing and research partners who manage contact lists, send marketing communications, and analyse campaign responses.
- Social media and analytics platforms such as LinkedIn and Google, to deliver and assess marketing effectiveness.
- Selected third parties in connection with any sale, transfer, or disposal of our business.
7. How long we keep your information
We will keep your personal information for as long as is necessary for the purposes we originally collected it for, or for as long as we are allowed to keep it under any relevant laws. How long we keep your personal information for will depend on:
- your relationship with us and the types of products or services you have with us;
- how long it is reasonable to keep records to show that we have met the obligations we have to you by law;
- any time limits for making claims under your insurance;
- any retention periods set by law, regulators, professional bodies or associations; and
- whether there are any relevant proceedings.
If you would like further information about how long we keep your data for, please email us at privacy@canopius.com.
8. International Transfers of Personal Data
We, or third parties acting on our behalf, may need to transfer your information to a country outside of the UK or the European Economic Area (EEA). We make sure your information and privacy rights are protected when we carry out a transfer by ensuring adequate safeguards are in place. For example by including restrictions in the contracts we have in place with the organisation receiving or processing the data.
If you would like further information about data transfers and the safeguards we have put in place, please email us at privacy@canopius.com.
9. How we keep your information secure
We are committed to keeping your personal information secure. We have put in place physical, electronic and operational controls to protect the information we collect and keep it secure. All our staff must respect the confidentiality of the information we collect, and access to confidential information is restricted to only those who have a reasonable need to see it.
10. Automated Decision Making, Profiling and Artificial Intelligence Automated Decision Making and Profiling
We may use profiling and automated decision making to help determine the prices, policy terms, relevant products/services, make any changes, renew a policy or manage a claim.
When providing an insurance quote, we may use an automated underwriting engine that takes account of the information we have collected about you. We may also validate information you provide against other records we hold about you in our systems and third-party databases, including public databases. We take account of all of the information available to us to help determine the likelihood of a claim being made, how much it might cost and we use that assessment to decide whether or not to offer insurance and the price of the policy.
Where we make an automated decision that has a legal or substantially similar effect, you have the right to object to automated processing of your personal information and to request human review of any decision. If you wish to exercise these rights, please contact privacy@canopius.com.
Artificial Intelligence
We use artificial intelligence (AI) and machine learning technologies to process your personal information for profiling and data analysis. This includes assessing insurance risk, processing underwriting and claims decisions, detecting potentially fraudulent claims, improving our services and operational efficiency, and maintaining data quality.
To carry out these purposes, we combine your personal information with information relating to other customers, potential customers, and data provided by third parties including credit reference agencies and publicly available sources. We only use data for these purposes where we’re satisfied it is fair, lawful, and complies with UK GDPR, the Data Protection Act 2018, FCA requirements, and the Equality Act 2010.
All AI-assisted decisions that significantly affect you involve human review and oversight. We do not make decisions based solely on automated processing without human involvement. We regularly audit our models and carry out checks to minimize the risk of unfair bias or discrimination and use statistical techniques to ensure the data we rely on is accurate and meaningful.
You have the right to object to automated processing of your personal information and to opt-out of or request human review of any AI-assisted decision. If you wish to exercise these rights, please contact privacy@canopius.com.
11. Your rights relating to your information
If you are based in the UK or EU, you have the following rights relating to the information we collect about you.
- Right of access – You have the right to make a written request for details of the personal information we hold about you, and to receive a copy of that personal information.
- Right of rectification – You have the right to have any inaccurate information about you corrected or removed from our records.
- Right to erasure (‘right to be forgotten’) – You have the right to have certain personal information about you deleted from our records.
- Right to restriction of processing – You have the right to ask us to stop using or suppress the use of your data in certain circumstances;
- Right to object – You have the right to object to us processing your personal information in certain circumstances.
- Right to data portability – If you have given us personal information that we store electronically, you have the right to ask us to transfer that information to you or someone else in a format that can be read by computer.
- Automated decision making and profiling – You have the right not to be subject to a decision using your personal information which is based solely on automated processing (without human involvement) where that decision produces a legal effect or significantly affects you.
- Right to withdraw consent – if we have asked for your consent to use your personal information, you are free to withdraw your consent at any time.
If you are based in another region, these rights apply where required by local law. We will inform you which rights apply to you when you make a request.
If you are a CyberSpace Guardian mobile app user and want to request deletion of your account, you can do so here: Cyberspace
If you want to exercise any of your rights, please contact privacy@canopius.com or complete our webform here.
12. Your right to lodge a complaint
If you are not satisfied with our use of your personal data, our response to any request by you to exercise any of your rights, or if you think that we have breached the UK/EU GDPR, then you have the right to complain to us and the regulator/supervisory authority.
If you would like to make a complaint to us, please contact privacy@canopius.com or complete our webform here with details of your complaint.
If you are based in the UK, you have the right to lodge a complaint with the Information Commissioner’s Officer (“ICO”). The ICO’s contact details are as follows.
Website: www.ico.org.uk
Write to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 0303 123 1113 (local rate)
If you are based in the EU, you have the right to complain to the supervisory authority in your country. A list of EU Supervisory Authorities can be found here.
13. How to contact us
If you have any questions, comments or complaints, or you want to exercise the rights you have relating to data protection, please contact the Group Data Protection Officer.
Group Data Protection Officer
Canopius Managing Agents Limited
Floor 29, 22 Bishopsgate
London
EC2N 4BQ
Email: privacy@canopius.com
Or, if you live in the European Union, you can also contact us through our EU Representative.
Canopius Data Protection, Oyster IMS
Carrick House, 49 Fitzwilliam Square
Dublin 2
Ireland.
Email: Canopius.EURep@oyster-ims.com
14. Third-party websites and applications
Our Website may contain links to other websites/applications and other websites/applications may reference or link to our Website. These third-party services are not controlled by us. We encourage you to read the privacy policies of each website and application you may interact with. We do not endorse, screen, or approve, and are not responsible for, the privacy practices or content of such other websites or applications. You agree that if you elect to provide personal information to third-party websites or applications encountered on our Website or through our services, you do so at your own risk.
15. Changes to our Privacy Notice
We keep our privacy notice under regular review, and the latest version will be available on this website. This privacy notice was last updated July 2026.