É«¶à¶àÊÓƵ

General US Privacy Policy

1. Data Controllers responsible for the Processing of your Personal Data
2. The personal information we use
   1. Information we collect about you
   2. Special categories of personal data
   3. Sources of the information we collect
3. How we use your personal information and the basis on which we use it;
4. Your rights over your personal information;
5. Automated decisions about you;
6. Information Sharing;
7. Information Security and Storage
8. International Data Transfer
9. Non Personal Confidential information
10. Contact Us
11. Changes to the Policy

É«¶à¶àÊÓƵ together with other members of its group, including but not limited to those listed at /insurance/our-companies and /reinsurance/our-companies (É«¶à¶àÊÓƵor we or us) are committed to compliance with data protection laws. This Privacy Policy describes how É«¶à¶àÊÓƵ collects, uses, shares and secures your personal information and non-personal confidential information when we provide our services as an insurance and reinsurance business. It also describes your choices regarding use, access and correction of your personal information. Personal information is information, or a combination of pieces of information that could reasonably allow you to be identified.

1. Data Controllers responsible for the Processing of your Personal Data

XL entities

É«¶à¶àÊÓƵRe Underwriting Inc.
Catlin É«¶à¶àÊÓƵ Company, Inc.
Coliseum Reinsurance Company
Eagleview É«¶à¶àÊÓƵ Brokerage Services, LLC
Greenwich É«¶à¶àÊÓƵ Company
Global Asset Protection Services LLC
Indian Harbor É«¶à¶àÊÓƵ Company
SMTC Guarantor LLC
SMTC Acquisition LLC
T.H.E. É«¶à¶àÊÓƵ Company
XL É«¶à¶àÊÓƵ America, Inc.
XL É«¶à¶àÊÓƵ Company of New-York, Inc.
XL Reinsurance America, Inc.
X.L. Global Services, Inc.
XL Specialty É«¶à¶àÊÓƵ Company

Registered office

100 Constitution Plaza Hartford, CT. 06103
1-800 242-5198
USA

2. Personal information we use

As an insurance and reinsurance business, we need to obtain information about the individuals covered in an insurance policy, or individuals that are beneficiaries of, or have made claims under, an insurance policy, or individuals who are involved in an incident giving rise to an insurance claim. This is so that we can properly assess the risks associated with providing insurance or reinsuring a particular block of insurance policies and administer and manage our products and services. This Privacy Policy applies to any individual whose personal information we process in the course of providing the services (each a "data subject" or "you")

We may be required by law to collect certain personal information about you, or as a consequence of any contractual relationship we have with you. Failure to provide this information may prevent or delay the fulfilment of these obligations. We will inform you at the time your information is collected whether certain data is necessary to receive our products or services and any potential issues related to the failure to provide such data.

2.1 Information we collect about you

The type of information we may collect and process about you will depend upon the type of insurance we are offering or underwriting. It may include any of the below (where permitted by law):

• Personal details: Your name, age, gender, date of birth, photographs, marital status, nationality, height and weight, leisure activities and interests.
• Identification information and criminal data: Your government-issued ID, driving licence, social security number (or local equivalent), driving record and criminal record (but only where it is lawful to collect this data).
• Contact Information: Your address, telephone numbers and email address.
• Information about your family and home: Your family health or morbidity history, number of children and name, age and gender of children, your dwelling type, your household income, home valuation and household demographics.
• Employment and experience information: Your employment history, job role, salary, employment benefit options, educational background and any professional licences and qualifications.
• Financial information: Details pertaining to your bank account, annual income, investment/savings, taxpayer ID, credit history and transaction history.
• Information to conduct our business: Information relating to underwriting insurance products and managing and processing insurance claims, such as previous insurance records and claims histories, services relating to our businesses and your business dealings or relationship with us.

From the information we collect about you, we may also derive or generate further information such as risk ratings. Some of this information is generated through profiling (see the section below on "Do we use personal information for profiling and automated decision making?").

2.2 Special categories of personal data

Some of the categories of information we collect are special categories of personal information (sometimes referred to as "sensitive personal information”). These include:

• your health records (such as your medical history, genetic test results and information, prescription history, death certificate and reports on medical diagnoses, tests and treatment);
• biometric information (photo ID, fingerprint and voiceprint);
• your family medical history;
• information about your personal characteristics and circumstances of a sensitive nature such as your racial or ethnic origin, sexual orientation, sex life, mental and physical health and genetic information;
• your membership of a professional association or trade union

We may also collect information about criminal convictions or offences where authorized by law.

2.3 Sources of the information we collect

We collect personal information from you directly when you voluntarily provide it to us, for instance if you submit application forms to be considered for insurance products or contact us.

We also collect your personal information from a variety of sources:

• From other insurance companies that we work with
• From other reinsurers and retrocessionaries
• From third party claims handlers who are involved in a claim or assist us in investigating or processing claims, including witnesses and external claims data collectors and verifiers
• From our business partners with whom we work to provide insurance products
• From public sources, such as public databases (where permitted by law)
• From coverholders, insurance brokers or other intermediaries
• From third party evidence providers
• From healthcare service providers
• From financial institutions
• From pension processing platforms
• From individuals that you may be associated with (e.g. joint account holders, company employees or directors, family members, etc.)

Occasionally we may collect your personal information from a third party, in particular from authorized, regulatory, public sources such as government regulators, industry self-governing bodies and other publicly available records. This will be most common when we are complying with our legal obligations regarding money laundering and other financial crimes. If appropriate, in these circumstances we will either notify you of our sources or seek your consent to their use.

2.4 Automated data collection

In addition to the categories described above, we also collect certain information automatically from you, related to your interactions with our website and other online services when you access or use them, whether via personal computer, browser, laptop, tablet, mobile phone or other device (each a “Device”).

In addition to any information that you choose to submit to us via our communications with you or through our online services, we and our third-party service providers may use a variety of technologies that automatically (or passively) store or collect certain information whenever you visit or interact with our online services (“Usage Information”). This Usage Information may be stored or accessed using a variety of technologies that may be downloaded to your Device whenever you visit or interact with our online services. To the extent we associate Usage Information with your personal information we collect directly from you through our online services, we will treat it as personal information.

This Usage Information may include:

• your IP address, UDID or other unique identifier (“Device Identifier”). A Device Identifier is a number that is automatically assigned to your Device used to access our online services, and our computers identify your Device by its Device Identifier;
• your Device functionality (including browser, operating system, hardware, mobile network information);
• the URL that referred you to our website or other online services;
• the areas within our online services that you visit and your activities there, including remembering you and your preferences;
• your Device location;
• your Device characteristics; and
• certain other Device data, including the time of day, among other information.

3.How we use your personal information and the basis on which we use it

We use your personal information to:

• (a) to provide our services and fulfil our contractual obligations to you and other third parties
• (b) to review, process and manage claims
• (c) to conduct data analysis, which helps us assess risks, price our products appropriately and improve our services
• (d) to help us prevent and detect fraud, money laundering, terrorism and other crimes
• (e) to help develop new, and improve existing, services
• (f) to operate and expand our business activities
• (g) to carry out background checks, where lawful
• (h) to perform administrative activities in connection with our services
• (i) to exercise, defend and protect our legal rights or the rights of third parties
• (j) to comply with legal obligations and to cooperate with regulatory bodies to which we are subject
• (k) for research and development of new insurance products
• (l) to audit our business
• (m) for marketing purposes.

We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:

• (a) to complete necessary pre-contractual checks to ensure that we can assess your suitability for the insurance products we offer
• (b) to fulfil our contractual obligations to you, for example to provide the services you request and to ensure that invoices are paid correctly. Failure to provide this information may prevent or delay the fulfilment of these contractual obligations
• (c) to comply with our legal obligations, such as due diligence and reporting obligations, and responding to binding requests from regulators, law enforcement authorities or other government authorities
• (d) to meet our legitimate interests, for example for example to improve our services, to ensure we price our products appropriately, to manage risk, to manage our business efficiently, to perform audits, and to maintain accurate records. When we process personal information to meet our legitimate interests, we always balance these against your fundamental rights and freedoms and put in place robust safeguards to ensure that your privacy is protected
• (e) to exercise our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims or violations of law.

If it is necessary that we process your sensitive personal information for one of the purposes listed above, we will only do so where one of the following applies:

• (a) We have obtained your explicit consent
• (b) We need to process your sensitive personal information to establish, exercise or defend a legal claim
• (c) We need to process your sensitive personal information for reasons of substantial public interest, for example to prevent or detect unlawful acts or fraud or for an insurance purpose
• (d) We are otherwise authorized by local law to process your sensitive personal information.

We may obtain your consent to collect and use certain types of personal information when we are required to do so by law (for example, in relation to our direct marketing activities, cookies and tracking technologies or when we process sensitive personal information). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this Privacy Policy.

For more information about how we process your information in relation to cookies and related tracking technologies, please review our cookies policy: /cookie-policy.

4. Your rights over your personal information

You have certain rights regarding your personal information, subject to local law. These include the following rights to:

• access your personal information
• rectify the information we hold about you
• erase your personal information
• restrict our use of your personal information
• object to our use of your personal information
• receive your personal information in a usable electronic format and transmit it to a third party (right to data portability)
• lodge a complaint with your local data protection authority.

If you would like to discuss or exercise such rights, please contact us at the details below. Also, we encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate

We will contact you if we need additional information from you in order to honor your requests.

5. Automated decisions about you

The way we analyze personal information for the purposes of e.g. risk assessment or fraud prevention may involve profiling, which means that we may process your personal information using software that is able to evaluate your personal aspects and predict risks or outcomes. We may also use profiling, or otherwise employ solely automated means, to make decisions about you that relate to the basis on which we provide insurance to you. This is known as "automated decision-making" and is only permitted when we have a legal basis for this type of decision-making.

We may make automated decisions about you:

• Where such decisions are necessary for entering into a contract. For example, we may decide not to offer insurance to you, or we may decide on the types of insurance that are suitable for you, or how much to charge you for our products based on your credit history and other financial information we have collected about you
• Where such decisions are required or authorised by law, for example for fraud prevention purposes
• Where you give your consent to us carrying out automated decision-making.

Subject to local legal requirements and limitations, you can contact us to request further information about automated decision-making, object to our use of automated decision-making, or request an automated decision to be reviewed by a human being.

6. Artificial Intelligence

Artificial Intelligence is an umbrella term for a range of technologies that replace manual processes and solve complex tasks by carrying out functions that previously required human action or input. Certain tasks are increasingly being supported by AI. AI can be used for a number of different functions, for example, grouping data (identifying common characteristics or properties), classifying or labelling data, or using data to come to or recommend a decision or determine an action.

'Generative AI’ is a particular type of AI involving systems or models that are capable of creating new content (based on the data that they have been trained on) when given an instruction or input prompt by the user. The difference between generative AI and other AI technologies is that generative AI creates or generates ‘net-new’ outputs, which could be text or graphics. Generative AI analyses the data that it has been trained on (using machine learning algorithms) in order to create something entirely new based on the instruction that it has been given and its analysis, mimicking human creativity and intelligence.

We may use AI systems and tools (including generative AI) to support our activities and for different purposes which we explain in more detail below.

I. Business process improvement and efficiency, information security

We use AI to improve our business processes with a particular focus on simplifying complex processes, ensuring consistent standards and driving efficiencies. For example, we use AI to help triage, organise and compile documents, extract data for entry into the relevant systems and translate or summarise text. We also use AI to support our business management and development initiatives with activities such as idea generation and trends prediction, the creation of content and for research tasks, including internal and external communications. We also use AI to support our information security practices (for example, by automatically detecting potential data loss).

II. Training AI

We may use personal information (for example where it is not possible to use anonymised data) as part of the development and training phase of an AI solution to be used in the provision of our insurance services. Where we use personal information for such training the lawful basis we will rely on is that it is necessary for the purposes of our legitimate interest in using an AI tool to assist in improving the efficiency and accuracy of our services, managing our business efficiently and maintaining accurate records.

When we process personal information on the basis that we have a legitimate interest to do so, we always balance this against your fundamental rights and freedoms and put in place robust safeguards to ensure that your privacy is protected.

7. Information Sharing

We may share your personal information with third parties under the following circumstances:

• É«¶à¶àÊÓƵgroup companies. We operate as a global business, so we may share your personal information with group companies who may use this information for the purposes described in this privacy notice.
• É«¶à¶àÊÓƵ companies, coverholders, intermediaries, financial institutions, retrocessionaires and business partners. We may share your personal information with insurance companies, intermediaries, financial institutions, retrocessionaires and business partners that use your personal information in connection with the provision of insurance and processing of claims. For example, we may share your personal information with other reinsurance businesses for the purposes of settling claims.
• Service providers. We may share your personal information with service providers that perform services and other business operations for us, for example, IT and analytics providers, actuarial service entities, auditors and advisers.
• Any law enforcement agency, court, regulator, government authority or professional body. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
• Asset purchasers. We may share your personal information with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this privacy notice.
• Customer companies. We may share our personal information with your company or employer in certain circumstances, for example, if your company has a corporate insurance product with us and you make a claim under that product.

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on "International Data Transfer" below for more information.

8. Information Security and Storage

We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.

We will keep your personal information for as long as we have a relationship with you, and for a period thereafter, in line with our Global Records Management Policy.

It is our policy to protect the confidentiality of Social Security numbers (SSNs) from misuse and improper disclosure by maintaining and enforcing physical, electronic, and procedural safeguards. We prohibit unlawful disclosure of SSNs, and limit access to SSNs to our personnel who need access to SSNs in order to perform their job functions. We do not disclose SSNs to third parties except where required or permitted by law.

9. International Data Transfer

Your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information under European Union law or by the European Commission. We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

Where we transfer personal data from EU countries to AXA companies and service providers outside the European Economic Area (EEA), We provide safeguards to ensure the security and the confidentiality of your personal data, by framing the transfer through either (i) the or (ii) through when your personal data is transferred to other entities of the AXA Group.

10. Non Personal Confidential Information

The provisions of sections 4 and 5 of this Privacy Policy also apply to any non-personal confidential information we hold about you.

11. Children’s Privacy

Our website and online services are not intended to be used by children and is not directed toward children under the age of 13. We do not knowingly solicit data from or market to children under the age of 13 and we do not sell products for purchase by children. No person under 13 years of age should disclose information to us. If you are under 18, you may use the online services only with the involvement of a parent or guardian.

Please visit to learn more about protecting children privacy.

12. Other Websites and Links

Our online services contains links to other websites and services that are not operated by AXA XL. Please note that when you click on a link to one of these sites, you are exiting our online services to go to another provider. We are not responsible for the content or privacy practices of these other online services. We suggest that you read the privacy policies of these providers, as their practices and policies may differ from ours.

We may provide certain parts of our online in association with third parties, such as promotional partners or affiliates. These “co-branded areas” will identify the third party. If you choose to use these co-branded areas, we may share your information with the identified third party, and that third party may also collect information from you, in addition to the information that we collect, as described above. You should review the privacy policies of those identified third parties to understand how they collect and use information.

13. Contact us

If you have questions about your rights or concerns regarding the way in which your personal information has been used, please contact our Data Protection Officer at dataprivacy@axaxl.com.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the data protection authority.

14.Changes to the Privacy Policy

You may request a copy of this Privacy Notice from us using the contact details set out above. We may modify or update this Privacy Notice from time to time.

If we change this Privacy Notice, we will notify you of the changes. Where changes to this Privacy Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).

Last status: March 2025