CannGen UK Ltd (“CGUK”) is part of the CannGen Insurance Services Group (“CannGen Group”) and aims to ensure the confidentiality and security of personal data processed by the company in connection with the services provided to its clients. CGUK operates as a Managing General Underwriter (MGU) and is an appointed representative of Advent Solutions Management Ltd, authorised and regulated by the Financial Conduct Authority (FCA), FRN 308751. CGUK’s services primarily include underwriting and insurance intermediary services that facilitate the consideration of, access to, administration of, and claiming of insurance benefits.

1. Name and Contact Details of the Controller and Data Protection Officer

This privacy notice applies to data processing by the data controller:

CannGen UK Ltd

20 St Dunstan’s Hill

London EC3R 8HL

United Kingdom

Email: nmorris@canngenins.com

The company Data Protection Officer is Mr Nick Morris, who can be contacted at the above address or at nmorris@canngenins.com.

The person responsible is also referred to below as “CGUK”.

2. Collection and Storage of Personal Data, and the Type, Purpose and Use of Such Data

When you request our services, we ask you for accurate and necessary information that will enable us to respond to your request. If you provide us with personal data, we will use that data for the purposes for which it was provided to us, as stated at the time of collection or as is obvious from the context of collection, for example to provide an insurance quote.

When we provide the above services to our customers, we may collect personal data such as:

Personal master data and communication data

Name, address, proof of address, contact details (including emails and telephone numbers), gender, marital status, date and place of birth, nationality, employer, job title, employment history and family details (including their relationship to you), relationship to policyholder, insured, beneficiary or claimant.

Identification data

Identification numbers issued by authorities or government agencies (e.g. National Insurance number, passport number, tax identification number, driving licence number — depending on your country of residence).

Financial data

Card number (debit card, credit card, etc.) and bank details, income and other financial data or transaction histories.

Insured risk

Information on the insured risk which may contain personal data, provided that this is relevant to the risk to be insured.

Policy data

Information about the insurance offers and policies that are created.

Technical information

Including the IP address of your computer.

Credit and anti-fraud data

Including credit history, credit score, sanctions and offences, as well as information from various anti-fraud databases relating to you.

Special categories of personal data

Which enjoy additional protection under the UK GDPR, including health data, criminal convictions, origin, political opinions, religious or similar beliefs, trade union membership, genetic data, biometric data or data concerning sex life or sexual orientation.

Previous insurance cases/claims (only with your express consent)

Information about previous insured events/claims, which may include health data and other special categories of personal data.

Current insurance cases/claims

Information on current insurance cases/claims, which may include health data and data on criminal records.

Marketing data

Information on whether you have consented to receive marketing communications from CGUK and/or selected third parties.

In the event that you provide us with personal data of third parties (for example, employees or family members), please note that you must obtain the consent of these persons beforehand.

We receive personal data from various sources and third parties, including:

• You yourself
• Your family members, your employer or your agent/representative (including your broker)
• Our representatives
• Insurer, insurance broker or reinsurer
• Credit institutions
• Websites or software applications for use on computers or mobile devices and/or social media content, tools and applications
• Anti-fraud databases, sanctions lists, court judgments and other databases
• Authorities
• Any open electoral roll

The collection of this data takes place:

• to be able to identify you as our customer or as an intermediary;
• to perform underwriting and insurance mediation services, including activities as an agent under powers of attorney granted, such as underwriting, quoting and policy issuance;
• to manage the relationship with our clients and business partners, including carrying out Know Your Client checks, communicating with clients, providing services including billing and administration, and handling client complaints;
• to enable physical mailing via a digital interface, allowing automated scanning of incoming mail and printing of outgoing mail;
• for direct advertising, sending publications or press releases;
• for other contact and customer care;
• for internal budget planning and reporting;
• to comply with our legal obligations of any kind, including compliance;
• for data protection and security purposes.

We may also use your personal data for other purposes if you have consented or the processing is compatible with the previous purpose.

The data processing is lawful pursuant to:

• Article 6(1)(b) UK GDPR — necessary for the performance of a contract;
• Article 6(1)(c) UK GDPR — compliance with a legal obligation; and/or
• Article 6(1)(f) UK GDPR — legitimate interests of the controller or a third party.

In order to facilitate the provision of insurance cover and the processing of insurance claims, CGUK relies on the data subject’s explicit consent to the processing of special categories of personal data pursuant to Article 9(2)(a) UK GDPR.

The data subject’s consent to the processing of special categories of personal data is a necessary condition for CGUK to provide the services requested by the customer.

If data about another person is provided to CGUK, you agree to inform that third party about our use of their personal data and to obtain their consent for us.

You can withdraw your consent to this processing at any time. However, as a result, CGUK will no longer be able to provide the services to you. In addition, if you withdraw your consent to the processing of special categories of personal data by an insurer or reinsurer, the continuation of insurance cover may no longer be possible.

3. Disclosure of Data to Third Parties

We will only share your personal data with service providers, business partners and other third parties in accordance with applicable data protection laws. We do not rent, sell or otherwise disclose personal information to unaffiliated third parties for their own marketing purposes.

Within the CannGen Group

We may share personal data with other affiliates and business units of the CannGen Group in order to provide services to you.

Business Partners

We disclose personal data to business partners who provide us with certain specific services or work with us on a project. These business partners operate as separate data controllers and are independently responsible for compliance with data protection laws. Examples include: insurers, reinsurers and other insurance intermediaries, insurance reference bureaux, and service providers for conducting sanction and compliance checks.

Authorised Service Providers

We may share your information with service providers contracted as processors. These service providers are subject to contractual restrictions and may only use or disclose data for the performance of the services we have contracted them to perform, or to comply with legal requirements.

If we transfer personal data to service providers outside the United Kingdom or the European Economic Area (EEA), the transfer will only take place where adequate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), UK addendum to the EU Standard Contractual Clauses, or an adequacy decision by the UK Government.

Our IT service providers are based in the following countries: Germany, USA, Philippines. These service providers are subject to strict contractual restrictions with regard to the processing of personal data.

Legal Obligations and Business Transfers

We may disclose personal data to a third party:

• if required by law, in the course of legal proceedings, or pursuant to a court order, search warrant or other legal request;
• on the instructions of a regulatory or governmental authority;
• if we believe that disclosure is necessary and appropriate to prevent physical harm or financial loss;
• in connection with the investigation of suspected or actual illegal activities;
• if you have consented; or
• in the event of a merger or acquisition, to the new owner of the company.

Disclosure may also be required in the case of audits or to investigate a complaint or security threat.

4. Duration of Data Storage

We will delete your personal data as soon as it is no longer required for the above purposes. Personal data may be retained for the duration during which claims can be asserted against our company. We also store your personal data insofar as we are legally obliged to do so under UK law.

5. Data Subject Rights

You have the right:

• to withdraw your consent at any time in accordance with Article 7(3) UK GDPR, which means we may no longer continue data processing based on that consent;
• to request access to your personal data processed by us in accordance with Article 15 UK GDPR, including information on the processing purposes, categories of data, recipients, planned storage period, and the existence of automated decision-making;
• to demand the correction of inaccurate or incomplete personal data in accordance with Article 16 UK GDPR;
• to request the erasure of your personal data in accordance with Article 17 UK GDPR, subject to applicable exceptions;
• to request the restriction of processing in accordance with Article 18 UK GDPR;
• to receive your personal data in a structured, commonly used and machine-readable format or to request transfer to another controller in accordance with Article 20 UK GDPR; and
• to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk, or the supervisory authority of your usual place of residence or workplace.

6. Right of Objection

Insofar as your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) UK GDPR, you have the right to object to the processing of your personal data pursuant to Article 21 UK GDPR, insofar as there are grounds for doing so that arise from your particular situation.

If you wish to exercise your right of objection, please send an email to nmorris@canngenins.com.

7. Amendments to This Notice

We may update this Privacy Notice from time to time. We will notify you of any changes that materially affect it via our website. We encourage you to periodically review this Privacy Notice so that you are aware of our privacy practices.

This Privacy Notice was last updated on 4 August 2025.