Bermuda Privacy Notice

The purpose of this Privacy Notice is to explain when, how and by whom information about you ("Personal Information") is collected, processed (i.e., used), and maintained, the reasons why we do so and the rights available to you in relation to your Personal Information.

This Privacy Notice is updated as necessary to remain accurate in compliance with the Bermuda Personal Information Protection Act 2016 (“PIPA”) and other applicable legislation and regulations.

This Privacy Notice is accessible on our website at www.everestglobal.com (“Website”). Our contractual documents and external communications may contain a reference to this Privacy Notice too.

Everest Group, Ltd. (NYSE:EG) and its subsidiaries and affiliates, Everest Reinsurance (Bermuda), Ltd., Everest International Reinsurance, Ltd. (Bermuda), Everest International Assurance, Ltd. (Bermuda), Mt. Logan Re, Ltd., and Mt. Logan Capital Management, Ltd. (together, “Everest Group”, "we", "us" and "our") and, on our behalf by our third-party service providers, collect and process your Personal Information. Each entity of Everest Group is responsible for its own collection and processing.

Much of the information we collect will have been provided by you, or, where legally permitted, from other sources. These include but are not limited to:

• From your representative(s) through the policy application process and renewals.
• From your family members, employers, professional associations or representatives;
• From other (re)insurance market participants including brokers, agents, managing general agents (MGAs), other reinsurers and retrocessionaires.
• From financial institutions and credit reference agencies.
• From public sources including public databases such as websites and print media.
• Where permitted by law, from government agencies, administrative authorities, regulators, anti-fraud databases, sanctions lists, court judgments and other databases.
• From healthcare service providers or benefits providers including pension and social security organisations.
• In the event of an (re)insurance claim, from third parties involved including the other party to the claim (claimant/defendant), witnesses, experts (including medical experts), loss adjustors, lawyers, and claims handlers.
• In the course of navigation of our website (see below).

Where we receive your Personal Information from third party sources, we require that those third parties either received your prior consent or are otherwise legally permitted or required to disclose your Personal Information to us.

When you visit our website, we seek your consent to collect certain information from your device by automated means such as cookies, web server logs and web beacons. Further information about our use of cookies can be found in our Cookie Policy.

Personal Information that we request depends on the purpose for which the information is collected. We collect, use, and disclose personal information and sensitive personal information (as defined in PIPA) about you only for the purposes for which it was collected. We do not sell your personal information or use it for marketing purposes. (Please see the below list of purposes)

For a policyholder or insured, the Personal Information collected will depend on the type of insurance that was bound with us, and the risks covered.

Requested Personal Information may include but is not limited to:

• Background data including title, name, phone numbers, personal email addresses, home address, date of birth, government identification numbers, national insurance numbers, social security numbers, membership of a professional association, tax numbers, copy of passport and any visa related documents for yourself and your dependents as well as driver’s license, emergency contact name and mobile/home numbers.
• Family information including name of spouse/partner, name of children, date of birth in respect of spouse/partner/children, phone numbers.
• Financial data including bank information, tax information, credit history and credit score.
• Technical data collected when you access our Website including your internet protocol (IP) address or domain names of the devices utilised, your login data, browser type and version, and geolocation address.
• Information that is characterized by applicable Bermuda law as Sensitive Personal Information, information regarding race, place of origin, color, ethnic or national origins; sex or sexual orientation; marital status; physical or mental disability; family status; religion or beliefs or political opinions, biometric information or genetic information (“Sensitive Personal Information”).
• Claims data including previous claims data (claims histories) and previous policy numbers (insurance records).
• Employment records (including job titles, work history, working hours, training records and professional memberships); Location of employment or workplace; Recruitment information (including copies of right to work documentation, immigration status, references and other information included in a CV or cover letter or as part of the application process); Compensation data including salaries, benefits, pension etc.; Performance information; and Disciplinary and grievance information.

 

If certain required Personal Information, including Sensitive Personal Information, is not provided to us, we may be unable to sign a contract or be able to fully or partially perform our services. Failure to provide required information could also generate delays in processing claims and/or in performing other obligations under a contract.

We collect and process Sensitive Personal Information in accordance with applicable laws and regulations, which may include obtaining your explicit consent prior to collection (please see below on “How & Why We Process Personal Information?”). If you refuse to consent or withdraw your consent, we may be unable to sign a contract, or perform, fully or partially, our services. Failure to consent may also delay the processing of claims and/or the performance of our contractual obligations.

We collect, process and use Personal Information of policyholders, insureds, beneficiaries, investors, counterparties or business partners for the following purposes:

A. The underwriting, management and performance of contracts signed by us;and

B. Compliance with our legal and regulatory obligations.

The following details the Personal Information we may collect and identifies the recipients that may receive such Personal Information in connection with each of these objectives.

We do not sell (or exchange) your Personal Information for monetary compensation.  

A. Personal Information necessary for performance of a contract

Purposes: We may collect your Personal Information for the following purposes:

Quotation/Inception

•      Setting you up as a client

•      Analysing the needs of clients/policyholders to offer products/services.

•      Evaluating our exposure under a contract (i.e. the risks to be covered and matching the appropriate policy/premium)

•      Payment of price/premium where the (re)insured/policyholder or contractor is an individual.

•      Verifying your identity and verifying the accuracy of the information we receive.

Policy Administration

•      Client care, including communicating with you and sending you updates.

•      Payments to and from individuals.

Claims and Disputes Processing

•      Managing claims, disputes, actions, and recourses in relation to a contract.

•      Defending or prosecuting claims, disputes, actions, and recourses in relation to a contract.

•      Complaints handling.

•      Making claim payments by processing your bank account details.

Renewals

•      Contacting you to renew a contract,

•      Evaluating the risks to be covered and matching to appropriate policy/premium.

•      Payment of price/premium where the (re)insured/policyholder or contractor is an individual.

Recipients: Recipients of this data may include but are not limited to:

•      Brokers

•      Managing General Agents

•      Third Party Claim Administrators

•      Everest Group affiliates

•      Partners who provide data processing services (for example data hosting and storage companies)

•      Legal advisors or counsel, loss adjusters and claims investigators, expert appraisers and other firms used as part of the claims handling process including private investigators when we need to further investigate certain claims

•      Medical professionals

•      Property and risk surveyors

•      Regulatory authorities

•      Tax advisers

•      Law enforcement agencies

•      Internal and external auditors

•      Third party claimants and/or their legal representatives during the administration of a claim being made against you

•      Reinsurers

B. Personal Information necessary for compliance with a legal and regulatory obligation

Purposes: We may collect your Personal Information for the following purposes:

•      Complying with anti-money laundering and financing of terrorism regulations.

•      Complying with our tax duties including pay as you earn obligations.

•      Considering international economic, financial and trade sanctions

Prohibitions and restrictions.

•      Assisting the courts in acting in their judicial capacity.

•      Complying with regulatory reporting obligations.

Recipients: Recipients may include but are not limited to:

•      Regulatory authorities and government departments.

•      Legal, financial and tax advisers and counsel.

•      Law enforcement agencies.

•      Public bodies.

•      Insurance providers.

•      Other parties in the course of legal proceedings.

C. Personal Information necessary based on our legitimate interests

Purposes: We may collect your Personal Information for the following purposes:

•      Identifying and preventing fraud, including the management of amicable litigation and disciplinary procedures

•      Facilitating corporate reorganisations and/or the acquisition or sale of some or all of the Everest Group or the Everest Group’s assets in the event such is contemplated.

•      General risk modelling of the Everest Group, statistics, and actuarial studies.

•      Research and development activities.

•      Conduct data analytics, benchmarking activities, create insight and reports.

•      Improving our services.

•      Operating our business, managing, and developing our relationships with clients and suppliers.

•      Understanding how our clients use our services and Website.

•      Investigating, establishing, exercising or defending a legal claim.

•      Maintaining information technology services, network and data security, fraud prevention and improving our Website.

Recipients: Recipients may include but are not limited to:

•      Prospective sellers or buyers of business assets.

•      Professional advisers or counsel.

•      Service providers who provide information technology and system administration services to us.

•      third party outsourcing, cloud, SaaS, DaaS or other IT/data processing service providers.

•      industry consultants: risk analytics, actuarial, pricing, KYC/due diligence service providers, police organizations

We are a global organisation, and your Personal Information will be accessed by our staff, affiliates or suppliers in, transferred to, and/or stored at, a destination outside Bermuda, which may have data protection laws that differ from the standards of Bermuda. We will, in all circumstances, safeguard your Personal Information as set out in this Privacy Notice.

Where we transfer Personal Information from Bermuda to jurisdictions that have been designated by the Minister as providing a comparable level of protection to Bermuda data protection laws, no additional safeguards are required to export Personal Information to these jurisdictions. In the case of transfers to jurisdictions that have not been so designated, we will implement legal protections for such transfers, such as certification mechanisms, contractual mechanisms, corporate codes of conduct including binding corporate rules or any other legal grounds permitted by applicable legal requirements.

In particular:

• We ensure that transfers between Everest Group entities are covered by agreements that incorporate prescribed contractual wordings that oblige each party to ensure that your Personal Information receives an adequate and consistent level of protection.
• Where we transfer to or receive your Personal Information from third parties who help provide our products and services, we obtain contractual commitments from them to protect your Personal Information.
• Where we receive requests for information from law enforcement or regulators, we carefully review and validate these requests before any Personal Information is disclosed.

To address any queries, you may have in relation to data transfers, please see Section “Contact Us”

We maintain commercially reasonable physical, electronic and procedural safeguards to protect your Personal Information in accordance with data protection laws and regulations. All Personal Information that we hold is stored on our or our third-party suppliers’ secure servers and only accessed and used subject to our security policies and standards.

We will retain your Personal Information only for as long as is necessary for the processing purpose(s) for which it was collected and any other permitted related purpose (for example where we are required to retain Personal Information for longer than the purpose for which we originally collected it in order to comply with certain regulatory requirements, to defend legal claims, respond to complaints or to preserve accurate records of the service that we have provided). Our retention periods are based on business needs, statutory requirements and industry guidelines.

As a data subject, you have a number of rights with regard to your Personal Information and the table below sets out the rights which you have to address any concerns or queries with us about the processing of your Personal Information.

Subject to local laws and regulations, you can exercise any of these rights by submitting a request to: DataPrivacy@Everestglobal.com

Right of Access:	You have the right of access to your Personal Information, to information about how Personal Information is being used by us, and to request a copy of your Personal Information. You have the right to request the names of persons of types of persons to whom your Personal Information was disclosed.
Right to Correction:	You have the right to request that we amend any inaccurate Personal Information that we have about you. You also have the right to ask us to complete information you think is incomplete.
Right to Blocking/Restriction of Information Use:	You have the right to ask us to cease or not begin using your Personal Information for purposes of advertising, marketing, or public relations. You have the right under certain circumstances to ask us to cease or not begin using your Personal Information the use of which is likely to result in harm or distress to you or another individual.
Right to Erase or Destroy	You have the right to ask us to erase or destroy the personal information we hold on you where such personal information is no longer relevant for the purposes of its use.

In certain circumstances, where we are authorized to do so, we may need to restrict the above rights in order to safeguard the public interest (e.g. the prevention or detection of crime), to comply with our legal or regulatory obligations, and our interests (e.g. to maintain legal privilege).

If you have any questions in relation to this Privacy Notice, your rights, or how we process your Personal Information, please contact our Data Protection Officer at:

A. DataPrivacy@everestglobal.com or 844-949-2272

  or

B. Privacy and Data Protection Officer

100 Everest Way

Warren Corporate Center

Warren, NJ 07059

To obtain access to, or make a request for a correction to, your personal information, please submit a written request to the Privacy Officer, which must include sufficient information to enable us, with reasonable effort, to identify the personal information that is relevant to your request. Your request must also include all necessary contact information for us to respond to your request.

You will be contacted by one of our privacy administrators promptly to confirm our receipt of your request, and we will respond to you in no more than two business days after we have received your request.

Please note the following information associated with any request we receive from you:

• We require your full and accurate name along with your contact information.
• We will confirm receipt of your inquiry or instructions within 48 hours.
• We will take a reasonable amount of time to process your inquiry or instructions and respond to your request, typically within 45 days, depending on the nature and complexity of your request.

We may update this Privacy Notice from time to time. When we do, we will post the current version on our Website and we will revise the version date located at the bottom of this page.

We encourage you to periodically review this Privacy Notice so that you will be aware of our privacy practices. Any new version of this Privacy Notice supersedes any previous version.

This Privacy Notice was last updated on December 2024.