Australia Privacy Policy

This Policy has been developed to protect the personal information of people with whom we deal and to demonstrate the Branch’s compliance with all requirements of the Australian Privacy Principles (APPs) which are contained in the Privacy Act 1988 (Privacy Act). This Policy also aligns to Everest Group, Ltd.’s Privacy Policy (“Group Policy”) and to the extent that there is a conflict between this Policy and the Group Policy, this Policy shall take precedence with respect to protection of Personal Information

This Policy applies to all Personally Identifiable Information (PII) including Sensitive PII, collected, maintained, transmitted, stored, retained, or otherwise used by EIR. We collect personal information, including sensitive information, relating to claims made on insurance policies. We collect personal information for the purpose of assessing applications for insurance, administering insurance policies or claims.

We collect this information in a number of ways. Sometimes we will collect this information directly from the individual. However, we normally collect this information from agents, insurance brokers and other insurance intermediaries.

‘Personal information’ means information or opinion about an identified individual, or an individual who is reasonably identifiable, regardless of whether:

• The information or opinion is or is not true; and
• The information or opinion is or is not recorded in a material form.

‘Sensitive information’ is personal information and includes information about an individual’s health, genetics, race, political opinion or membership, religion, philosophical beliefs, union membership, sexual orientation, and criminal record.

Examples of the types of personal information which we collect include but are not limited to name, address and contact details, date of birth, gender, health information, claims history, criminal records, and credit history records. We may use personal and other information for the following purposes:

• To underwrite, quote and price insurance policies or other insurance contracts;
• To defend or settle claims;
• To assist in loss prevention and risk management activities;
• To complete transactions;
• To respond to requests for our services, including employment opportunities;
• To protect from crimes, including fraud;
• To personalize an individual's experience using our online services;
• To analyse data analytics across our entire business; and
• For other business purposes as allowed by law.

Personal information is collected with the individual’s consent, which is obtained during the application and/or renewal of insurance cover and/or during any claims process, or as otherwise permitted by law.

If personal information pertains to a candidate applicant for employment with us, we collect name, address, contact details, current and past employment information, educational qualifications, and professional associations. We also collect information about and proof of residency status, the name and contact details of referees and other information required for recruitment purposes. Where we seek consent to conduct a background check, we also collect details of proof of identity.

Role	Responsibilities
SOOA	Supervisor of this policy
Senior Manager in Australia	Responsible for maintaining oversight of the implementation of the policy.
Privacy Officer	Overseeing and ensuring the proper management and protection of personal information collected, used, and disclosed by the insurer. Plays a crucial role in ensuring compliance with privacy laws and regulations, maintaining customer trust, and working closely with the Risk and Compliance committee on mitigating risks related to the handling of sensitive information
All	Review the Branch Privacy Policy and are abreast of the Group Privacy Guidelines. Complete relevant Privacy training programs as nominated from time to time.

We only use and disclose an individual’s personal information for the purpose it was collected unless the use or disclosure for another purpose is with your consent or otherwise permitted by law.

We may disclose personal information to:

• Our related corporate entities for the purpose of performing our functions or corporate reporting. These related entities may be located overseas in any of the countries in which Everest operates including, but not limited to Singapore and the United Kingdom;
• Our advisers (including legal, actuary and accounting advisers) and service providers, including data analytics, marketing organisations and debt collecting agents;
• Other entities within our group, reinsurers (who may be located overseas), insurance intermediaries, credit reference agencies, our advisers, any agents, our administrators, and those involved in the claims handling process (including assessors, investigators, and others), for the purpose of assisting us and them in providing relevant services and products, or for the purpose of recovery or litigation;
• If we propose to exit particular portfolios of policies or particular policies, to insurance intermediaries or other insurers for the purpose of administering policies issued by us and/or alternative quotations for replacement policies to be provided to insureds.

We do not disclose personal information to persons for the purpose of them selling personal information for marketing purposes.

We may be required to disclose personal information under Australian law. When personal information is shared overseas, there is also a possibility that whoever receives the information may be required to disclose it under a foreign law.

We maintain appropriate physical, electronic, and procedural safeguards to protect personal information. We secure our databases with various physical, technical, and procedural measures, and we restrict access to information by unauthorised persons.

We also train all employees on their responsibility to safeguard customer data and provide them with appropriate guidelines for adhering to our Branch’s Privacy policy.

Encryption, and other methods are used to protect sensitive information. The method of protection is based on the sensitivity of the data that is shared with customers and other third parties under contract to do business with Everest.

We will hold personal information in electronic and physical form. These include:

• In our secure computer systems or databases;
• In paper records; and/or
• In telephone and digital recordings (for use in training and verification purposes).

Personal information may be held in the cloud or on overseas databases in countries such as Singapore, the United Kingdom, and North America.

We take several steps to protect the personal information we have collected including:

• Operating secure buildings and systems;
• Working with trusted service providers;
• Training our staff on keeping personal information secure; and
• Keeping personal information only for as long as we require for our business needs or required by law.

In the unlikely event that there is an unauthorised use or disclosure of personal information, we will notify the individual of the data breach and will undertake an investigation into how the data breach occurred and its severity. As part of this, we will endeavour to work with the individual and the Privacy Commissioner to limit the impact, and reoccurrence, of the breach.

We have appropriate systems infrastructure and regularly test their resiliency to support the appropriate management of the branch, as well as support our obligations to clients and business partners.

We have implemented and continue to update multi-layer controls and processes to protect data and other intellectual property including network security controls, logical and physical access controls, up-to-date managed inventories (authorised hardware and software), system monitoring, and incident response procedures.

Physical Security

We use security personnel (where necessary) surveillance measures and put access controls in place to prevent unauthorised access to our systems and data stores. We also protect our locations from physical hazards as well as regularly test our response capabilities with local municipalities to maintain business continuity and deliver optimal service to our clients and business partners.

Network Security

We use boundary firewalls and internet gateways to prevent unauthorised access to or from private company networks. We have controls to ensure that only those who should have access to systems have access at the appropriate level. We ensure that virus and malware protection is installed and maintained to apply appropriate software updates and vulnerability patches.

Application Security

Secure configuration practices are in place to ensure systems are configured in the most secure way for the needs of the Branch. We follow processes for developing, adding, and testing security features within applications to prevent security vulnerabilities and protect against threats such as unauthorised access and modification.

Vulnerability Assessment

Potential vulnerabilities in our technology asset portfolio are identified by performing periodic vulnerability scans.

Training

• EIR ensures that security awareness training for the entire branch is conducted regularly (at a minimum at least annually), and that ongoing communication of Program initiatives are permeated throughout the organization.
• We advise and regularly train all Everest employees and relevant contractors about their responsibility to protect customer data, and we provide them with appropriate guidelines for adhering to our company’s business ethics standards and confidentiality policies.
• All Employees are expected to review the applicable Company Website Privacy Notice Everest Group Privacy Notice and comply with the Program Policies, Standards and Guidelines which specify how to handle PII on the company page Employee Privacy training program

We will provide an individual with access to any information we hold on request, except where privacy laws permit us to withhold information.

In limited circumstances, however, access may be refused if required or permitted by law. For example, they may be refused access to their personal information which relates to:

• Anticipated or existing legal proceedings and that information could not be subject to a process of discovery;
• Information regarding our negotiations with you;
• Legal advice we have received in relation to your claim;
• Where providing access poses a serious threat to life, health, or safety or if access may have an unreasonable impact on the privacy of other individuals; and
• Where we are prohibited by law from providing access (such as investigations by government bodies).

The Privacy Officer handles inquiries and requests from customers and individuals regarding their personal information. This includes providing information about data collection, access, correction, complaints, and data removal processes. The Privacy Officer can be contacted on email: Privacyofficer_Australia@everestglobal.com.

The Office of the Australian Information Commissioner (OAIC) is an independent national regulator for privacy and information management in Australia. If the Privacy Officer is unable to address a person’s queries, the OAIC can be contacted for further information. Their contact information is available on the OAIC website

The Branch reviews this policy regularly, in light of changes in regulation or as deemed necessary by the SOOA.

Signed on behalf of Everest International Reinsurance, Ltd., Australia Branch

Jason Keen

Senior Officer Outside Australia

Date:  1 November 2024