(Effective October 25, 2018)
Before we get started, here are a few terms we think you should know as you read this Policy.
“Data Protection Laws” refers to the laws that are designed to protect your personal data and privacy in the place where you live. This includes the “GDPR”, the European data protection law which stands for “General Data Protection Regulation”, with the official name Regulation (EU) 2016/679 of the European Parliament and of the Council. It also includes “PIPEDA” (Personal Information Protection and Electronic Documents Act), which is the Canadian Data Protection Law that applies to our activities in Canada.
“Personal data” – this is information we collect from you or about you and which is defined in the GDPR as “any information relating to an identified or identifiable natural person.” It can be as simple as your name or your email, or something more complicated like an online identifier (usually a string of letters and / or numbers) that gets attached to you. Under PIPEDA, the equivalent concept is “personal information”, which is roughly the same. Any mention of “personal data” in this Policy shall also mean personal information.
About Us and Contacting Us
Slice is actually three different but related companies who are owned by the same people – in the U.K. (Slice Labs UK Limited), the U.S. (Slice Insurance Technologies Inc.) and Canada (Slice Labs Inc.). All of those companies are committed to protecting your privacy and conforming to the Data Protection Laws applicable to you.
Under the GDPR, Slice is a “Data Controller”. That means we collect personal data directly from you and determine the purpose and means of “processing” that data. “Processing” is a broad term that means collection, use, storage, transfer or any other action related to your personal data; it is used in this Policy and other documents linked to from this Policy in that way.
If you want to ask us anything about what’s in this Policy, or anything else privacy or data related, you can email firstname.lastname@example.org. Here are our mailing addresses for you as well:
|Slice Labs UK
2 Leman Street
|Slice Insurance Technologies
33 Irving Place, Suite 4017B
New York, NY 10003
|Slice Labs Inc.
2197 Riverside Drive, Suite 502
Data Protection Officer
In addition to the contact information above Slice has designated a Data Protection Officer (DPO) who is responsible for all personal data matters at Slice. If you have a specific complaint or wish to invoke your legal rights under any Data Protection Law, please contact our DPO directly:
Data Protection Officer
833-729-3732 in North America
0330 808 5583 in Europe
You have the following rights regarding your personal data held by Slice, and other rights:
- The right to withdraw at any time your consent for Slice to process your personal data;
- The right to have your personal data erased from Slice’s records;
- The right to access your personal data and any relevant information around its processing and use;
- The right to have a copy of your personal data given to you in an easy to read format so that you can transfer it to another data processor;
- The right to have your personal data corrected if you believe it is inaccurate;
- The right to restrict the processing of your personal data if it is inaccurate or if our processing or use of it is against the law; and
- The right to refuse any marketing targeted at you by Slice.
If you wish to exercise any of these rights, please contact our DPO at the contact information above.
Personal Data Collected from You and What We Use It For
In the table below, please find all the personal data we may collect from you directly, what we use it for, and the legal basis under the GDPR for us having and processing this personal data. Under PIPEDA, the legal basis is your informed consent, and by submitting this personal data you acknowledge having granted this consent to Slice.
|Personal data category||Personal data processed||What we use it for
(the “purpose” of processing)
|Legal basis for processing under the GDPR|
|Contact information||Your email address, phone number||To communicate with you||Your consent in giving us this information|
|Employment application information||Your name, your email address, and any personal data in your cover letter or CV||To find out if you are a good fit to work with Slice!||Your consent in giving us this information|
|Account information||Name, email address, mailing address, and address of any properties you wish to insure||To create an account for you, to communicate with you, and to sell you insurance||Your consent and performance of a contract between you and us|
|Insurance information||Details about what you want to insure, whether the property you are renting, your car, your business, etc.||To sell you insurance and determine what that insurance should cost||Performance of a contract between you and us|
|Billing information||Credit card holder name, number, expiration date, CVV number and billing address||To allow you to pay for the insurance you want to purchase||Performance of a contract between you and us|
|Claims information||Any personal data included in pictures or other documents sent to us when making a claim under your insurance||To determine if your claim is warranted, and if so, the amount to be paid to you||Performance of a contract between you and us|
Where you have provided personal data further to the contract between you and us, if you fail to provide such data or withdraw your consent to use such data, we will no longer be able to sell you insurance or process your claim.
Personal Data Collected About You from Third Parties and What We Use It For
Sometimes we get personal data about you from third parties. This table explains the details about this personal data – what it is, where it came from, what we do with it, and legal basis for us having and processing this personal data under the GDPR. Under PIPEDA, the legal basis is your informed consent. None of this data comes from publicly-available sources.
|Personal data category||Personal data processed||Who we get the data from||What we use it for
(the “purpose” of processing)
|Legal basis for processing under the GDPR|
|Insurance information||Details about what is to be insured, for example your property||A third party you have authorized to buy insurance on your behalf||To provide you with insurance||Performance of a contract between you and us|
|Claims information||Any personal data about you such as your name and contact information||A Slice user who submits information about you when they make a claim||To determine if the user’s claim is warranted, and if so, the amount to be paid||Your consent given to the Slice user|
Who We Transfer Your Personal Data To
We routinely share some of your personal data with certain types third parties who are identified in the table below along with what they do with it. Some of those third-party recipients may be based outside your home jurisdiction. If you are in the European Economic Area — please see the “Transfer of Your Personal Data Outside of the European Economic Area” further down in this Policy for more information including on how we safeguard your personal data when this occurs.
We will never share your personal data with other third parties except under these circumstances.
|Personal data category||Who we transfer it to||What they do with it|
|Contact information||Companies that provide email or SMS services||Send you emails or SMS messages|
|Account information (including contact information)||
||Underwrite your insurance, communicate with you about insurance, various needs to sell you insurance|
||Various tasks in selling you insurance including validating information you submit|
|Billing information||Payment processing companies, particularly Stripe||Process your payments for insurance you buy|
|Claims information||Companies that process claims||Process and determine the value of your claim|
|Advertising identifiers||Companies that provide ad networks, like Google and Facebook||Show you ads for Slice when you are on the internet|
|Analytics identifiers||Companies that provide data analytics||Provide us with analytics as to how the services are used, and to trace fraudulent activities|
Tracking Technology (“Cookies” and Related Technologies) and Advertising
How We Protect Your Personal Data
We have implemented very strict technical and organisational procedures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed by us. These procedures prevent your personal data from being lost; or used or accessed in any unauthorised way.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable supervisory authority of a suspected data security breach where the Data Protection Laws requires us to do so, and within the time frame required by the applicable Data Protection Law.
When you buy insurance through Slice, your personal data is transferred with encryption using Transport Layer Security (“TLS”), the highest security standard for Internet transactions.
Transfer of Your Personal Data Outside of the European Economic Area (EEA)
For our European users, we endeavour to keep your personal data inside the EEA. However, certain of our data processors (and some of Slice!) are in other countries where your personal data may be transferred. However, these countries are limited to countries with particular circumstances that protect your data, specifically:
- Canada. Canada has been determined to have an “adequate level of protection” for your personal data under European data protection law.
- The United States. Your personal data is only transferred to companies in the United States that: (1) participate in the Privacy Shield, which includes Slice as described in the next section of this Policy; and (2) have signed agreements with us or have informed us that they are GDPR-compliant.
That’s it! You have the right, however, to refuse to have your data transferred outside the EEA. Please contact our DPO to make that request.
EU-U.S. and Swiss-U.S. Privacy Shield Frameworks
As an American company, Slice Insurance Technologies Inc. complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from users in the European Union and Switzerland to the United States, respectively. Slice Insurance Technologies Inc. has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.
To read the details of Slice’s participation in the EU-U.S. and Swiss-U.S. Privacy Shield Framework, please read our EU-U.S. and Swiss-U.S. Privacy Shield Policy.
Supervisory Authorities and Complaints
If you are in the EEA, under the GDPR you have the right to make a complaint to the appropriate supervisory authority. If you are not satisfied with the response received or the actions taken by our DPO, or if you would like to make a complaint directly about Slice’s data practises, we invite you to contact the supervisory authority in your country. If you are in the U.K., you should contact the Information Commissioner’s Office who is the supervisory authority. You can reach them in a variety of ways, including by phone (0303 123 1113 in the UK) and mail (Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF).
The full listing of all Data Protection Authorities (the supervisory authorities) across the EEA can be found here.
Your personal data will only be kept for as long as it is necessary for the purpose needed for that processing. For example, we will retain your account information for as long as you need to have an account with us.
Because insurance is a heavily regulated industry, sometimes we have to keep your data for a longer period of time to satisfy our requirements under the law, so we may retain your personal data for a longer time based on this factor.
Slice uses certain automated decision-making processes, taking some of your personal data, especially insurance information, to determine the cost of the insurance you purchase from us.
Children’s Privacy Statement
The Services are not intended for children under the age of 13. We do not knowingly collect any personal data from a child under 13. If we become aware that we have inadvertently received personal data from a person under the age of 13 through the Services, we will delete such information from our records.
Changes to This Privacy Notice
The date at the top of this page indicates when this Policy was last updated. Every now and then, we will have to update this Policy. You can always find the most updated version at this URL, and we will always post a notice on our website if we make big changes. If you have a Slice account, we will also email you to tell you the Policy has been updated, and what the important changes are.