STL (Bahamas) Data Protection Policy (2022.08) VU

DATA PROTECTION POLICY (THE BAHAMAS)

Last Revised: August 2022

OUR COMMITMENT TO PROTECT YOUR PRIVACY
Stewart Title Limited (“Stewart”) is a leading provider of title insurance. Stewart is a company registered in England and Wales with a licensed branch in The Bahamas. We are registered as a data controller with the Information Commissioner's Office under registration number Z6980449.

Your privacy is important to us. As a data controller, we are responsible for deciding how we collect, store, manage and use personal information about you. We understand how important it is to protect and safeguard any personal information that you provide to us. We are committed to ensuring that we are open and transparent about the manner in which we collect, store, manage and use personal information that you may provide to us. In the United Kingdom, we abide by the General Data Protection Regulation and Data Protection Act, 2018. In The Bahamas, we abide by the Data Protection (Privacy of Personal Information) Act, 2003 (“Act”).

CHANGES TO OUR DATA PROTECTION POLICY
We regularly review our Data Protection Policy (“Policy”); when we do, the date at the top of this page will be updated and the revised policy shall be effective as of that date.

WHAT INFORMATION WE COLLECT AND WHY
We collect personal information when you (i) browse our websites, (ii) make general inquiries about our products and services, (iii) order a product or service from us, or (iv) you file a claim under a policy we have issued to you.

We rely upon the following lawful bases for collecting your personal information:

Pursuant to the Act:

1. Personal information relates to any information about a living individual whose identity can, directly or indirectly, be reasonably determined from the relevant information or in conjunction with other information in our possession.
2. Sensitive personal information relates to personal data about an individual’s race origin, politicalopinions or religious other beliefs, physiological/mental health, trade union involvement or activities,sexual life or criminal convictions and proceedings.

We will never collect any unnecessary personal information from you and we do not process your information other than as specified in this Policy. We do not collect sensitive personal information for the purposes of assessing a request for, or when providing you with, our products and services.

We have outlined below the personal information we may collect as it varies depending on the nature of our interaction with you and based on local requirements.

CONSEQUENCES OF NOT PROVIDING PERSONAL INFORMATION

You are not obligated to provide your personal information to us. However, in most cases, if you do not provide us with the required personal information, we may not be able to:

• provide our services to you or your associated company or other entity
• issue you with any premium refunds (where applicable)
• assess, investigate and finalise a claim which you may make under a polic

SHARING AND DISCLOSING PERSONAL INFORMATION WITH OTHERS
Access to your personal information is restricted to employees and trusted third party providers (“Data Processors”) in accordance with the lawful bases outlined in this policy. A non-exhaustive list of who we may share your personal information with includes:

• professional advisors who assist us with our legal, tax, audit and accounting obligations (e.g. accounting firms and law firms)
• real property professional advisers such as property valuers, licensed conveyancers, land surveyors, building consultants, and solicitors and/or notaries
• third party advisers who assist with investigating, assessing and settling claims
• affiliated companies that provide us with management tools and services
• companies that provide us with internal management and data sharing tools
• companies that provide us with email marketing tools to help us manage our email communications
• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets with 

The Data Processors we use can only process your personal information in accordance with our instructions, in compliance with data protection laws, and must demonstrate they have implemented appropriate confidentiality and security measures. You may contact our Privacy Office for a current list of the Data Processors we work with.

WHERE WE COLLECT PERSONAL INFORMATION FROM
We may collect information in the following ways:

• directly from you by way of telephone, email, post, text or fax communication, as well as in person and at industry events
• from people acting on your behalf such as lenders, lawyers, mortgage brokers, valuers, surveyors, accountants, finance brokers, real estate agents and conveyancers (“Representatives”)
• by way of an online form or application submitted by yourself or your Representatives
• publicly and commercially available sources such as land registry offices, online conveyancing services and other similar services

HOW WE USE ’COOKIES’
Our websites and web-based applications (“Sites”) use cookies and similar technologies to improve the user experience and to ensure the Sites are functioning effectively and properly. A cookie is a small text file that is placed on a computer or other device and collects information about your usage of the Sites, such as time spent on a website, pages visited, and user preferences such as default language for the site.

We may use a variety of cookies on our Sites:

Necessary Cookies: These cookies are essential to enable you to navigate the Sites and to use their features. Without these cookies, services you have asked for cannot be provided. For example, a cookie must be used to allow you to securely log in to a restricted area of these Sites.

Performance or Analytic Cookies: These cookies collect information about how you use our Sites. For example, these cookies collects information such as the browsers and operating systems used, the domain name of the website previously visited, the number of visits, average duration of visit, and pages viewed. These cookies are used to gather statistical information that allows us to improve the design, user-friendliness and functionality of our Sites. They provide us with overall patterns of usage on the Sites—we don’t use this information to observe the usage of a single person.

Preference Cookies: These cookies allow the website to remember and maintain choices and preferences you make concerning your use of the Sites. For example, these cookies collect information such as your username or ID, language preference or multimedia player settings. These cookies can also be used to remember changes you have made to text size, fonts, and other customizable parts of web pages.

Social Media Cookies: These cookies collect information about your social media usage. By placing social media ‘buttons’ on our Sites, you are able to share or bookmark pages from our Sites. These third party social media sites may log information about your activities on the Internet including on our sites. You should review their usage and privacy policies to understand exactly how social media companies use your information and to find out how to opt-out, or delete, such information.

Cookies can also be of two forms:

Persistent: information these cookies collect remain stored for a pre-determined length of time, even after you close your browser.

Session: information these cookies collect expire and are permanently lost when you close your browser. As such, when you restart your browser and revisit the website that created the cookie, the site will not recognize you—a new session cookie will need to be generated.

On our Sites, we use necessary, performance and preference cookies. We use the information collected by these cookies for security purposes, to facilitate your navigation of our Sites, to allow you to fully utilize our Sites features and to continually improve upon your user experience of the Sites. By using our Sites, you agree that we can place cookies on your computer or device as explained in this policy.

Most web browsers automatically accept cookies but provide controls that allow you to block or delete them. If you are not comfortable with our use of cookies, you may reconfigure your browser settings to limit cookie usage and you can always change those settings at any time. However, if you decide to limit or refuse the use of cookies, certain functions and features of our Sites may not work as intended.

In most modern browsers, you can block or delete cookies by clicking Settings > Privacy > Cookies. Other browsers may provide instructions for blocking or deleting cookies within their privacy or help documentation. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.

HOW WE PROTECT PERSONAL INFORMATION
We implement appropriate technical and organisational measures to protect and secure your personal information from unauthorised access, unlawful processing, accidental loss or disclosure, misuse, alteration or corruption. A non-exhaustive list of these measures include:

• secure servers
• lockable filing cabinets and restricted access to offices
• password protection/encryption of files
• password protection on all laptops and computers
• encryption of attachments for sensitive personal information sent by email

All our employees receive regular privacy awareness training which includes instruction as to the careful disposal or destruction of personal information. We also have procedures in place to deal with any suspected personal information breaches and will notify you and the appropriate data protection authority where we are legally required to do so.

HOW LONG WE KEEP PERSONAL INFORMATION
We retain your personal information only for as long as is necessary in order to fulfil the purposes outlined in this policy or as required because of certain laws (e.g. for tax, legal or accounting purposes). Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent. When no longer required, personal information will be destroyed, erased or made anonymous in an appropriate manner.

INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION
When you visit our websites, use our products or services, or contact us to make general inquiries, the personal information you submit is stored and transferred to our affiliated companies in Canada and the United States. We may also utilise certain products or services hosted in countries in and outside of the UK and the European Economic Area ("EEA"). By submitting your personal information, you are agreeing to this transfer, storage and/or processing to allow us to provide you with our products and services.

These transfers, whether to a third party or to a corporate affiliate, are for the following purposes: administrative, data back-up, claims administration, reinsurance, website hosting, email server hosting, email communications management, and the management and processing of policies.

Such transfers are on the basis of a variety of legal mechanisms and we ensure (i) the necessary level of protections are in place for your personal information, which are equivalent to such protections afforded under the Act, (ii) strict agreements and measures set out by our company to protect your data are being complied with and (iii) relevant data protection laws are being complied with. Regulatory authorities and enforcement agencies in these other countries may access your personal information in accordance with their laws.

YOUR RIGHTS AND HOW TO CONTACT US
You have the right to request a copy of the personal information that we hold about you as well as to correct inaccurate or incomplete personal information. Unless there is a valid reason for not doing so (and you will be so notified), we will respond within forty (40) days of the receipt of such requests. You also have the right to request (i) erasure (where appropriate), (ii) portability, or (iii) restricted processing of your personal information in accordance with the Act, which request shall be complied with within forty (40) days upon receipt of the request.

A request from you to exercise any of the above rights must be made in writing and to verify your identity, we will require appropriate identification (for example, a certified copy of your passport) before we will act on any request.

Please make your written request by email or post to:

By email: STLBahamas@stewart.com

By post: Stewart Title Limited, P.O. Box N-136, Nassau, Bahamas, Attention: Legal

With a copy to: Stewart Title Limited, 11 Haymarket, London, SW1Y 4BP, Attention: Privacy Office

If you have any questions or concerns about your privacy and our privacy practices, it is our hope that you will contact us first to address these issues; however, if you feel we have not adequately dealt with your concerns, you may also contact your local data protection authority.