PRIVACY NOTICE

For Clients in compliance with

QATAR FINANCIAL CENTRE (QFC) DATA PROTECTION RULES AND REGULATIONS 2021

This privacy notice explains when and why we collect your personal information, how we use it, how we keep it secure and your rights in relation to Personal Data.

In accordance with Article 14 & 15 of the QFC Data Protection Regulations 2021, we would like to inform you that:

1. Identity of Data Controller

Seib Insurance and Reinsurance Company LLC (“the Company”, “we”, “our”, “Seib” or “us”), a company Authorized by the Qatar Financial Center Regulatory Authority (QFCRA), Qatar Financial Centre (QFC) License number 00114 and having its offices at Airport Road, Sheikh Jabor Bin Youssef Bin Jassem Al Thani Building, Ground Floor, P.O. Box 10973 Doha – Qatar is the Data Controller which collects, uses and is responsible for processing your Personal and Sensitive Data in manual and electronic format.

2. Collection of Personal Data

We collect and use your personal data, meaning any information that identifies or allows one to identify you. Depending among others on the types of products or service we provide to you and the interactions we have with you, we collect various types of personal data about you, including:
Identification information: e.g., full name, gender, place and date of birth, nationality, identity card number, national register number, passport number, driving license number, vehicle registration number, photograph, signature, compliance related documents (including a copy of your national identity card or passport);
Contact information: (private or professional) postal address, e-mail address, phone number;
Information relating to your financial and family situation: e.g., marital status, number of children and age, study or employment of children or yourself, composition of the household, property you own, apartment or house;
Lifestyle: hobbies and interests, travel, your environment;
Economic, financial and tax information: e.g., tax ID, tax status, country of residence, salary and other income, value of your assets;
Education and employment information: e.g., level of education, employment, employer’s name and remuneration;

Banking and financial information related to the products and services you hold: e.g., bank account details, products and services owned and used, credit card number, money transfers, assets, profile of declared investor, credit history, payment incidents;
Transaction data: account movements and balances, transactions including beneficiary’s data such as full names, addresses and contact details as well as details of bank transactions, amount, date, time and type of transaction (bank card, transfer, cheque, direct debit);
Data relating to your habits and preferences in relation to the use of our products and services;
Data collected from our interactions with you: your comments, suggestions, needs collected during our exchanges with you in person and online during phone communications (conversation), discussion by email, chat, exchanges on our social media pages and your latest complaints. Your connection and tracking data such as cookies and tracers for non-advertising or analytical purposes on our websites, online services, applications, social media pages;
Data collected from the video protection system (including CCTV) and geolocation;
Data about your devices (mobile phone, computer, tablet, etc.): IP address, technical specifications and uniquely identifying data;
When you access our websites or our applications, data transmitted by your browser or device you are using and automatically recorded by our server, including date and time of the access, name of the accessed file as well as the transmitted data volume and the performance of the access, your device, your web browser, browser language and requesting domain, and IP address (additional data will only be recorded via our Website if their disclosure is made voluntarily, e.g., in the course of a registration or request). When you visit our website or out applications, that website or application will contain additional information about how we use your information while you are visiting that website;
In some cases, we collect this information from public registers which may include beneficial ownership and other registers, public administration or other third-party or public sources, such as screening services, intermediaries that facilitate data portability. We might also collect certain of the above Personal Data types in relation to your business relationship, such as your additional business partners (including other shareholders, or beneficial owners), dependants or family members, representatives or agents. Where you are a corporate client, we may also collect information about your directors, representatives, employees, shareholders, authorised signatories or beneficial owner.
We may collect sensitive data such as health data, biometric data, or data relating to criminal offences, subject to compliance with the strict conditions set out in data protection regulations.

We collect personal data directly from you; however, we may also collect personal data from other sources. We sometimes collect data from public sources: publications/databases made available by official authorities or third parties (e.g., brokers, dealers etc.); websites/social media

pages of legal entities or business clients containing information that you have disclosed (e.g., your own website or social media page); public information such as that published in the press. We also collect personal data coming from third parties:

from other Group entities;
- from our customers (companies or individuals);
- from our business partners, brokers, intermediaries;
- from service providers;
- from third parties such as Third Party Administrators (TPAs) and fraud prevention agencies;
- from data brokers who are responsible for ensuring that they collect relevant information in a lawful manner.

3. Lawfulness of processing

The lawful basis for processing your Personal and Sensitive Data is the performance of our contractual relationship and its obligations including preliminary steps to its establishment.
- We will inform you in case we need to process your personal data for a purpose different than the one mentioned above and seek your consent, if needed.
- Depending on the purpose of the processing activity (see Section 4), the legal basis for the processing of your Personal Data will be one of the following:
necessary for taking steps to enter into or executing a contract with you for the services or products you request, or for carrying out our obligations under such a contract;
necessary to comply with an obligation imposed on the Company by law;
necessary for the legitimate interests of the Company, without unduly affecting your interests or fundamental rights and freedoms and to the extent such Personal Data is necessary for the intended purpose. (See below for examples of legitimate interests of the Company);
necessary to perform a task carried out in the public interest; or
we have obtained prior consent (for instance where required by law) or processed with your explicit consent.

Examples of the “legitimate interests” referred to above are:

manage our relationship with you and to help us to learn more about you as a client, the products and services you receive, and other products and services you may be interested in;
evaluate whether and how we may offer products, services and events that may be of interest to you;
prevent fraud or criminal activity, misuses of our products or services as well as the security of our information, IT systems, architecture and networks and security of our premises;
receive and handle complaints, requests or reports from you or third parties made to designated units within the Company or the Group;

take steps to improve our products and services and our use of technology and to conduct market research;
cooperate with a request made in any actual or potential proceedings or the inquiries of a public or judicial authority;
certain situation when we make the disclosures, providing products and services and assuring a consistently high service standard across the Group, and keeping our clients, employees and other stakeholders satisfied.

To the extent that we process any sensitive Personal Data relating to you, we will do so because:

the processing is necessary to comply with a legal obligation imposed on the data controller by law;
the processing is necessary for the performance of our contractual relationship;
the processing is necessary for the establishment, exercise or defense of a legal claim;
the processing is necessary for substantial public interest reasons;
the processing relates to personal data which are manifestly made public by you; or
you have given your explicit consent to us to process that information (where legally permissible). In each of the above cases we are also applying adequate safeguards before processing your sensitive Personal Data.

4. Purposes of Processing your Personal Data and Sensitive Data

We process your Personal Data for a variety of purposes related to our contractual relationship which may include:
Managing and processing your insurance with us, including underwriting, reinsurance, and claims handling;
We may also collect your personal information to reply to your request for quote and offer you products that meet your insurance needs and use the personal information to send you information about our products and services and any other services described in our website or Mobile app;
record keeping and other mandatory legal obligations;
Client onboarding: to verify your identity and assess your application. For legal and regulatory compliance checks (for example, to comply with anti-money laundering regulations, and prevent fraud);
Client Relationship Management. For example, to:
- Manage our relationship with you, including communicating with you in relation to the products and services you obtain from us and from our business partners, handling customer service-related queries and complaints, claims handling, and policy endorsement or cancellation (in accordance with applicable law);
- help us to learn more about you as a client, the products and services you receive, and other

products and services you may be interested in receiving, including profiling based on the processing of your Personal Data, for instance by looking at the types of products and services that you use from us, how you like to be contacted.

Engaging in prospecting and business development and / or protecting and enhancing the Seib brand. For example, to evaluate whether and how the Company may offer products, services and events that may be of interest to you;
Supporting, Enhancing and Maintaining the technology. For example, to take steps to improve our products and services and our use of technology, including testing and upgrading of systems and processes, and conducting market research to understand how to improve of our existing products and services or learn about other products and services we can provide;
To provide you with some of our products or services, we may need to collect and process sensitive personal information (such as information about any criminal convictions or the state of your health) about you and others who are a party to the service or product. We will only use sensitive personal data for the specific purpose for which you provide it. Please ensure that you only provide us with sensitive information about other people with their express agreement. We will never ask for sensitive information like your Credit or Debit Card Number, CVV, PIN, OTP, online passwords, etc. Please do not provide or share these details via emails/SMS or on calls received from individuals claiming to be from Seib;
We want to be able to offer you access to the full range of products and services that best meet your needs. Once you are a customer and unless you object, we may send you these offers electronically for our products and services if they are similar to those you have already subscribed to. We will ensure that these commercial offers relate to products or services that are relevant to your needs and complementary to those you already have to ensure that our respective interests are balanced. We may also send you, by phone and post, unless you object, offers concerning our products and services if you consent. If you have provided your contact information to us and would prefer not to receive marketing information, or to participate in research, simply contact us to let us know;
Compliance and Risk Management and / or Crime Prevention, Detection and Investigation. For example, to:
- carry out legal and regulatory compliance checks as part of the onboarding process, including to comply with anti-money laundering regulations and fraud prevention;
- meet our on-going regulatory and compliance obligations (e.g., laws of the financial sector, anti-money laundering and tax laws), including in relation to recording and monitoring communications, disclosures to tax authorities, financial service regulators and other regulatory, judicial and governmental bodies or in proceedings and investigating or preventing crime;

receive and handle complaints, requests or reports from you or third parties made to designated units within the Group;
- reply to any actual or potential proceedings, requests or the inquiries of a public or judicial authority;
- prevent and detect crime, including fraud or criminal activity, misuses of our products or services as well as the security of our IT systems, architecture and network.

5. Direct Marketing Purpose

The information you supply may be used by us and carefully selected third Parties for research purposes or to inform you of other products or services that may be of interest to you unless you have advised us otherwise. On each occasion that we contact you for these purposes, you will always be given the option to opt out of any further communication. If you have provided your contact information to us and would prefer not to receive marketing information, or to participate in research, simply contact us to let us know.

6. Recipients of your Data

In compliance with the purpose for which your data have been collected and in accordance with the QFC Data Protection Regulations, we would like to inform you that your Personal and Sensitive Data may be shared with the following:
As a member of the Chedid Group we work closely with the Group’s other companies worldwide. Your personal data may therefore be shared between Group entities, where necessary, to:
- comply with our various legal and regulatory obligations described above;
- fulfil our legitimate interests and those of the entities of the Group, which are: assisting each other in fulfilling our legal, regulatory and contractual obligations in the course of our business.
- In order to fulfil the purposes described in this Privacy Notice, we may, where necessary or provided for in our services, share your personal data with:
processors which perform services on our behalf e.g., IT services, logistics, printing services, telecommunication, advisory and distribution and marketing;
Insurance/Reinsurance partners, independent agents, intermediaries or brokers, financial institutions, counterparties;
public services if such transmission is required to allow us to provide you with the services and products or execute our contractual obligations or transactions;
local or foreign financial, tax, administrative, criminal or judicial authorities, arbitrators or mediators, public authorities or institutions (such as the QFCRA/QFCA, Qatar Central Bank etc.), to which we, or any member of the Group, are required to disclose pursuant to:

their request;
- our defence, action or proceeding;
- complying with a regulation or a recommendation issued from a competent authority applying to us or any member of the Group;
certain regulated professions such as lawyers, notaries, actuaries or auditors when needed under specific circumstances (litigation, audit, etc.) as well as to our partners or to an actual or proposed purchaser of the companies or businesses of the Group;
universities and public and/or private scientific institutions;
Any legitimate recipient required by applicable laws or regulations.;
Where we transfer your data to service providers processing data on our behalf, we take steps to ensure they meet our data security standards, so that your Personal Data remains secure.

7. Data Transfer to other countries

We generally transfer your Personal Data abroad to countries which are considered by the QFCA Data Protection Office to provide an adequate level of data protection. In some cases, we can also transfer your Personal Data to Countries that do not guarantees adequate protection only if at least one of the following conditions is met:
the transfer is based on appropriate safeguards including enforceable rights and effective legal remedies for data subjects;
you have provided your explicit consent for one or more specific purposes after being informed of the risks;
the transfer is necessary for the performance of a contract between you and us, for the implementation of precontractual measures taken at your request, or for the performance of a contract concluded in your interest between the data controller and a third party;
the transfer is necessary to comply with a legal obligation on us;
the transfer is necessary to perform a task carried out in the public interest;
the transfer is necessary for the establishment, exercise or defence of a legal claim.

A copy of these measures and safeguards can be obtained by contacting us. If and to the extent required by applicable law, we implement the necessary legal, operational and technical measures and/or enter into an agreement with you before such transfers.

8. Third Party Requests

We will not share your Personal Data with any third parties without your prior consent (which you are free to withhold) except where we are required to do so by law or as set out in paragraph 8.2 below.

In case we need to share your Personal Data to third parties (for example: service providers, contractors and subcontractors) for purposes related to the performance of our contractual relationship, we will disclose only Personal Data that are necessary for the purpose, ensuring that adequate protection of your Data is in place.

9. Mandatory Disclosure of your Personal Data and Sensitive Data

Disclosure of your Personal and Sensitive Data to statutory bodies such as the Ministry of the State of Qatar, judicial bodies and any other governmental authorities or departments, among others, will take place only if required by law, and in accordance with their requirements.

10. Data retention

We will only retain Personal Data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements. As far as necessary, we will keep your data for the duration of our insurance relationship subject to applicable legal and regulatory requirements. In addition, we might process your data after the termination of our relationship for compliance or risk management in accordance with the applicable laws as well as pursuant to various retention and documentation obligations or if it is in the Company’ legitimate interest. However, if you wish to have your Personal Data removed from our databases, you can make a request as described in Section 11 below, which we will review as set out therein.

11. Individual rights

In line with the QFC Data Protection Regulations in force, you have the right to:
access your personal data
request an update to your personal data
request and obtain information on how your personal data is processed
request and obtain correction of your personal data
request and obtain erasure of your personal data in certain circumstances (right to be forgotten)
request to suspend the use of your personal data
right to withdraw your consent
object to processing or request and obtain restriction on the processing of your personal data
be notified in case of data breach which can result in a high risk to your rights and freedom
When Personal Data is processed for direct marketing purposes, your right to object extends to direct marketing, including profiling to the extent it is related to such marketing. You may object to direct marketing by contacting us at any time.
Where we process your Personal Data on the basis of your consent, or where such processing is necessary for entering into or performing our obligations under a contract with you, you may have the right to request your Personal Data be transferred to you (known as the ‘data portability’ right).

You also have the right to ask us for information regarding some or all of the Personal Data we collect and process about you.

In certain circumstances we may process your Personal Data through automated individual decision-making, including profiling. Where this takes place, you will be informed of such processing and be given information on criteria and procedures applied. Except where legal exceptions apply, you can request to obtain a human intervention, to express your point of view and to contest the decision where such a decision is exclusively based on automated individual decision-making, including profiling.

We will honour above requests, withdrawal or objection as required under applicable data protection rules but these rights are not absolute: they do not always apply and exemptions may be engaged. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to understand your request better. If we do not comply with your request, we will explain why.

Exercising your rights:

You can exercise the above rights by contacting us.

If you are not satisfied with how the Company processes your Personal Data, we would like to discuss it with you to understand how we can rectify the issue. If you would like to speak to us about our use of your Personal Data, you can contact us. If you are not satisfied with the Company’s response, you have the right to make a complaint to the Qatar Financial Centre Authority (“QFCA”).

12. Protection of your Personal Data

All our employees accessing Personal Data must comply with our internal rules and processes in relation to the processing of your Personal Data to protect them and ensure their confidentiality. The Company and the Group have also implemented adequate technical and organisational measures to protect your Personal Data against unauthorised, accidental or unlawful destruction, loss, alteration, misuse, disclosure or access and against all other unlawful forms of processing.
1. We will notify you promptly in the event of any breach of your personal data which might expose your rights and freedom to serious risk.

13. Changes to your personal data

We are committed to keeping your Personal Data accurate and up to date. Therefore, if your Personal Data changes, please inform us of the change as soon as possible.

14. Complaint

Any complaints related to alleged breaches of Data Protection Regulations can be filed with:

Employment Standards Office of the QFC – Data Protection Directorate

QFC Tower 1 – West Bay – Dafna – Doha (Qatar)

P.O. Box: 23245

Email: esodp@qfc.qa

T. (+974) 44967609

15. Additional Information

Where the Personal Data we collect from you is needed to meet our legal or regulatory obligations or enter into an agreement with you, if we cannot collect this Personal Data there is a possibility, we may be unable to on-board you as a client or provide products or services to you (in which case we will inform you accordingly).
1. Please be informed that, if you are requested to provide us with your consent and you are unable to do so, this may result in us being unable to comply with the relevant laws and regulations imposed on us, as applicable to the intended contractual relationship.

By continuing to use our services (whether directly or through third party arrangements) and by providing any personal data (including sensitive personal data) to us, you are consenting to our use of your personal data as set out in this Privacy Policy. Please do not send us any personal data if you do not want that information to be used by us in this manner.

17. Changes

This Notice was updated in June 2022. We reserve the right to amend it from time to time. Any amendment or update to this Notice we will make available to you. Please visit the Company’s website frequently to understand the current Notice, as the terms of this Notice are closely related to you

18. Our Contact Details:

If you wish to exercise the rights listed above or if you have any questions or complaint relating to our use of your personal data under this Privacy Notice, please submit a request by email addressed to:

compliance@seibinsurance.com

or you can send your request at below address:

Seib Insurance and Reinsurance Company LLC, Airport Road, Street 310, Zone 45, Building 220, Doha, Qatar, P.O. Box -10973

T. (+974) 44026888