Common use of USING PERSONAL INFORMATION Clause in Contracts

USING PERSONAL INFORMATION. We use personal information to undertake activities relating to the setting up, administration and renewal of our policies, products and services. This includes processing applications and handling any claims. For the majority of our business we will rely on the performance of our contractual arrangements with you as the legal basis for processing. We do not use policyholder, member or beneficiary personal data for marketing purposes and we do not make your personal information available to third parties for the purpose of direct marketing. The nature of our business is to provide investments, life and pensions cover, critical illness, income protection and employer-related group products. To do this we need to use the personal information provided to carry out analysis of actuarial risks (risks of gains or losses), mortality and morbidity risks and pricing. This will be carried out in accordance with the Institute & Faculty of Actuaries’ data handling protocols. We use an underwriting engine to process some applications and quotations which will use an element of automated decision making. Exceptionally, we may rely on our legitimate interests to process your personal data. When we do, we will demonstrate compelling legitimate grounds for doing so. For employer-related group insurance products the DPA permits appropriate information about employees to be provided by an employer to an insurer without individual consent (including details of long-term absentees, current and previous claimants, and medical underwriting decisions). For employer-related group products the DPA permits that members may individually withdraw their consent, in those instances Canada Life will be unable to provide cover for that individual. When medically underwriting or assessing a claim we will obtain consent from the employee. Sharing personal information We share personal information only on the basis of the purposes for which it was collected. This notice is intended to illustrate the instances where data may be shared. However, we will share your data only for the limited and compatible purposes for which it was originally obtained: • with other Canada Life group companies including those outside the European Economic Area (EEA); • with any of our service providers, reinsurers and / or regulators; • with other insurers and government agencies, including without limitation Her Majesty’s Revenue and Customs (HMRC), Department of Work and Pensions (DWP); • in order to prevent, detect or investigate financial crime including fraud or other criminal activity, we may share your data with other companies (including private investigators), organisations (including fraud prevention agencies and databases), public bodies (including the police) and associations and credit reference agencies; • we will not share your medical information with anyone other than yourself without your consent except as described in the next bullet point. This includes your employer, spouse, other relatives, friends or your legal or professional adviser. In some circumstances, it may be appropriate to advise your employer about your medical information, for example, to recommend alternative supportive therapy. However, we will seek your consent in such circumstances; • for employer-related products and services only, some medical information related to underwriting decisions and non-medical information about you necessary for lawful policy and claim administration purposes will be shared with your employer; • we will not share non-medical information concerning you with your spouse, other relatives, friends or your legal or professional adviser unless you provide your consent to us in writing; • for insurance related products, with your own doctor or relevant medical professionals; and/or • in any circumstances if permitted or required to do so by law or if we have your consent to do so. International Transfers Given the global nature of our business, we use third party suppliers and outsourced services (including cloud- based services), which can require transfers of personal information outside of the EEA. In doing so, we will ensure there are contractual arrangements in place with those organisations who have appropriate organisational and technical measures to protect your personal information. Data Protection Notice (continued) Retention of your personal data We will keep your personal data only for so long as is necessary and for the purpose for which it was originally collected. In particular, for so long as there is any possibility that either you or we may wish to bring a legal claim under this insurance, or where we are required to keep your personal data due to legal or regulatory reasons.

USING PERSONAL INFORMATION. We use personal information to undertake activities relating to the setting up, administration and renewal of our policies, products and services. This includes processing applications and handling any claims. For the majority of our business we will rely on the performance of our contractual arrangements with you as the legal basis for processing. We do not use policyholder, member or beneficiary personal data for marketing purposes and we do not make your personal information available to third parties for the purpose of direct marketing. The nature of our business is to provide investments, life and pensions cover, critical illness, income protection and employer-related group products. To do this we need to use the personal information provided to carry out analysis of actuarial risks (risks of gains or losses), mortality and morbidity risks and pricing. This will be carried out in accordance with the Institute & Faculty of Actuaries’ data handling protocols. We use an underwriting engine to process some applications and quotations which will use an element of automated decision making. Exceptionally, we may rely on our legitimate interests to process your personal data. When we do, we will demonstrate compelling legitimate grounds for doing so. For employer-related group insurance products the DPA permits appropriate information about employees to be provided by an employer to an insurer without individual consent (including details of long-term absentees, current and previous claimants, and medical underwriting decisions). For employer-related group products the DPA permits that members may individually withdraw their consent, in those instances Canada Life will be unable to provide cover for that individual. When medically underwriting or assessing a claim we will obtain consent from the employee. Sharing personal information We share personal information only on the basis of the purposes for which it was collected. This notice is intended to illustrate the instances where data may be shared. However, we will share your data only for the limited and compatible purposes for which it was originally obtained: • with other Canada Life group companies including those outside the European Economic Area (EEA); • with any of our service providers, reinsurers and / or regulators; • with other insurers and government agencies, including without limitation Her Majesty’s Revenue and Customs (HMRC), Department of Work and Pensions (DWP); • in order to prevent, detect or investigate financial crime including fraud or other criminal activity, we may share your data with other companies (including private investigators), organisations (including fraud prevention agencies and databases), public bodies (including the police) and associations and credit reference agencies; • we will not share your medical information with anyone other than yourself without your consent except as described in the next bullet point. This includes your employer, spouse, other relatives, friends or your legal or professional adviser. In some circumstances, it may be appropriate to advise your employer about your medical information, for example, to recommend alternative supportive therapy. However, we will seek your consent in such circumstances; • for employer-related products and services only, some medical information related to underwriting decisions and non-medical information about you necessary for lawful policy and claim administration purposes will be shared with your employer; • we will not share non-medical information concerning you with your spouse, other relatives, friends or your legal or professional adviser unless you provide your consent to us in writing; • for insurance related products, with your own doctor or relevant medical professionals; and/or and/ or • in any circumstances if permitted or required to do so by law or if we have your consent to do so. International Transfers Given the global nature of our business, we use third party suppliers and outsourced services (including cloud- cloud-based services), which can require transfers of personal information outside of the EEA. In doing so, we will ensure there are contractual arrangements in place with those organisations who have appropriate organisational and technical measures to protect your personal information. Data Protection Notice (continued) Retention of your personal data We will keep your personal data only for so long as is necessary and for the purpose for which it was originally collected. In particular, for so long as there is any possibility that either you or we may wish to bring a legal claim under this insurance, or where we are required to keep your personal data due to legal or regulatory reasons.