Privacy Policy

Our Contact Details

Director
Otter Audit Ltd
4635 Wyandotte Street East
Windsor ON N8Y 1H6
Canada
enquiries@otteraudit.ca

What type of information we have

We collect and hold personal data associated with insurance transactions that you may have been involved with when dealing with one or more of our clients and their agents. 

How we collect:

• Collect from our clients (i.e. your insurer), online insurance market databases (i.e. Lloyd’s central market due diligence systems), and other relevant stakeholders (i.e. TPAs) when necessary.

• Collect personal information through paper or online applications for audit services, on the telephone, through online chat, or through email.

• Collecting personal information through cookies and preferences on our website; use of cookie consent manager?

The type of information is determined by the client and provided by their agent. This can include sensitive personal data and the personal data of children. Personal data can include, but is not limited to, the following: name, address, telephone number, email address, age, gender, ID numbers, income, ethnic origin, medical records, credit records, etc.

How we get the information and why we do we have it:

PIPEDA, or the Personal Information Protection and Electronic Documents Act, is a Canadian law that governs how private-sector organizations collect, use, and disclose personal information. It aims to protect individuals' privacy rights while supporting electronic commerce.

Under PIPEDA, the lawful bases we rely on for processing this information are:

• We have a contractual obligation.

We collect personal information from our client, your insurer. The insurer provides the information themselves or through an agent. 

We use this data to:

1. Perform an exception analysis

2. To select a sample to conduct an audit of the transaction

3. To conduct a compliance audit of the insurance agent

Your insurers are under a legal and regulatory obligation to audit their agents. We collect and hold your data to allow insurers to meet those obligations.

Manage risk and compliance with law and regulations:

• Prevent and protect you and us from crime, fraud, misrepresentation, or cyber crime

• When asked provide your information to law enforcement, courts, and/or other authorities inside and outside of Canada

• Comply with tax requirements/

Insurers will provide us with a scope of work including a time frame which informs the review period. We process data within the instructed scope.

What we do with the information

The information is reviewed against the terms of the delegated authority contract between the insurer and their agent, and any applicable provincial and territorial laws and regulations. 

The outcomes of the review are prepared in a pseudonymised report which is provided to the insurer. This may be provided through a third party system, such as Lloyd’s DAM.

How we store your information

Information is stored in a secure cloud based system in the EU. Information is stored for up to 6 years, in line with instructions from the insurer, for the purposes of dispute resolution.

The cloud based storage system has retention policies that delete data automatically.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access - You have the right to ask us for copies of your personal information.

• Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

• Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.

• Your right to object to processing - You have the the right to object to the processing of your personal data in certain circumstances.

• Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

• Your right to ask us about our privacy practices.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at enquiries@otteraudit.ca if you wish to make a request.

How to Complain

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113