Enstar Australia Data Privacy Notice

The policy of Enstar Group Limited and its subsidiaries (“The Company” “our” “us” or “we”) is to respect and protect the privacy and data protection rights of individuals whose data we process during the course of our business, including data relating to, customers, and claimants.

To fulfil this policy, we agree to exercise the safeguards and precautions set out in this written notice (the “Privacy Notice”) to respect the rights of anyone whose data we process.

Our representative office in Australia is: Enstar Australia Limited, Level 6, 3 Spring Street, Sydney, New South Wales, 2000 Australia.

As a group with a global presence, we are subject to differing data protection legislation where we operate. Our aim is to be as consistent as possible; to obey all applicable laws; and to apply the highest standard of privacy principles to our approach.

This Privacy Notice sets out our policies and practices with respect to:

• What personal information we may hold or collect
• How we may use your personal information and who we may disclose your personal information to
• Lawful bases
• Data transfers to third parties
• International Transfers
• Data storage
• Your rights
• Retention Periods
• Data Security
• Interfaces with third party websites etc
• How to contact us
• How changes to this Privacy Notice will be made

What personal information we may hold or collect

We may process the following data categories:

• Information including your name, address, contact details, details relating to the claim (which depending upon the nature of the claim may include medical reports and reports of criminal convictions or crime reports) (“Claim Details”) that you, your employer, an organisation that we insure, or another third-party provide to us in relation to the administration of an insurance/reinsurance policy that we insure or reinsure.
• Information relating to any request for assistance or support, including your name, address, contact details and details of any vulnerabilities (which may include medical reports) and financial information to support the claim.
• Details of your visits to our website and information collected through cookies and other tracking technologies including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, usage information and the resources that you access.
• Information you supply when you directly interact with us, which may include call recording information.

Sensitive information may include:

• Information relating to any criminal or fraudulent activities provided to us by you or third parties (such as anti-fraud agencies or other insurers).
• Health information you supply to us or that is provided to us with your consent as part of the claims administration process.

We collect this information from the following sources:

• Information from you supplied during the course of a claim, or that is provided to us with your consent
• From authorised third parties who support our processing and handling of the claim.
• When assuming responsibility for administering policies and claims that relate to a book of insurance business.
• From public sources to eliminate the purpose of fraud.

How we may use your personal information and who we may transfer it to

We process your personal data for the following purposes:

• Policy and claims administration. We use your personal information in performance of our contract and claims management process, to facilitate settlement of any valid claims, including identifying you and carrying out appropriate checks.
• Compliance with applicable laws and regulations as well as security, and compliance with corporate financial responsibilities. This includes For Fraud Prevention, Know Your Client, Sanctions Screening and Anti Money Laundering purposes.
• When you visit our website, we may collect information using essential cookies about your device and how you use our website. For example, we may collect your device identification number, browser type and version, operating system and platform, hardware used, browser plug-in types and versions, IP address (which may reveal your location), URLs, referrer URL, date and time of access, information about page response times, length of visits to certain pages, interaction information (such as scrolling, clicks, and mouse-overs), error reports and performance data (Device Information). We may use your personal data contained within this Device Information because it is in our legitimate interests to ensure the proper use, functioning, maintenance and security of our website. For further information please see our Cookie Policy.
• When you use our website and consent to our use of non-essential cookies, we may use the personal data contained within your Device Information with your consent to improve our website and to better understand how people use it. Further information about the information we collect and how we do this is set out in our Cookie Policy.
• When you provide us with feedback, we may use your feedback to make improvements to our website, our ways of communicating with you, and our wider offerings, because it is in our legitimate interests to make these improvements.

Lawful basis

Our lawful basis for processing your personal information varies depending on the purpose of processing; for example the basis might be where the processing is reasonably necessary for or directly related to our functions or activities.

Data transfers to third parties

We may transfer your personal data to third parties who are primarily business partners, reinsurers, third party administrators, and other parties involved in the processing of insurance claims.

We are sometimes required to share data with other entities to comply with a law or regulation; or in order to enforce or apply our terms of use and other agreements; or to protect our customers’ or others’ rights. This could include state or federal authorities, courts, external advisors, and similar third parties. It may also include exchanging your personal data with other companies and organisations for the purposes of fraud prevention.

Our transfers are subject to a process of risk assessment. We have formal agreements in place with recipients outside Australia to ensure they provide an adequate level of protection for your data, including technical and organisational security measures to protect your personal data.

International Transfers

We have formal agreements in place with recipients outside Australia to ensure they provide an adequate level of protection for your data, including technical and organisational security measures to protect your personal data.

In addition to Australia, Enstar Group Companies are located in Bermuda, the USA, the United Kingdom, and the European Union. Where personal data transfers occur to these destinations, they are governed by safeguards which include International Group Data Transfer Agreements which contain, where necessary, the appropriate Model Contract Clauses for such transfers. We may transfer any information we collect mentioned above to Enstar Group companies within these destinations.

Whenever we transfer your personal data outside of your home jurisdiction, we ensure it receives appropriate protection as required by law. To keep this notice as short and easy to understand as possible, we have not set out the specific circumstances in which each of these protection measures are used. You can contact us using the details below for more information about this.

Data Storage

We store your personal data on third-party/internal servers. When working with third parties, we may need to transfer your personal data outside of your home jurisdiction.

Your Rights

You may have the following rights depending on the circumstances of your case and applicable local law.

• The right to access – you have the right to ask us for copies of your personal information. We may charge you a proportionate fee for this service. We will inform you of the charge and explain the reasons for it when you make the request.
• Request for correction – you can request that we correct your personal information that you believe is incorrect.
• The right to rectification – you have the right to ask that the Company correct any information you believe is inaccurate. You also have the right to request the Company to complete the information you believe is incomplete.
• The right to erasure – you have the right to ask that the Company erase your personal data, under certain conditions.
• The right to restrict processing – you have the right to ask that the Company restrict the processing of your personal data, under certain conditions.
• The right to object to processing – you have the right to object to the Company’s processing of your personal data under certain conditions (for example, you might wish to withdraw consent to direct marketing).
• The right to data portability – you have the right to ask that the Company transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• The right to complain to the regulator. If you are not satisfied with the way we have handled the request, you have the right to lodge a complaint with us or the supervisory authority for data protection in your country. The supervisory authority for data protection in Australia is The Office of the Australian information Commissioner (“OAIC”). You may submit a privacy complaint through the OAIC website.

If you make a request, we have 30 calendar days to respond to you. If you would like to exercise these rights, please contact the Data Protection Officer at Enstar: [email protected].

Automated Decision Making

Enstar does not engage in automated decision making or use artificial intelligence for processing the personal data it collects.

Retention Periods

We only retain data for as long as necessary to process your data. Our retention policy varies depending on the categories of information we collect and according to applicable law. Due to the nature of our business, we hold most information for ten years, but this could be longer depending on our obligations to you or whether we have an ongoing legal dispute with you. A copy of our retention policy can be obtained on request.

Data Security

We take the security of your data seriously and we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, including:

• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
• the ability to restore the availability and access to personal data in a timely manner, unless this has been irrevocably anonymized or erased; and
• a process for regularly testing and evaluating the effectiveness of technical and organisational measures.

We ensure that those who have permanent or regular access to personal data, or who are involved in the processing of personal data, or in the development of tools used to process personal data, are informed of their responsibilities when processing personal data.

Interfaces with Third Party Websites and Services

Our websites and apps may contain links, references, and content from other websites and services outside of our control. We have limited or no control over these websites and services, and this Privacy Notice does not apply to them. We suggest you read the Privacy Notices of the relevant third-party website or service.

How to contact us

If you wish to access your personal data, request we correct details, file a complaint relating to our handling of your personal data or if you have any questions concerning this notice, please contact the Data Protection Officer at Enstar: [email protected].

How changes to this Privacy Notice may be made

We may occasionally make changes to this Notice. When we make material changes to it, we’ll provide you with prominent notice as appropriate under the circumstances e.g. by displaying a prominent notice on our website.

Last revised: August 2026