Enstar UK & EEA Data Privacy Notice

The policy of Enstar Group Limited and its subsidiaries (“The Company” or “we”) is to respect and protect the privacy and data protection rights of individuals whose data we process during the course of our business, including data relating to customers and claimants.

To fulfil this policy, The Company agrees to exercise the safeguards and precautions set out in this written notice (the “Privacy Notice”) to respect the rights of anyone whose data we process.

Our office in the UK can be found at 12th Floor 70 Mark Lane, London EC3A 7NQ.

For the EU: Both Starstone Insurance SE and Alpha Insurance NV are located at H/O Hive 5, Securex Building, 3rd Floor, Cours Saint Michel 30, 1040 EtterBeek, Brussels, Belgium.

As a group with a global presence, we are subject to differing data protection legislation where we operate. Our aim is to be as consistent as possible, to obey all applicable laws, and apply the highest standard of data protection and privacy principles to our approach.

This Privacy Notice sets out:

1. What personal information (also known as “Personal Data) we may hold or collect;
2. How we may use your personal information;
3. Our Lawful Bases;
4. Who we may disclose your personal information to;
5. International Transfers;
6. Data Storage;
7. Contacting us and your rights to access and update your personal information;
8. Automated Decision Making;
9. Retention Periods;
10. Data Security;
11. Interfaces with third party websites etc
12. How to contact us;
13. Data Protection Policy; and
14. How changes to this Privacy Notice will be made.

1. What personal information we may hold or collect

We may process the following data categories depending on our relationship with you:

• Information including your name, address, contact details, details relating to the claim (which depending on the nature of the claim may include medical reports and reports of criminal convictions or crime reports) (“Claim Details”) that you, your employer, an organisation that we insure, or another third-party provide to us in relation to the administration of an insurance/reinsurance policy that we insure or reinsure.
• Information relating to any request for assistance or support, including your name, address, contact details and details of any vulnerabilities (which may include medical reports) and financial information to support the claim.
• Details of your visits to our website and information collected through cookies and other tracking technologies including, but not limited to, your IP address and domain name, your browser version and operating system, traffic data, location data, web logs and other communication data, usage information and the resources that you access.
• Information you supply when you directly interact with us which may include call recording information.

Sensitive or Special Category Personal Data may include:

• Information relating to any criminal or fraudulent activities provided to us by you or third parties (such as anti-fraud agencies or other insurers).
• Health/Medical information you supply to us as part of the claims administration process.
• Information used in fraud prevention or sanctions checking public lists.

We collect this information from the following sources:

• Information from you supplied during the course of a claim.
• From authorised third parties who support our processing and handling of the claim.
• When assuming responsibility for administering policies and claims that relate to a book of insurance business.
• From public sources for the purpose of fraud prevention.

2. How we may use your personal information

We process your personal data for the following purposes:

• Policy administration. We use your data in performance of our contract with you to provide you with the policy you requested. This includes when we may need to contact you for the purpose of administering our service to you.
• Claim processing. We use your data in performance of our contract with you to process any claims you make under your policy.
• Providing payments. We will use your data to provide you with any payments due to you as a result of any claims you have made.
• Compliance with applicable laws and regulations as well as security, and compliance with corporate financial responsibilities. This includes For Fraud Prevention, Know Your Client, Sanctions Screening and Anti Money Laundering purposes.
• When you visit our website, we may collect information using essential cookies about your device and how you use our website. For example, we may collect your device identification number, browser type and version, operating system and platform, hardware used, browser plug-in types and versions, IP address (which may reveal your location), URLs, referrer URL, date and time of access, information about page response times, length of visits to certain pages, interaction information (such as scrolling, clicks, and mouse-overs), error reports and performance data (Device Information). We may use your personal data contained within this Device Information because it is in our legitimate interests to ensure the proper use, functioning, maintenance and security of our website. For further information please see our Cookie Policy.
• When you use our website and consent to our use of non-essential cookies, we may use the personal data contained within your Device Information with your consent to improve our website and to better understand how people use it. Further information about the information we collect and how we do this is set out in our Cookie Policy.
• When you provide us with feedback, we may use your feedback to make improvements to our website, our ways of communicating with you, and our wider offerings, because it is in our legitimate interests to make these improvements.

3. Lawful basis

Our lawful basis for processing this data varies depending on the purpose of processing; these are outlined below.

• Where we process your personal data for the performance of contractual obligations to which you are a party, our lawful basis is that it is necessary for the performance of a contract.
• Where we process your personal data to progress the efficiency of the company and analyse how data subjects interact with us, our lawful basis is legitimate interest.
• Where we have a legal obligation to comply with applicable law or where we defend a legal claim, our lawful basis is processing is required for compliance with a legal obligation or in defence of a legal claim

4. Who we may disclose your personal information to

We may transfer your personal data to third parties who are primarily business partners, reinsurers, third party administrators, and other parties involved in the processing of insurance claims. In addition, we are sometimes required to share data with other entities to comply with a law or regulation. This could include state or federal authorities, courts, external advisors, and similar third parties.

Our transfers are subject to a process of risk assessment. We have formal agreements in place with recipients outside of the UK and EU to ensure they provide an adequate level of protection for your data, including technical and organisational security measures to protect your personal data.

5. International Transfers

Enstar Group companies are also located in Australia, Bermuda, and the USA. Where personal data transfers occur to these destinations, they are governed by safeguards which include International Group Data Transfer Agreements which contain, where necessary, the appropriate Model Contract Clauses and for the UK International Data Transfer Addendum for such transfers. We may transfer any information we collect to Enstar Group companies.

We have formal agreements in place with non Enstar recipients outside of the UK and EU to ensure they provide an adequate level of protection for your data, including technical and organisational security measures.

Whenever we transfer your personal data outside of your home jurisdiction, we ensure it receives appropriate protection as required by law. To keep this notice as short and easy to understand as possible, we have not set out the specific circumstances in which each of these protection measures are used. You can contact us using the details above for more information about this.

6. Data Storage

We store your personal data on third-party/internal servers. When working with third parties, we may need to transfer your personal data outside of your home jurisdiction.

7. Contacting us and your rights to access and update your personal information

We observe a number of data subject rights as required by law and adopted by Enstar Group as our standard. You may have the following rights depending on the circumstances of your case and applicable local law.

• The right of access – you have the right to ask the Company for copies of your personal data.
• The right to rectification – you have the right to ask that the Company correct any information you believe is inaccurate. You also have the right to request the Company to complete the information you believe is incomplete.
• The right to erasure – you have the right to ask that the Company erase your personal data.
• The right to restrict processing – you have the right to ask that the Company restrict the processing of your personal data, under certain conditions.
• The right to object to processing – you have the right to object to the Company’s processing of your personal data under certain conditions.  (for example you might wish to withdraw consent to direct marketing).
• The right to data portability – you have the right to ask that the Company transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• The right to complain to the regulator – If you are not satisfied with the way we have handled the request, you have the right to lodge a complaint with us or the supervisory authority for data protection in your country. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You may make a complaint to the ICO through the ICO’s website or by calling 0303 123 1113. In Belgium the supervisory authority is the Autorite de protection des donnees (APD) Gegevensbeschermingsautoriteit (GBA) Rue de la Presse 35, 1000 Brussels, +32 (0) 22744800.
• The right not to have your data sold to third parties – Enstar will not sell or rent your data unless we are engaged in the sale of the company or part of the company and in such case, we would need to transfer your data to honour our continuing obligations to you.

To exercise your Rights, please contact the Data Protection Officer at Enstar: [email protected]

8. Automated Decision Making

Enstar does not engage in automated decision making or use artificial intelligence for processing the personal data it collects.

9. Retention Periods

We only retain data for as long as necessary to process your data. Our retention policy varies depending on the categories of information we collect and according to applicable law. Due to the nature of our business, we hold most information for ten years, but this could be longer depending on our obligations to you or whether we have an ongoing legal dispute with you. A copy of our retention policy can be obtained on request.

10. Data Security

We take the security of your data seriously and we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, including:

• the pseudonymisation and encryption of personal data;
• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to restore the availability and access to personal data in a timely manner, unless this has been irrevocably anonymised or erased; and
• a process for regularly testing and evaluating the effectiveness of technical and organisational measures.

We ensure that those who have permanent or regular access to personal data, or who are involved in the processing of personal data, or in the development of tools used to process personal data, are informed of their responsibilities when processing personal data.

11. Interfaces with Third Party Websites and Services

Our websites and apps may contain links, references, and content from other websites and services outside of our control. We have limited or no control over these websites and services, and this Privacy Notice does not apply to them. We suggest you read the Privacy Notices of the relevant third-party website or service.

12. How to contact us

If you have any questions concerning this notice, please contact the Data Protection Officer at Enstar: [email protected].

13. Data Protection Policy

Our Data Protection Policy, outlining the measures we have in place, can be requested from the Data Protection Officer at Enstar: [email protected].

14. How changes to the Privacy Notice will be made

We may occasionally make changes to it. When we make material changes, we will provide a prominent notice as appropriate e.g. by displaying a prominent notice within our online services.

Last revised: August 2026