Privacy Notice

Your privacy matters and it’s important to us that you read the information in this Policy. Learn more about how your personal information is used by PG Mutual in the information below.

Last update 01 Jan 2020.

General Information

1. Address contact details for the Data Controllers

For Income Protection Plus or PG Mutual membership matters, the Data Controller to contact is:

Pharmaceutical and General Provident Society Limited, trading as PG Mutual
11 Parkway
Porters Wood
St Albans
AL3 6PA

For information relating to third party services endorsed by PG Mutual, the Data Controller to contact is:

P&G Insurance Services Limited, trading as PG Mutual Services
Pharmaceutical and General
11 Parkway
Porters Wood
St Albans
AL3 6PA
2. Email contact details for the Data Controllers
If you wish to contact PG Mutual or PG Mutual Services via email, please use either:
- the secure contact facility provided on our website
- or send an email to: info@pgmutual.co.uk
3. Telephone contact details for the Data Controllers

If you wish to contact PG Mutual or PG Mutual Services via telephone, please call us on 01727 840095.
4. Who to contact

PG Mutual and PG Mutual Services have chosen not to appoint a Data Protection Officer. However, should you have any questions relating to your data rights or our data protection policies, please contact our Membership Services team using the contact information provided in this Privacy Policy.
5. Information Commissioner registration details
PG Mutual and PG Mutual Services are registered with the Information Commissioner’s Office and the registration numbers are:
- PG Mutual: Z4619081
- PG Mutual Services: ZA020831
6. Legal information about the Data Controllers

Pharmaceutical and General Provident Society Limited, trading as PG Mutual is an incorporated friendly society under the Friendly Societies Act 1992 and registered on the Mutual Services Register under reference number 462F.

PG Mutual is authorised by the Prudential Regulation Authority, and regulated by the Financial Conduct Authority and the Prudential Regulation Authority, firm reference number 110023

P&G Insurance Services Limited, trading as PG Mutual Services is a company limited by shares in accordance with the Companies Act 2006 and its Companies House registration number is 05290304.
7. How we protect your data

PG Mutual and PG Mutual Services maintains rigorous security policies and procedures designed to protect your data against loss, misuse, alteration, unauthorised access and theft. While for security and confidentiality purposes we do not publish details about our security policies, the Board of Directors of PG Mutual have implemented governance arrangements to ensure regular monitoring of security protocols and their effectiveness.
8. How data relating to minors' is processed

PG Mutual and PG Mutual Services will not collect or process personal data for a minor without fully complying with the special rules for consent when dealing with minors.

In the rare cases of a minor looking to apply for Income Protection Plus or Private Medical Insurance, the consent of an appropriate guardian will first be necessary.
9. How long we keep your data

Any data you have consented to PG Mutual or PG Mutual Services using for marketing purposes will be kept as long as your consent has not been withdrawn. However, we will at appropriate intervals ask you to confirm the details you have provided remain correct.

Any data used by PG Mutual or PG Mutual Services for the purpose of preparing or performing your contract with us, or for the purpose of complying with a regulatory or statutory compliance or reporting requirement, will normally be held for at least fifteen years after the completion of your contract for the purpose of protecting us against any future legal claims.

How we use your data and why

10. Income Protection Plus quotations
In order for PG Mutual to provide you with a Quick Quotation for Income Protection Plus, we will require you to provide the following personal information:
- Your Date of Birth;
- Your gender;
- Your smoking status;
- Your occupation;
- Your required cover or your monthly budget limit for the insurance; and
- Any discount code you may be entitled to use.
We also request your name, email or telephone number as PG Mutual may wish to contact you to help you with your enquiry as there a wide variety of quotation options to notify you of, and we may also remind you periodically by email, telephone or text not to forget about your quotation.

You are of course welcome to withdraw your consent to us using this information at any time.
11. Private Medical Insurance quotations
In order for PG Mutual Services to provide you with a Quick Quotation for private medical insurance, we will require you to provide the following personal information:
- Your Date of Birth;
- Whether your spouse is to be included;
- Your spouse’s Date of Birth if included; and
- The number of children under 26 years of age you wish to include.
We also request your name, email or telephone number as PG Mutual Services may wish to contact you to help you with your enquiry as there a wide variety of plans available via PG Mutual Services to notify you of, and we may also remind you periodically by email, telephone or text not to forget about your quotation.

You are of course welcome to withdraw your consent to us using this information at any time.
12. Applying for Income Protection Plus
In order to apply for Income Protection Plus, PG Mutual will require:
- Your name;
- Your Date of Birth;
- Your gender;
- Your contact information;
- Your occupation and income information;
- Information about your medical history;
- Any relevant current or previous insurance information;
- Your required cover choices;
- Any discount code you may be entitled to use; and
- Your direct debit details.
PG Mutual requires this information for the purpose of processing and assessing your application for Income Protection Plus membership, and to prepare the policy terms for such membership.

Please remember that you are under a legal obligation when providing information for the purpose of obtaining insurance cover to take reasonable care to make sure the details you provide are full and accurate to the best of your knowledge. Failure to do so could lead to a future claim being declined or your insurance policy being cancelled without any refund.
13. Applying for Private Medical Insurance
In order to apply for Private Medical Insurance via PG Mutual Services, we will require the following:
- Your name;
- Your Date of Birth;
- Your contact information;
- Information about your medical history and that of any family members to be insured;
- Any relevant current or previous insurance information;
- Your required cover choices;
- Any promotional terms you may be entitled to use; and
- Your direct debit details.
While this information is collected by PG Mutual Services via our online application platform, the completed application is passed to our partner the Hospital and Medical Care Association who, as the insurer and administrator of the Private Medical Insurance you are applying for, will become the Data Controller.

Please remember that you are under a legal obligation when providing information for the purpose of obtaining insurance cover to take reasonable care to make sure the details you provide are full and accurate to the best of your knowledge. Failure to do so could lead to a future claim being declined or your insurance policy being cancelled without any refund.
14. Management of your PG Mutual membership
PG Mutual is a ‘mutual insurer’. This means that if you successfully apply for Income Protection Plus cover from PG Mutual, you will automatically become a member of our Society as well as becoming a policyholder.PG Mutual will therefore need to use the data you provided when applying for Income Protection Plus cover to administer your policy in accordance with your policy terms, and your membership in accordance with the Rules of PG Mutual. The most common processing purposes will be:
- Sending you policy documentation;
- Acting on any enquiries you may have about your policy or your membership;
- Processing your membership subscriptions;
- Managing any claims you make for income benefit;
- Processing any withdrawals from your capital account;
- Providing you with annual bonus and annual renewal statements; and
- Notifying you of any General Membership meetings and providing you with relevant background information for those meetings.
In addition to this, PG Mutual may from time-to-time contact you via telephone or email to ask for your feedback on matters relevant to the Board of Directors duty to govern the organisation in the best interests of our members. PG Mutual therefore believes it is in the legitimate interests of you, our members for the data we hold about you to be used for this purpose. You will be given appropriate opportunity to opt out of such feedback communications if you wish.
15. Management of PG Mutual income benefit claims
The primary purpose of PG Mutual’s Income Protection Plus product is to provide you with a replacement income should you be incapacitated by disease, illness or injury. However, in order to process, assess and manage any claim you make for income benefit in accordance with your policy terms we will normally require the following information:
- More information about your occupation, your duties and your income;
- Medical information about your condition and your capacity;
- Information relating to any other protection policies you may have relevant to your claim;
- Information about the medical attendants and any consultations or investigations relating to your claim;
- Information about your employment and your employer.
As part of our claim process, some of your data may be shared with third parties such as credit agencies, investigators or medical consultants for the purpose of protecting PG Mutual against financial crime and to ensure we meet our responsibility to all PG Mutual members to administer claims in accordance with our organisations Rules.
16. Administration for your nominees
As a member of PG Mutual, you are entitled to nominate at least one person who, in the event you die during your membership, may receive a direct payment from PG Mutual once we are in receipt of the Certificate of Death. We will also use your duly registered nominee(s) for the purpose of processing any Enhanced Loyalty Bonus they may be eligible for under your membership terms.

In order to register your nominee(s), we will require the following information about them:
- Their full name;
- Their Date of Birth;
- Their address; and
- Their telephone number.
PG Mutual will then hold this data as it will be necessary for us to be able to fulfil our legal obligation to the nominee(s) under the Friendly Societies Act 1992. You, our member can later revoke or amend a duly registered nomination if you wish.
17. Website cookies

PG Mutual does use cookies to help us to manage and monitor our website service. Please consult the Cookies Policy on our website for more information about the cookies we use and how we use them.
18. Product marketing

If you have provided consent to the Data Controller to receive such communications, you may receive information about other products or services available through PG Mutual or PG Mutual Services. You can withdraw your consent at any time and, if you are a member of the Data Controller, you can alter your communication preferences for marketing materials in your Members Area.

Who we share your data with and why

19. Telephone medical interviews

With your consent, with a medical interview service provider for the purpose of either obtaining medical information relevant to an application for Income Protection Plus or a claim for Income Protection Plus benefit.
20. Crime prevention

PG Mutual and PG Mutual Services are committed to supporting the Financial Conduct Authority’s efforts to reduce financial crime. As part of its regulatory obligations we will use your data to help us prevent financial crime including sharing that data with regulators, law-enforcement or judicial bodies, and third-party credit and financial crime prevention organisations.
21. Regulatory authorities

PG Mutual and PG Mutual Services is subject to a number of statutory and regulatory obligations to submit relevant financial, policy and performance reports to regulatory bodies. Your data may be used by us as necessary to meet these statutory responsibilities.
22. Employers paying Income Protection Plus premiums for staff

If you were introduced to PG Mutual by your employer and they are paying any of your premium on your behalf, PG Mutual may share some of your data with that employer to confirm your continued participation in the scheme and verify premium levels.
23. Introduction discounts from Partner Associations

If you were introduced to PG Mutual through a partner association, we may share some of your data to verify your membership of the partner association to confirm your eligibility for any offers you may have claimed, or to prepare invoices where the partner association pays any premium on your behalf.
24. Recorded telephone calls

PG Mutual generally records telephone calls made to and from its team for the purpose of monitoring service quality standards and for use in any complaint or legal claim brought against it. If your call has been recorded, it will generally be stored by our telephone service provider.

If you do not wish to have a telephone call us with recorded, PG Mutual reserves the right to insist that an alternative method of communication be used instead.
25. Electronic record storage

In accordance with best practice standards, PG Mutual and PG Mutual Services arrange for its electronic records to be regularly backed-up for service continuity and disaster recovery purposes. These records are backed-up externally to a specialist data storage third party for security and safety.
26. Data processed outside the European Economic Area (“EEA”)
While PG Mutual makes every effort to retain your data within the United Kingdom, from time-to-time third parties used by the PG Mutual may process your data outside the EEA. In these circumstances, your data will only be transferred on one of the following conditions:
- the country is approved by the European Commission as providing an adequate level of protection for personal information; or;
- the recipient has agreed with us standard contractual clauses approved by the European Commission, obliging the recipient to safeguard the personal information; or
- there exists another situation where the transfer is permitted under applicable data protection legislation (for example, where a third-party recipient of personal data in the United States has registered for the EU-US Privacy Shield).
PG Mutual is aware that Microsoft Outlook 365, the email service we use for our email communications, is backed-up to servers located in the United States of America. However, we have confirmed that any data transmitted to the USA from the EEA by Microsoft is done in compliance with the model contract terms prepared by the European Union for the protection of your data.

Your Data Rights

27. Right to Access

You have a general right to ask PG Mutual for copies of the personal information we hold about you. This right always applies. Please note that this right may be subject to limitations allowed by legislation so you may not receive all the information you request.

You can read more about this right here.
28. Right to Rectification

You have the right to ask PG Mutual to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

You can read more about this right here.
29. Right to Erasure

You have the right to ask us to erase your personal information in certain circumstances. Please note that this this right may be subject to limitations allowed by legislation, and we may be entitled to refuse requests where exceptions apply.

You can read more about this right here.
30. Right to Restrict Processing

You have the right to ask us to restrict the processing of your personal information in certain circumstances. Please note that this this right may be subject to limitations allowed by legislation, and we may be entitled to refuse requests where exceptions apply.

You can read more about this right here.
31. Right to Object to Processing

You have the right to object to processing if we are able to process your information because the process forms part of our legitimate interests.

You can read more about this right here.
32. Right to Data Portability

This right only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.

You can read more about this right here.
33. Your data rights, charges and response time

You are not required to pay any charge for exercising your data rights, and PG Mutual and PG Mutual Services will have one month to respond to your request.

Please note that there are some exceptions allowed by law but PG Mutual’s general policy is not to take advantage of these exceptions unless it considers it necessary to do so.
34. Complaints or Queries

PG Mutual and PG Mutual Services aim for the highest standards when collecting, processing, safeguarding and using personal information. For this reason, we will take any complaint you may have very seriously. Please inform us at the earliest opportunity of any complaint you have, and we will look to resolve the matter as soon as possible.

If you have any questions about our Privacy Policy, or if you want to know what information we have collected about you, please contact us.

If you are not satisfied with how we deal with your complaint, you can refer the matter to the Information Commissioner’s Office (www.ico.org.uk).
35. Changes to this Policy

The Data Controller regularly reviews this Privacy Policy and the last modified date is highlighted below. Any changes to our Privacy Policy will supersede the previous version of our Policy and we will take reasonable steps to draw your attention to any changes. We suggest that you regularly read this document to ensure that it continues to meet with your approval.

Last modified date: 8 March 2019