Mercer Privacy Notice 

This Privacy Notice describes how Mercer and its subsidiaries (collectively, the “Company”), collect, use, share, retain, transfer and otherwise process information relating to identified or identifiable individuals (Personal Data), and the rights you may have regarding your Personal Information. We believe that it is important for you to understand how we process Personal Information and encourage you to take a moment to familiarize yourself with our privacy practices outlined below.

Please note that in some instances we act on behalf of and under the instructions of clients, or other partners who act as controllers. Please refer to their respective privacy policies for more information regarding the processing of your Personal Information in these contexts.

Depending on your jurisdiction and the specific service offered, the Company may solely determine the means and purposes of processing your Personal Information (and therefore would be acting as the data Controller). In other jurisdictions or for other services, the Company may be following the specific instructions of a third-party Controller, such as your employer or another client. In these jurisdictions, the Company acts as a Processor.

To determine whether the Company is a Controller or Processor in your jurisdiction or to find the contact information for the Company, please contact your Data Protection Officer at privacy@mmc.com.

We may collect the following categories of Personal Information where appropriate to fulfil our intended business purposes:

Every category of Personal Data not expressly listed as voluntarily-provided is required to provide the requested services. The Company strives to minimize the Personal Data it collects and will only collect the minimum required to provide the requested service. Should you refuse to provide such required Personal Data, the Company may not be able to provide services offered.

You have no legal obligation to provide us with any Personal Data when you use the services, and the provision of Personal Data is solely based on your free will. Should you refuse to provide such required Personal Data, the Company may not be able to provide services offered. 

We may collect Personal Information from the following sources (depending on the service we are seeking to or are providing and country you are in):

Information Provided by You, Your Representatives or Third Parties

• Directly from you or your family members, online, face to face, by telephone, or in written correspondence, including where information is submitted on your behalf (where the person submitting has your permission to do so). For example, we may collect information when you visit a website, enroll in benefits, request a quote, call a service center, or otherwise give us information;
• Your representatives, including your employer, association, or group or benefit program/plan sponsor;
• In the event of a claim, third parties including the other party to the claim (claimant/defendant), witnesses, experts (including medical experts), loss adjusters, lawyers and claims handlers;
• Other insurance market participants, such as insurers, reinsurers, appointed loss adjusters and other intermediaries;
• Credit reference agencies (to the extent the Company is taking any credit risk or participating in any underwriting activities);
• Anti-fraud databases and other third-party databases, including sanctions lists;
• Government agencies, such as vehicle registration authorities and tax authorities;
• Claim forms;
• Resources that provide publicly-available information;
• Business information and research tools;
• Selected third parties who provide us with details of potential customers;
• Third parties who introduce business to us; and
• Vetting and data validation agencies and other professional advisory service providers in connection with our marketing or business development activities.

If you supply us with Personal Information about other people (e.g., family members, beneficiaries, or dependents), you represent that you have the authority to provide this information and that you have shared this Privacy Notice where appropriate. We do not knowingly collect Personal Information directly from minors.

If a third party (e.g., your employer) collects your personal information, we encourage you to read the third party’s privacy policy to learn more about how your information will be used and disclosed by them.

If you communicate with one of our investment advisors through any device or method, please note that we log and monitor all such communications in order to comply with our record-keeping obligations.

Collection by Automated Means 

We use cookies and related tracking technologies (“Cookies”) on our company-owned websites. If available based on your jurisdiction, website users can opt-out of our use of certain Cookies using the Manage Cookies link at the bottom of the website and find out more about how we use Cookies by selecting the Cookie Notice link. 

External Links 

Our websites may include links to websites that are operated by organizations other than the Company.  If you access another organization’s website using a hyperlink on our website, the other organization may collect information from you.  The Company is not responsible for the content or privacy practices of linked websites or their use of your Personal Information.  If you leave a Company website via such a link (you can tell where you are by checking the URL in the location bar on your browser), you should refer to that website’s privacy policies, terms of use, and other notices to determine how the other organization will handle any Personal Information they collect from you.

Collection by Third Parties 

If you conduct a transaction through us, a third party (e.g., a service provider or insurer) may collect and process credit card or other Personal Information about you, including through Cookies, in connection with such a transaction. In those instances, and for any other arrangement where we receive information from your employer, association or other third party, we encourage you to read the third party’s privacy policy to learn more about how your information will be used and disclosed by them.

We may use Personal Information we collect:  

We may also use the Personal Information we collect and receive as otherwise described to you at the point of collection.

Insurance premiums are calculated by insurance market participants benchmarking clients’ and beneficiaries’ attributes as against other clients’ and beneficiaries’ attributes and propensities for insured events to occur. This benchmarking requires the Company and other insurance market participants to analyse and compile information received from all insureds, beneficiaries or claimants to model such propensities.  Accordingly, we may use Personal Data to both match against the information in the models and to create the models that determine the premium pricing in general and for other insureds.  The Company and other insurance market participants may use special categories of Personal Data and criminal records data for such modelling to the extent it is relevant, such as medical history for life insurance or past motor vehicle convictions for motor insurance.  

The Company and other insurance market participants use similar predictive techniques to assess information that clients and individuals provide to understand fraud patterns, the probability of future losses actually occurring in claims scenarios, and as set out below. To do this, we may use Personal Data we receive from clients to match against information in the models that we have created based on the behaviour of other individuals with similar attributes and to create further models.

We use these models only for the purposes listed in this Privacy Notice. In most cases, our staff make decisions based on the models. 

To the extent we engage in the automated processing of your Personal Information, we will provide you in advance with any notices, including regarding your rights, that are required under law.  Decisions regarding insurance premiums, coverage limits and eligibility, however, may be determined by insurance carriers using automated means, including through one of our websites or applications interacting with such insurers’ systems.  In those instances, we encourage you to review the applicable insurers’ privacy notices to obtain additional information regarding their automated decision-making practices, as well as any right to opt-out of such processing or challenge a prediction, recommendation or decision that has impacted you.  

We may use your Personal Data to provide you with information about products or services which we think would be of interest to you. We may also share your Personal Data with other companies in the MMC group so that they can provide you with information about their products and services. These may be sent by email or post or, in some circumstances, we may telephone you to explain this information to you.  

We take care to ensure that our marketing activities comply with all applicable legal requirements. In some cases, this may mean that we ask for your consent in advance of us or our group companies sending you marketing materials.

In all cases, you can opt out of receiving marketing communications, at any time. You can do this by clicking on the "unsubscribe" link in any marketing email or by contacting us using the details set out at the end of this Privacy Notice.

Please note that, even if you opt out of receiving marketing messages, we may still send you communications in connection with the services we provide to you.

Right to Opt., in or out of Sale or Sharing for Cross-Context Advertising

If you visit one of our websites, we may disclose your internet or other electronic network activity information, biographical identifiers, geolocation data, and professional information (to the extent it can be derived from your activity on our website) to website analytic and advertising providers for cross-context behavioral or targeted advertising purposes utilizing advertising cookies.  Under some laws, this activity may be considered a sale or sharing of information, and you may have the right to opt in or out of these types of disclosures.  To opt-in or out of our selling or sharing your Personal Information on our websites or to view the names of specific third parties with whom we have sold or shared your information, please click on the “Manage Cookies” link at the bottom of our webpage. If you would like to opt out of the sale or sharing of your information, ensure the toggles for “Advertising” and “Analytics” trackers are set to “No” or, where available, enable the Do Not Sell or Share My Personal Information toggle.

You may also implement a browser setting or extension to communicate your selling and sharing preferences automatically to the websites you visit.  Our websites process such “opt-out preference signals” in a frictionless manner by recognizing the Global Privacy Control (GPC). If you want to use GPC, you can download and enable it via a participating browser or browser extension. More information about downloading GPC is available here. 

Direct Marketing and Do Not Track Signals

You may have a right to request and obtain a notice once a year about the Personal Information we disclosed to other businesses for their own direct marketing purposes, where permitted by law.  If applicable, such a notice will include a list of the categories of Personal Information that were disclosed (if any) and the names and addresses of all third parties to whom the Personal Information was disclosed (if any).  The notice will cover the preceding calendar year.  You may contact us as provided below if you would like to learn if this right applies to you and, if so, exercise that right.  

Please note that some of these rights may be limited where we have an overriding legitimate interest or legal, regulatory, or contractual obligation to continue to process the Personal Information, or where the Personal Information may be exempt from disclosure or erasure under to applicable law.  Some of these rights can be exercised only in certain circumstances or may otherwise be limited by data protection legislation in your jurisdiction.

We may disclose Personal Information to the following categories of third parties:  

We may also disclose de-identified information that is not reasonably likely to identify you for commercially legitimate and lawful business purposes.  Where we have de-identified information, we will maintain and use it without attempting to re-identify the data other than as permitted under law. 

Our company strives to comply with all applicable cybersecurity and data protection laws. With these goals in mind, Marsh has a dedicated Chief Information Security Officer (“CISO”) and a Global Chief Privacy Officer (“GCPO”). CISO is responsible for managing a Global Information Security team and a comprehensive cybersecurity program.  As part of our cybersecurity program, we have implemented commercially reasonable physical, administrative, and technical safeguards to protect your Personal Information from unauthorized access, use, alteration, and deletion.   

The GCPO leads and oversees a Digital Compliance and Privacy Center of Excellence and a Data Protection Officer Network responsible for implementing our comprehensive global privacy program. The Data Protection Officer Network connects our Data Protection Officers across the world and seeks to implement our privacy program consistently and thoroughly wherever we process data. You can find the name and contact information for the Data Protection Officer in your jurisdiction by emailing us at privacy@mmc.com.

Where we act as a Processor, we process Personal Information based on the instructions of our corporate clients who act as the Controller of that information, and you should contact them to exercise any rights you may have under applicable privacy laws. 

Where we act as the Controller, we are primarily responsible for deciding how your information is processed. In such case, you may have some or all the rights listed below, depending on the jurisdiction and our reason for processing your information.  

Please note that we may need to use your Personal Information to verify your identity prior to fulfilling any of the below rights:

• Right of access (Right to know) 
  You may ask us to provide you with further details on how we make use of your Personal Data, the sources, the categories or specific pieces of Personal Data we have collected, the categories of third parties to whom we have disclosed the information, and to request a copy of the Personal Data that we hold about you.
  
  
• Right to correct  
  You may ask us to update any inaccuracies in the Personal Data we hold. If we disclose your Personal Data to others, we will tell them about the correction where possible. 
  
  
• Right to object to or restrict processing 
  You may ask us to restrict the processing of your Personal Data in certain circumstances, such as: (1) when the processing of personal data is likely to cause substantial distress to you and (2) the damage or distress is or would be unwarranted.
  
  
• Right to data portability 
  You may ask us, where it is technically feasible, to transfer to a third party of your choice a copy of Personal Data we have obtained from you, in a structured, commonly used, and machine-readable format.
  
  
• Right to withdraw consent 
  If we rely on your consent as our legal basis for processing your Personal Data, you have the right to withdraw that consent. 

If you wish to exercise any of the above rights or request review of a decision or denial, please Complete this Form or contact privacy@mmc.com.

As a global company operating across more than 130 countries, there are circumstances in which we will have to transfer Personal Information out of the country, province, or territory in which it was collected for the purposes outlined in this Privacy Notice. Specifically, we may transfer data to offer, administer, and manage the Services provided to you, and to enhance the efficiency of our business operations. We will make every effort to ensure that these transfers adhere to all relevant data protection legislation, and that the rights and freedoms of individuals under such laws are appropriately safeguarded.

Where the need for such a transfer arises, we will take steps to ensure that there are appropriate safeguards in place to protect Personal Information such as an impact assessment, adequacy decision by the appropriate supervisory authority, the use of approved binding corporate rules or standard contractual clauses, or your consent.  

Our products, services, and regulatory obligations are complex, and thus our retention periods for Personal Information vary.  We consider the following obligations when setting retention periods for Personal Information and the records we maintain: 

• the need to retain information to accomplish the business purposes or contractual obligations for which it was collected; 
• our duties to effectuate our clients’ instructions with respect to Personal Information we process on their behalf; 
• our duties to comply with mandatory legal and regulatory record-keeping requirements; 
• our backup and disaster recovery procedures; and
• other legal impacts such as the applicable statute of limitations periods. 

Based on the factors above, we may retain Personal Information beyond the period for which we provide services to you. When we no longer need to retain Personal Information, our company policies require that we either de-identify or aggregate the information (in which case we may further retain and use the de-identified. 

To submit questions or requests regarding this Privacy Notice or our privacy practices, please email us at privacy@mmc.com. If you would prefer to contact us by post or by phone, please contact your local Data Protection Officer. You can find the contact information for your local Data Protection Officer by emailing us at privacy@mmc.com.