Privacy policy

1. Who we are

This website is operated by Tripline Underwriting Ltd (“Tripline”, “we”, “us”), a fictional managing general agent that writes weather and catastrophe policies on an index basis. For the purposes of data protection law, Tripline Underwriting Ltd is the controller of the personal data described in this policy, unless a section says otherwise. You can reach us through the address shown on the Contact page: [Contact address: see Contact page].

2. The data we collect

We collect the data you give us and the data your visit produces.

You give us: your name, business email address, company, role and the content of your message when you use the contact form, ask for a quote, join the Journal newsletter, or apply to become a broker.

We receive from your organisation: when a policy is placed, the insured locations, contacts for alerts, and the bank details needed to send a payment.

Your visit produces: pages viewed, approximate location derived from your network address, device and browser type, and the date and time of the visit. This is collected only through the cookies and similar technologies described in our Cookie Policy.

3. Why we use it, and on what basis

Replying to your message or request for a quote — Steps taken at your request before a contract; our legitimate interest in running the business.

Issuing, servicing and paying out a policy — Performance of a contract.

Sending prevention alerts to the contacts named on a schedule — Performance of a contract.

Sending the Journal newsletter — Your consent, which you can withdraw at any time.

Keeping the site secure and understanding how it is used — Our legitimate interest; your consent for non-essential cookies.

Meeting legal, tax and regulatory obligations — Legal obligation.

4. Alerts and location data

A prevention alert is sent when a forecast puts a policyholder’s cell on a path to cross a tier. To send it, we hold the location of the insured site, expressed as a grid cell, and the email addresses or phone numbers of the contacts named on the schedule. We do not track the position of people and we do not use alert data for marketing.

5. Who we share it with

We share personal data only where needed and only with:

capacity partners and reinsurers who underwrite the policy, in the form needed to assess and settle it;

service providers acting on our behalf, such as hosting, email delivery, analytics and payment services, bound by written agreements;

professional advisers, auditors and regulators, when the law requires or when we need advice;

a buyer or successor, if the business is reorganised or sold, under the same protections.

We do not sell personal data.

6. International transfers

Some of our providers are located outside your country. When personal data leaves the United Kingdom or the European Economic Area, we rely on an adequacy decision, standard contractual clauses or another transfer mechanism recognised by law, and we assess whether the receiving country offers comparable protection.

7. How long we keep it

We keep enquiry data for 24 months after our last contact with you. We keep policy and payment records for as long as the policy runs, plus the period required by law, which is usually six to ten years. Newsletter data is kept until you unsubscribe. Server logs are kept for three months. When the period ends, we delete the data or anonymise it.

8. Your rights

Depending on where you live, you may have the right to ask us to access, correct, delete or restrict the use of your personal data, to object to its use, to receive a copy in a portable format and to withdraw your consent at any time. To exercise a right, write to us through the address shown on the Contact page. We will answer within one month. If you are not satisfied, you may complain to your local data protection authority.

9. Security

We use encryption in transit and at rest, role-based access and audit logs for systems that hold personal data. No system is perfectly secure, and if a breach affects your data in a way that carries a risk to you, we will tell you and the relevant authority within the time the law requires.

10. Changes to this policy

We may update this policy when our practices change. The date at the top shows the latest version. If a change is material, we will say so on this page and, where we hold your email address for the newsletter, by email.