Schedule an Appointment

OUR PRIVACY POLICY

Controller Contact Details

Vanilla Financial (VF) is the data controller responsible for the personal information we process.  As an organization we are committed to compliance with the Barbados Data Protection Act.  This privacy notice describes: 

  • How VF collects uses, shares and secures your personal data
  • The type of personal information we collect
  • The lawful basis for processing your information
  • Your rights as a data subject

Personal data is data, or a combination of pieces of information that could reasonably allow you to be identified.

If you have any questions about your rights or concerns about our use of your personal data or want to know more about our data processing activities, you can contact our Data Privacy Officer using the following information

Main number: (246) 826-4552

Email: vfacompliance@vanillafinancial.com.

Subject:  Privacy Query

The type of personal information we collect

We collect the following types of personal data depending on the purpose of your interaction with us (e.g., as business contact, customer, insured) and as allowed by applicable law:

  • Basic personal and demographic information, such as your name, date of birth, age, gender and marital status.
  • Contact information, such as your address, telephone number and email address.
  • Unique identifiers, such as identification numbers issued by government bodies or agencies (e.g., your national identifier number or social security number, passport number, ID number, tax identification number, driver's license number, birth, death and marriage certificates, military passbook, and copies of official documents).
  • Beneficiary information, such as details of relationships, family members and dependents.
  • Employment information, such as your job title, employer, employment status, salary information, employment benefits, pensionable service periods, employment history and professional certifications and training.
  • Financial information, such as your bank account numbers and statements, credit card numbers, brokerage account numbers, transaction information, tax information, details of your income, property, assets, investments and investment preferences, pension and benefits, debts, and creditworthiness.
  • Policy information, such as your policy number, policy start and end dates, premiums, individual terms, mid-term adjustments, reasons for cancellation, risk profile, details of policy coverage, enrolment, eligibility for insurance or benefits, benefit amounts and underwriting history.
  • Claim information, such as a claimant's relationship to a policyholder/insured, claims history and claims data, and the date and particulars of a claim, including causes of death, injury or disability and claim number.
  • Plan information, such as contributions levels and benefit options
  • Commercial information, such as records of your personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
  • Lifestyle information, such as travel history and plans and general health data.
  • Special category data and sensitive personal data, such as data relating to your health (including protected health information), genetic or biometric data, sex life, sexual orientation, gender identity, racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership.
  • Criminal records information, such as criminal charges or convictions, including driving offences, or confirmation of clean criminal records.
  • Professional disciplinary information.
  • Marketing information, such as your consent to or opt out from receiving marketing communications from us and/or third parties, your marketing preferences, or your interactions with our marketing campaigns and surveys, including whether you open or click links in emails from us or complete our surveys.

How we use personal information and the legal basis we use it

We use the information that you have given us in order to:

  • Perform services for you or our clients
  • Provide services and fulfill our contractual obligations, including providing services that you may not have personally requested but were requested by our client(s) and require us to interact, directly or indirectly, with you.
  • To conduct policy administration activities when onboarding and offboarding customers
  • To conduct Basic Customer Data (BCD) processes
  • Facilitate and enable placement of policies and assist in the ongoing management of such policies, including premium management, renewals, adjustments, cancellations, claims management and settlement.
  • Provide various consulting, administration, financial services and claims administration.
  • Advise on the management of our clients' business risks and opportunities, affairs and insurance arrangements and on the administration of claims.
  • Manage our business operations
  • Enter into business relationships and perform due diligence and background checks, such as fraud, trade sanctions screening, and credit and anti-money laundering checks.
  • Create, maintain, customize and secure your account with us.
  • Maintain accounting records, receive professional advice, apply for and make claims on our own insurance policies, manage or dispute a claim and recover a debt.
  • Communicate and market to you
  • Communicate with you regarding your account or changes to our policies, terms and conditions, respond to any inquiries you may have, and send you invitations for events or meetings.
  • Advertise, market and promote our services or the services of others, including by email, LinkedIn, SMS, post or telephone.
  • Send you newsletters, offers or other information we think may interest you, as well as offer and administer promotions.
  • Comply with legal obligations
  • Comply with national security or law enforcement requirements, discovery requests, or where otherwise required or permitted by applicable laws or regulations, court orders or regulatory authorities.
  • Exercise and defend ours, yours or third parties' legal rights.

Under the Barbados Data Protection Act, the lawful basis we rely on for processing this information are:

  • Legitimate Business Interest, such as seeking to and entering into or performing our contractual duties, maintaining our business records, keeping records of insurance policies or other products we place, and analyzing and improving our business model, services, systems and algorithms. When using your personal data for these purposes, we ensure our business need does not conflict with the rights afforded to you under applicable laws.
  • For the performance of a contract with you or in order to take steps at your request prior to entering into that contract.
  • Compliance with legal obligations, such as when you exercise your rights under data protection laws and make requests, for compliance with legal and regulatory requirements and related disclosures and for the establishment and defense of legal rights.
  • Fraud detection or prevention.
  • Consent, such as when we have to obtain your consent to process your personal data.


Your rights over your personal information

Your rights under the Barbados Data Protection Act are as follows:

  • Right to Access – You have the right to be informed about the details on the processing of your data.
  • Right to Rectification – You have the right to ask us to rectify your personal information you think is inaccurate or incomplete.
  • Right to Erasure – You have the right to ask us to erase your personal data in certain circumstances.
  • Right to Restriction of Processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Right to Data Portability – You have the right to ask that we provide the personal data you provided in a structured, commonly used and machine-readable format to reuse for your own purposes.
  • Right to Prevent Processing Likely to Cause Damage or Distress – You are entitled by written notice to request that we cease, or not to begin, processing of your data that may cause damage or distress to the data subject under certain circumstances.
  • Right to Prevent Processing for Purposes of Direct Marketing – You are entitled by written notice to require that we cease processing of your data for the purposes of direct marketing.
  • Rights Related to Automated Decision-Making and Profiling – You have the right not to be subject to a decision solely on automated processing, including profiling.

Who we share your personal data with

We share your personal data with our broker partner if necessary for the purpose of your interaction with us, such as for the provision of our services, general business operations and controls, marketing, data analytics, systems improvements, surveys, benchmarking, and compliance with applicable laws.


We may also share your personal data with the following third parties for the purpose of your interaction with us:

  • Your employer, as part of our provision of the services to you or your employer.
  • Professional Advisors, such as underwriters, actuaries, claims handlers and investigators, surveyors, loss adjusters/assessors, accident investigators,  specialist risk advisors, pension providers or trustees, banks and other lenders (including premium finance providers), health   professionals, health service providers, lawyers (including third party legal process participants), accountants, auditors, tax advisors, financial institutions, investment advisors and other fiduciaries and consultants.
  • Business partners, such as customers, insurance companies, brokers, other insurance intermediaries, claims handlers or other companies who act as insurance distributors and premium financing companies.
  • Service providers, such as IT software, security and cloud suppliers, marketing agencies, background check agencies.
  • Insurers who provide you with insurance and us with our own insurance.
  • Regulators, public authorities and law enforcement agencies, such as police, judicial bodies, governments, quasi-governmental authorities, financial and pension regulators and workers' compensation boards, where we are required or requested to do so by law.
  • Other third parties, where we have your consent or are required by law.

When required by applicable law, we will obtain your explicit consent before sharing your data with any third parties. We will also require third parties (where applicable) to maintain a comparable level of protection of personal data as set out in this Privacy Notice by the use of contractual requirements or other means. On request and where required by law, we will confirm the name of each third party to which your personal data has, or will be, transferred. To the extent permitted by applicable law, we disclaim all liability for the use of your personal data by third parties.


Children

Our Sites are not intended for children and we do not knowingly collect, use, or disclose information about children. If you are a minor, please do not provide any personal data even if prompted to do so. If you believe that you have inadvertently provided personal data, please ask your parent(s) or legal guardian(s) to notify us. In the event that we learn that we have inadvertently collected personal data via our site from a child, we will delete that information as quickly as possible.


How we protect your personal data

We use a range of organizational and technical security measures to protect your personal data, including, but not limited to, the following:

  • Restricted access to those who need to know for the purposes set out in our underlying agreement or this Privacy Notice, and who are subject to    confidentiality obligations.
  • Firewalls to block unauthorized traffic to servers.
  • Physical servers located in secure locations and accessible only by authorized personnel.
  • Internal procedures governing the storage, access and disclosure of your personal data.


Please note that where we have given you (or you have chosen) a password, you are responsible for keeping the password confidential. Please do not share your password with anyone.


Changes to this Privacy Policy

We may modify or update this Privacy Notice as required.  If changes to this Privacy Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you can exercise your rights under the Barbados Data Protection Act.

 

This privacy notice was updated on 2025-06-30

>