MARKET LEADER IN
GENERAL INSURANCE

Your privacy is of utmost importance to National Insurance Company Berhad (“NICB”, “us”, “we” or “our”).

This Privacy Policy (the “Policy”) describes the Personal Data which NICB collects about you through your use of our product and services, in line with the Personal Data Protection Order 2025 of Brunei Darussalam (the “PDPO”). It also sets out how NICB handles and protects this data while meeting the requirements of the PDPO.

By submitting information to us, enrolling for any products or services offered by us, you give consent to us, brokers and/or agents ("Representatives") (The companies and Representatives collectively referred herein as “NICB”, “us”, “we” or “our”), collecting, using, disclosing, sharing and transferring amongst themselves your Personal Data, as outlined in this Privacy Policy.

NICB will collect Personal Data from an individual when it considers the Personal Data reasonable and necessary for the relevant purposes underlying such processing.

The Personal Data we collect or may collect include:

• Personal particulars such as your name, residential address, contact details, date of birth, country of nationality, NRIC, passport or other identification number;
• Financial and payment information, such as bank account or card details used for premium payment or claim settlement;
• Vehicle, property or other asset details relevant to the insurance cover you hold with us, such as vehicle registration and plate number, valuation, inspection reports and photographs;
• Sensitive personal data, such as health or medical information, where relevant to a claim (for example, medical insurance, personal accident or workmen compensation claims). We handle this data with extra care and only where necessary for the relevant purpose and permitted under the PDPO;
• Claims Data, including any personal data such as photographs, reports provided during any investigation that NICB may need to undertake;
• Personal opinions through surveys or other forms of feedback;
• Technical and website data collected when you use our website, such as your IP address, browser type, and pages visited;
• Any other Personal Data required to comply with any applicable local laws, rules, acts, regulations, notices, guidelines, as may be amended from time to time;
• Any other information relating to any individuals which you have provided us in any forms you may have submitted to us, or via other forms of interaction with you;

We collect personal data in several ways, including:

1. when you submit any form, including but not limited to application, declaration, or proposal or forms;
2. when you enter into any agreement or provide other documentation or information in respect of your interactions and transactions with us, or when you use our services;
3. when you interact with our staff, and other representatives, for e.g., via telephone calls, letters, fax, face-to-face meetings, digital platforms (including social media) and email;
4. when you use our electronic services or interact with us via our websites or use services on our websites;
5. when you request that we contact you, be included in an email or other mailing list; or when you respond to our request for additional Personal Data, our promotions and other initiatives;
6. when you are contacted by, and respond to, our staff and agents and other service providers;
7. when you submit an employment application or when you provide documents or information including your resume and/or curriculum vitae in connection with any appointment as an officer, director, representative or any other position;
8. when we receive references from business partners and third parties, for example, where you have been referred by them;
9. when your images are captured by us via CCTV cameras while you are within our premises, or via photographs or videos taken by us or our representatives when you attend events hosted by us;
10. when we seek or receive information about you in connection with your policy, policy applications, claims or job applications, for example, from other insurers, insurance associations, hospitals, clinics, motor workshops, your ex-employer and the relevant authorities; and/or
11. when you submit your Personal Data to us for any other reason.
    
    

If you provide us with any Personal Data relating to a third party (e.g., information of your spouse, children, parents, and/or employees), including where you have named them as beneficiaries, or where you refer a third party to us for the purposes of us offering our products and/or services to that third party, by submitting such information to us you have obtained the consent of the third party to you providing us with their Personal Data for the respective purposes.

Generally, NICB collects, uses and discloses your Personal Data for the following purposes:

1. responding to, processing and handling your requests, complaints, feedback, recommendations and requests;
2. verifying your identity;
3. managing the administrative and business operations of the Companies and complying with internal policies and procedures;
4. requesting feedback or participation in surveys, as well as conducting market research and/or analysis for statistical, profiling or other purposes for us to design our products, understand customer behaviour, preferences and market trends, and to review, develop and improve the quality of our products and services;
5. preventing, detecting and investigating crime, including detecting anomalies in payment systems to prevent fraud and money-laundering or terrorist financing, and analysing and managing commercial risks;
6. managing the safety and security of our premises and services (including but not limited to carrying out CCTV surveillance and conducting security clearances);
7. providing media announcements and responses;
8. organising promotional events;
9. in connection with any claims, actions or proceedings (including but not limited to drafting and reviewing documents, transaction documentation, obtaining legal advice, and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;
10. managing and preparing reports on incidents and accidents;
11. complying with any applicable rules, laws and regulations, codes of practice or guidelines or to assist in law enforcement and investigations by relevant authorities (including but not limited to disclosures to regulatory bodies, conducting audit checks, surveillance and investigation or conducting customer due diligence); and/or
12. any other purposes relating to or reasonably necessary for any of the aforesaid.

These purposes may also apply even if you do not maintain any policy or relationship with us, or have terminated the policy or relationship with us.

You may withdraw any consent given or deemed to have been given in relation to the collection, use and disclosure of your personal data at any time, by contacting us using the details set out in this Policy.

Your request should clearly state the following:

(a) your full name;

(b) your address, telephone number or email address;

(c) the personal data affected by your notice; and

(d) the purposes or activities for which you are withdrawing consent.

We will process your withdrawal request within thirty (30) calendar days of receipt, and will inform you of the likely consequences of the withdrawal, including where this may affect our ability to continue providing you with insurance coverage or related services. We may also retain and continue to process your personal data where required or permitted by law, including under the PDPO, or where necessary to fulfil contractual or regulatory obligations.

We shall take reasonable steps to ensure personal data collected by us or on our behalf is accurate and complete if:

• it is likely to be used to make a decision that affects you; or
• it is likely to be disclosed to another organisation.

Where you provide your personal data directly to us, we shall be entitled to assume that it is accurate and complete.

We shall protect personal data in our possession or under our control by making reasonable security arrangements to prevent loss, unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

In the event of a data breach that will or is likely to result in significant harm to you, we shall notify the relevant authority as soon as practicable, and in any case within three (3) working days of concluding our assessment of the breach, and shall notify you in accordance with and subject to the PDPO.

We may retain your personal data as long as reasonably required for any of the purposes specified in this Policy and for any other legal or business purpose permitted by law.

You may request access to the personal data we hold about you, and request that we correct any error or omission in it, by contacting us using the details below. We will take reasonable steps to verify your identity before acting on your request, and will respond within fourteen (14) working days of receiving a valid request. Where we are unable to provide access or make a correction, we will inform you of the reason, except where the PDPO does not require us to do so. A reasonable fee may apply to cover the cost of processing an access request which we will inform you of in advance.

NICB reserves the right to amend this Privacy Policy at any time, and will provide notice of such amendment as applicable, to correctly reflect the way NICB uses your data or any updated laws and regulations.

By continuing to use our services after the changes come into effect, you agree to be bound by the revised policy.

This policy is not intended to create any contractual right between the company and its customers.

If you:

• have any feedback or queries on our privacy policy or data protection practices, or
• wish to submit any request relating to access, correction, or withdrawal of consent, or
• have any privacy-related incident to report,

please contact us at +673 222 6222 or email us at insurance@national.com.bn (attention: Data Protection Officer).

(Date issued: June 2021 / Last Updated: September 2026)