Legal

• Last Updated: April 15, 2026

Introduction and Fiduciary Commitment

Universal Sompo General Insurance Company Limited ("Company", "we", "our", “Universal Sompo” or "us") is unequivocally committed to safeguarding the privacy, confidentiality, and integrity of the personal data entrusted to us by our customers and digital visitors. Operating within the dynamic landscape of the Indian general insurance sector, we recognize that the collection and processing of diverse data sets—spanning from financial histories and vehicular telematics to highly sensitive health and medical records—is the foundational element of precise risk assessment, policy administration, and rapid claims settlement.

This Comprehensive Privacy Policy and Notice ("Notice") serves as the definitive articulation of our data governance architecture. It delineates the methodologies through which we collect, process, secure, retain, and responsibly share personal data across all user interactions with our primary website (www.universalsompo.com), customer self-service portals, mobile applications including the USGI PULZ application, and all associated digital touchpoints.

This Notice is architected and published to ensure strict adherence to the prevailing regulatory ecosystem.

Roles, Responsibilities, and Jurisdictional Scope

Within the framework of the DPDPA, 2023, Universal Sompo General Insurance Company Limited operates primarily as a Data Fiduciary. In this capacity, we determine the fundamental purposes and the technological means of processing your personal data.

To deliver complex insurance solutions effectively, we engage specialized third-party entities—including Third-Party Administrators (TPAs) for health claims, independent loss surveyors, cloud infrastructure hosting providers, and advanced data analytics vendors. All designated third-party entities are bound by rigorous, legally enforceable non-disclosure agreements, are strictly prohibited from utilizing your data for their independent commercial purposes, and are contractually obligated to deploy technical and organizational safeguards equivalent to or exceeding our internal Information Security Policy.

The scope of this Notice encompasses all natural persons ("Data Principals", "you", or "your"), including prospective applicants, active policyholders, non-active policyholders, insured beneficiaries, legally appointed nominees, and general visitors navigating our digital ecosystem.

Itemized Categorization of Personal Data Collected

In strict compliance with the transparency mandates of Rule 3 of the DPDP Rules, 2025, we reject the use of broad, opaque data collection clauses. We ensure absolute clarity regarding the precise data points ingested into our systems. Depending on the specific insurance vertical you engage with (e.g., comprehensive health coverage, motor insurance, or commercial property risk), we may collect and process the following itemized categories of personal data:

Important Notice Regarding Sensitive Data: We recognize that health, medical, and detailed financial data command the highest threshold of confidentiality. Consequently, we subject these data categories to enhanced cryptographic controls, stringent Role-Based Access Controls (RBAC), and rigorous monitoring in alignment with IRDAI security mandates.

Mechanisms and Sources of Data Ingestion

Our data collection strategy is governed by the principle of data minimization; we ingest only the data essential for the provision of insurance services. Personal data enters our ecosystem through the following primary vectors:

• Direct Principal Interactions :

  Data explicitly and voluntarily inputted by you into our digital proposal forms, premium calculators, claims intimation portals, or through the USGI PULZ application.

• Authorized Ecosystem Intermediaries :

  Information securely transmitted through our network of licensed insurance brokers, corporate agents, web aggregators, and certified point-of-sale persons (POSPs) acting on your behalf.

• Healthcare and Investigative Networks:

  Medical dossiers received directly from network hospitals and diagnostic centers during cashless claim processing, as well as incident reports generated by IRDAI-licensed independent surveyors and loss assessors.

• Statutory and Regulatory Databases :

  Information systematically retrieved from the Central KYC Registry, the Insurance Information Bureau of India (IIB), and the Ministry of Road Transport and Highways (VAHAN) databases, strictly subject to regulatory allowances.

• Automated System Technologies :

  Technical and behavioral data continuously gathered via cookies, server access logs, and integrated analytics engines during your navigation of our digital properties.

Explicit Purposes of Processing and Services Enabled

We process your personal data exclusively for lawful, predefined purposes. The processing of your data is the mechanical engine that enables the provision of the following specific goods, services, and operational functions:

• Algorithmic Risk Assessment and Underwriting:

  To evaluate individual and aggregate risk profiles, determine eligibility across our health, motor, cyber, and commercial portfolios, and calculate actuarially sound premium structures.

• Comprehensive Policy Administration :

  To generate and issue legally binding policy documents, process mid-term endorsements, manage automated renewal cycles, and maintain accurate, auditable registries of insured individuals and their appointed nominees.

• Claims Adjudication and Financial Settlement

  To verify the authenticity and validity of submitted claims, coordinate seamlessly with TPAs and medical facilities for cashless authorizations, deploy predictive models for fraud detection, and execute secure electronic fund transfers for final claim disbursements.

• Customer Support and Grievance Resolution :

  To authenticate your identity during service inquiries, facilitate emergency roadside assistance, manage policyholder complaints, and execute the directives of internal grievance redressal committees or the Insurance Ombudsman.

• Regulatory Compliance and Statutory Reporting:

  To adhere to the exhaustive compliance mandates of the IRDAI, fulfill anti-money laundering (AML) and counter-terrorism financing (CTF) obligations, process taxation requirements, and report mandatory operational metrics to statutory bodies and the Data Protection Board of India.

• Cybersecurity, Platform Integrity, and Evolution:

  To monitor digital traffic patterns for anomalous behavior, authenticate user sessions to prevent account takeovers, deploy threat intelligence mechanisms to thwart cyber attacks, and continually refine the user interface and functionality of our digital platforms.

Lawful Grounds for Processing

The processing of personal data within our infrastructure is executed strictly upon the foundational lawful basis:

• Verifiable and Explicit Consent :

  The vast majority of our data processing relies upon your free, specific, informed, unconditional, and unambiguous consent. This consent is obtained through clear affirmative action—such as checking a digital consent box

• Legitimate Uses:

  In highly specific scenarios where obtaining immediate consent is impossible or statutorily exempted, data may be processed under the doctrine of legitimate uses. Such scenarios include:

  • Responding to acute medical emergencies involving an immediate threat to life or severe health degradation.
  • Fulfilling binding obligations under state laws, executing court orders, or complying with compulsory regulatory mandates (e.g., mandatory disclosures to law enforcement or the FIU).
  • Executing employment-related processing and safeguarding corporate assets for individuals engaged as personnel of the Company

Disclosure and Controlled Sharing of Personal Data

Modern insurance operations function within a highly interconnected ecosystem. To deliver seamless policy issuance and claims settlement, it is operationally requisite to share specific, minimized data points with authorized external entities. Universal Sompo categorically does not sell, rent, or commercially trade your personal data to unauthorized third parties. Disclosures are strictly limited to the following categories of recipients:

• Insurance Ecosystem Operational Partners :

  Third-Party Administrators (TPAs) facilitating health insurance claims, independent surveyors investigating motor or property damage, and specialized medical professionals engaged for complex underwriting assessments.

• Reinsurance and Co-insurance Syndicates :

  Data shared strictly to distribute large-scale risk and ensure compliance with complex reinsurance treaty obligations, ensuring the financial stability required to honor high-value claims.

• Technology, Cloud, and Operational Vendors:

  Providers of secure cloud hosting infrastructure, operators of PCI-DSS compliant payment gateways, communication API providers, and IT infrastructure vendors who architect and maintain our digital ecosystem.

• Regulatory, Judicial, and Government Authorities :

  Mandatory disclosures made to the IRDAI, SEBI, the Insurance Information Bureau (IIB), various taxation authorities, and law enforcement agencies to satisfy unyielding statutory obligations and actively participate in industry-wide fraud prevention initiatives.

Cross-Border Data Transfers and Data Sovereignty

The architecture of modern cloud computing and the mechanics of the global reinsurance market occasionally necessitate the transfer of specific operational data to servers or entities located outside the territorial borders of India. Universal Sompo ensures that any such cross-border data transmission is executed strictly in accordance with the DPDPA, 2023, and sectoral data localization guidelines. Data is transferred exclusively to jurisdictions that have not been restricted by the Government of India. Furthermore, all international transfers are governed by rigorous Standard Contractual Clauses (SCCs) and binding corporate rules that guarantee the receiving entity applies data protection standards entirely equivalent to those mandated within India.

Data Retention and Erasure Protocols

We adhere to the principle of storage limitation. Personal data is retained within our active databases solely for the duration required to fulfill the specific purposes enumerated in this Notice, or as dictated by superseding statutory requirements.

• Operational Retention :

  Policyholder records, underwriting data, and comprehensive claims dossiers are retained in strict compliance with the IRDAI (Maintenance of Insurance Records) Regulations and our internal corporate Records Retention Policy. This ensures data is available for necessary actuarial analysis, long-tail claim adjudication, and regulatory audits.

• Security and Forensic Retention :

  System, network, and application access logs are retained for a rolling period of at least 180 days, directly aligning with the mandates of the IRDAI Information and Cyber Security Guidelines to facilitate post-incident forensic investigations.

• Erasure Protocol:

  Upon the expiration of the defined statutory or operational retention period, or upon the successful processing of a valid request for erasure from a Data Principal, personal data is permanently purged or irreversibly anonymized using secure, cryptographic erasure protocols. We will issue a proactive notification to the Data Principal at least 48 hours prior to the execution of the final data erasure.

Information Security and Cyber Resilience Safeguards

Universal Sompo deploys a defense-in-depth security architecture to safeguard your personal data against unauthorized access, malicious modification, accidental disclosure, or total destruction. Our security posture is aggressively mapped against ISO 27001 standards, the IRDAI Cyber Security Guidelines, and SEBI’s Cyber Security and Cyber Resilience Framework (CSCRF). Key technological and organizational controls include:

• Cryptographic Controls :

  Mandatory end-to-end encryption of all sensitive personal data, utilizing industry-standard algorithms both while the data is at rest in our databases and in transit across external networks.

• Identity and Access Management :

  Strict enforcement of Role-Based Access Control (RBAC) and mandatory Multi-Factor Authentication (MFA) for all personnel and vendors accessing internal systems holding policyholder data.

• Continuous Monitoring and Threat Detection :

  Deployment of advanced intrusion detection/prevention systems (IDS/IPS), continuous network traffic monitoring, and automated vulnerability scanning across all digital assets.

• Incident Response and SOC:

  Operation of a dedicated Security Operations Center (SOC) equipped with predefined Cyber Crisis Management Plans to ensure rapid containment of anomalies. In the highly unlikely event of a verified personal data breach, we maintain highly drilled protocols to notify the Data Protection Board of India, CERT-In, and all affected Data Principals within the legally prescribed 72-hour timeframe.

Tracking Technologies and Cookie Management

Our digital platforms, including the primary website and the USGI PULZ application, utilize cookies, web beacons, and similar analytic technologies to maintain secure user sessions, remember individual interface preferences, and generate aggregated analytics to optimize system performance.

• Essential / Strictly Necessary Cookies:

  These are deployed automatically upon your arrival at our platforms, as they are technically indispensable for core website functionality, load balancing, and fundamental security.

• Non-Essential / Performance and Analytics Cookies:

  These tracking mechanisms are deployed exclusively upon receiving your explicit affirmative consent via our integrated Cookie Consent Management interface. You retain total autonomy to modify, restrict, or entirely withdraw your cookie preferences at any time through the configuration settings of your web browser.

Protection of Children's Personal Data

Universal Sompo does not independently solicit, nor do we intentionally collect, personal data directly from children (defined under the Act as individuals below 18 years of age) for the purposes of behavioral profiling, tracking, or targeted marketing.

When the processing of a child's personal data is an absolute necessity for the execution of an insurance contract—such as enrolling a minor as a dependent in a comprehensive family health insurance plan or designating them as a legal nominee—we ensure that consent is obtained directly from the parent or lawful guardian.

Rights of Data Principals

The Digital Personal Data Protection Act, 2023, transitions privacy from a corporate courtesy to a statutory right. As a Data Principal, you are empowered with comprehensive control over your personal data. You possess the following unalienable rights:

• Right to Access and Information :

  You hold the right to obtain a clear, concise summary of the personal data we are actively processing, the specific processing activities being undertaken, and the identities of all third-party Data Processors with whom your data has been shared.

• Right to Correction and Updating :

  You may request the immediate correction of materially inaccurate data, the completion of incomplete data profiles, or the updating of personal information that has become obsolete.

• Right to Erasure (Right to be Forgotten):

  You may demand the permanent deletion of your personal data when it is no longer strictly necessary for the specified purpose for which it was collected, provided that this request does not conflict with our overriding legal, taxation, or regulatory retention obligations.

• Right to Withdraw Consent:

  You possess the absolute right to revoke your consent for data processing at any juncture. We guarantee that the mechanism for withdrawing consent is as frictionless and accessible as the mechanism used to grant it. (Please note: The withdrawal of consent is applied prospectively and may inherently restrict our operational ability to continue providing specific insurance coverages, process active claims, or honor policy renewals).

• Right to Nominate :

  You hold the right to formally nominate another competent individual to exercise your statutory rights under the Act in the unfortunate event of your death or severe physical/mental incapacity.

• Right to Grievance Redressal:

  You have the right to register formal complaints regarding our data governance practices directly with our designated Grievance Officer. Should our internal resolution prove unsatisfactory, you retain the right to escalate the matter to the Data Protection Board of India.

To exercise any of these statutory rights, please utilize the dedicated Data Principal Rights a formal request to our Data Protection Officer using the contact parameters detailed in Section 15.

Statutory Duties of Data Principals

To ensure the systemic integrity of the insurance ecosystem and to prevent the facilitation of fraud, the DPDPA legally mandates that Data Principals observe specific duties. While exercising your rights, you are statutorily required to:

• Provide personal data that is verifiably authentic, accurate, and current.

• Strictly refrain from impersonating another individual, utilizing synthetic identities, or submitting fraudulent or manipulated documentation.

• Ensure that no material information is suppressed or concealed—particularly regarding historical health conditions or vehicular modifications—as the suppression of material fact directly nullifies the fundamental premise of utmost good faith (uberrimae fidei) upon which all insurance contracts are based.

• Refrain from registering frivolous, vexatious, or entirely false grievances with either the Company or the Data Protection Board of India.

To exercise any of these statutory rights, please utilize the dedicated Data Principal Rights a formal request to our Data Protection Officer using the contact parameters detailed in Section 15.

Grievance Redressal and Data Protection Officer

We view the rapid and transparent resolution of privacy concerns as a critical component of our operational mandate. If you possess queries regarding the interpretation of this Privacy Notice, require assistance exercising your statutory rights, or wish to register a formal grievance concerning our data processing methodologies, please direct your communication to our designated Data Protection Officer / Grievance Officer:

Data Protection Officer / Grievance Officer Universal Sompo General Insurance Company Limited Registered Office: 8th Floor and 9th Floor (South Side), Commerz International Business Park, Oberoi Garden City, Off Western Express Highway, Goregaon East, Mumbai – 400063. Designated Privacy Email: privacyofficer@universalsompo.com

Upon receipt of a formal communication, our privacy team will execute a comprehensive investigation and resolution process within the strict timelines prescribed by the DPDPA, DPDP Rules, and IRDAI grievance redressal frameworks.

Version Control and Modifications to This Notice

Universal Sompo retains the right to unilaterally update, amend, or structurally modify this Comprehensive Privacy Policy and Notice to accurately reflect continuous improvements in our technological security posture, shifts in our operational processing practices, or mandatory adaptations to evolving legal and regulatory frameworks.

In the event of material modifications—particularly those altering the fundamental purposes of data processing, expanding third-party sharing, or impacting your statutory rights—we will proactively communicate these changes via direct email correspondence or through highly visible, mandatory acknowledgment notifications within our mobile applications and web portals prior to the changes taking effect. The "Last Updated" positioned at the genesis of this document signifies the effective date of the currently active architectural version.