Where Milliman is Acting as a Data Controller
Collection of Data
Like many companies, Milliman monitors the use of its websites by collecting aggregate data. No Personal Data is collected in this process. Typically, Milliman collects data about the number of visitors to the website, to each web page, and the originating domain name of the visitor's Internet Service Provider. This data is used to improve the usability, performance and effectiveness of Milliman’s website.
In some instances, Milliman may collect data through cookies. A "cookie" is a text-only string of data that Milliman sends to the cookie file of the browser on a website visitor’s computer hard disk using Milliman’s web server. Cookies are used to make websites work, or work more efficiently, as well as to provide data to the owners of the website.
Milliman’s website may use both required cookies and analytics and performance cookies.
Required cookies enable a website visitor to move from page to page within the website and to use its features. These cookies are deleted when the visitor closes his/her browser.
Analytics and performance cookies allow Milliman’s third-party agents to collect data, including the number of visitors to the website, where they have come to the website from, and the length of time they have spent on the website. Milliman uses the following third-party agents for website performance tracking, and you can learn more about their privacy policies and how to opt-out of their cookies by clicking on these links:
Google Analytics: http://www.google.com/analytics/learn/privacy.html
AI Media group: https://aimediagroup.com/user/themes/aimedia/docs/privacy_2018.pdf
The majority of web browsers accept cookies and similar files, but a visitor can usually change the browser settings to prevent this. However, by doing so, some functionality of the website may be lost. Please visit https://www.aboutcookies.org/ to learn more about cookies and how to control them. We rely on your consent, to the extent required by law, to use non-required cookies that may contain your Personal Data. To change your cookie preferences, click here.
Third-Party Embedded Content and Do Not Track
Milliman websites may feature content (such as buttons, widgets, and other embedded features or content) embedded by third parties that rely on cookies or similar technologies. You can learn more about the privacy policies of these third-party content providers and how to opt-out of their cookies by clicking the appropriate link below:
Facebook and Instagram: https://www.facebook.com/policies/cookies/
Google Inc. and YouTube: https://policies.google.com/privacy
Please note that Milliman websites currently do not respond to Do Not Track signals in browsers.
Processing of Personal Data
We may collect, store and otherwise process Personal Data of:
- visitors to our websites (first name, last name, title, company, phone number, location, email address, subject of the request and message given) who request information about products or services from Milliman, for the purpose of the management of the relationship with clients and the administration of the website. If a website visitor uses a log-in to access our website, certain criteria such as user data, transactional data, session surveillance, IP data, and pattern recognition may be collected and used by Milliman for authentication purposes. The legal basis for the processing of Personal Data is Milliman’s legitimate interest (Art. 6 (1) letter (f) GDPR), consisting of the website’s management.
- clients’ representatives, officers, agents and employees, business partners, providers, parties to a contract (name, professional address, title, email and other professional contact details) for contract administration purposes. The professional contact details of clients’ representatives, their employees and business partners are also used to activate and maintain client accounts, to fulfill requests or respond to inquiries about Milliman products or services and to provide offers and information (as permitted by law) about products, services, or events offered by Milliman or that Milliman thinks may be of interest. The legal basis for the processing of Personal Data is Milliman’s legitimate interest (Art. 6 (1) letter (f) GDPR). Milliman may also rely on your consent (Art. 6 (1) letter (a) GDPR) for the sending of marketing communications when so required by data protection and privacy laws, in which case we will ask your consent prior to the sending of the communication. Milliman SAS may also use professional contact details of its clients’ employees for the purpose of sending surveys, questionnaires or for the purpose of organizing games. For those activities, the legal basis for the processing of Personal Data is Milliman SAS’ legitimate interest (Art. 6 (1) letter (f) GDPR), unless data protection and privacy law require your prior consent. We may also collect and process limited Personal Data about you from public resources (such as LinkedIn) including your name/surname, email address, telephone number, organization, title/position, profession, professional interests, to allow us to assess a potential interest in our services and to contact you for marketing purposes.
When we communicate with you regarding the products and services we offer or develop, you will be given the opportunity in each communication to unsubscribe and prevent future communications of that sort. If you do not want us to collect this information from our marketing emails, or if you wish to unsubscribe from direct marketing communications from us, you may write to us at firstname.lastname@example.org requesting the same. We will cease using your Personal Data for direct marketing purposes once you have requested us to do so.
If you provide us with Personal Data of another individual, it is your duty to make sure that these individuals have consented to or are appropriately informed about the processing of their Personal Data by Milliman.
No automated decision-making is undertaken based on the Personal Data collected from you.
Milliman’s websites, products, and services are not directed to children, and Milliman does not knowingly collect Personal Data from children. If a parent or legal guardian becomes aware that his or her child has provided Milliman with Personal Data without their consent, the parent or legal guardian should contact Milliman at email@example.com, and Milliman will take steps to delete any such Personal Data.
Access and Corrections
As allowed or required by law and consistent with our applicable agreements, you may contact Milliman at any time at firstname.lastname@example.org to request a copy of any Personal Data that Milliman has about you, to request that certain Personal Data be corrected, updated, or deleted, or to express any complaints or concerns about Milliman’s use of your Personal Data. It is not technologically possible to change or delete each and every instance of the data Milliman holds on its systems, and some Personal Data may remain in non-erasable forms.
Milliman’ website may contain links to websites hosted and operated by companies other than us (“Third-Party Websites”) to which you can export (part of) your Personal Data.
Affiliates and Authorized Third-Party Agents
Any transfers of Personal Data are subject to appropriate safeguards that are compliant with Applicable Data Protection Laws (adequacy decision or Model Clauses of the European Commission or any successor adequacy decision and standard contractual clauses). Those can be made available at Milliman’s premises, by contacting us at email@example.com.
Milliman’s accountability for Personal Data that it receives under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, Milliman remains responsible and liable under the Privacy Shield Principles if third parties engaged by Milliman process the Personal Data in a manner inconsistent with the Principles, unless Milliman proves that it is not responsible for the event giving rise to any damage. Additionally, Milliman, Inc. has put in place data protection agreements with its affiliates located in the European Economic Area and the United Kingdom based on the EU Standard Contractual Clauses issued by the European Commission (the “EU Standard Contractual Clauses”).
As further explained in the "How to Contact Us" section below, Milliman encourages any individual to contact us should they have a Privacy Shield-related (or general privacy-related) complaint. Any right of access, rectification, erasure, restriction of the processing as well as the right to data portability of individuals domiciled in the European Economic Area, the United Kingdom or Switzerland may be exercised under the conditions set forth in the GDPR by contacting Milliman at: firstname.lastname@example.org. Furthermore, these individuals will have the right to lodge a complaint with a competent supervisory authority at any time.
You have a number of rights under Applicable Data Protection Laws in relation to your Personal Data, namely:
(i) the right of access: you have the right to obtain from us confirmation as to whether or not Personal Data concerning you is being processed, and, where that is the case, access to (including by obtaining a copy of) such Personal Data and the manner in which, and the purposes for which we process your Personal Data, so that you can verify its accuracy and the lawfulness of the processing.
(ii) the right to rectification: you have the right to obtain from the us the rectification of inaccurate Personal Data concerning you, and the right to have incomplete personal data completed, including by means of providing a supplementary statement.
(iii) the right to erasure: the right to obtain from us the erasure of your Personal Data delay where (a) your Personal Data is no longer necessary for the purpose for which it was collected/processed; (b) you wish to withdraw your consent to processing (except where we have another legal ground for the processing that we may rely on); (c) where processing is based on our legitimate interests and there are no overriding legitimate grounds for processing; (d) where your Personal Data has been unlawfully processed;
(iv) the right to restriction of processing: you have the right to obtain from us the restriction of processing of your Personal Data where (a) the accuracy of such Personal Data is contested by you (for such period as will enable us to verify the accuracy of your Personal Data); (b) the processing of your Personal Data is unlawful, but you do object to the deletion of such data and request restriction of its use instead; (c) you consider that we no longer need your Personal Data for the purposes of the processing, but require such Personal Data for the establishment, exercise or defense of legal claims; (d) you have objected to the processing of your Personal Data on grounds of “legitimate interest” as per (iii) above, pending verification by us on whether our legitimate grounds override your own.
(v) the right to objection: you have the right to object, on grounds relating to your particular situation, at any time to processing of your Personal Data, which is based on point our legitimate interests, including profiling based on those provisions. We shall no longer process the Personal Data unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. You may object to the processing of your Personal Data or direct marketing purposes at any time, without giving reason.
(vi) the right to data portability: you have the right to receive Personal Data concerning you, and which you have provided to us, in a structured, commonly used and machine-readable format, and to transmit such data to another data controller (please note this applies only where our processing of your Personal Data is based on your consent, and the processing is carried out by automated means).
(vii) the right to appeal to a competent data protection supervisory authority: you have the right to appeal to the competent data protection supervisory authority - in the UK, such authority is the Information Commissioner’s Office (https://ico.org.uk/).
Please note that any processing of your Personal Data prior to the deletion of your account with us, or your request that we no longer contact you for direct marketing purposes will remain valid under the legal grounds then prevailing.
You can exercise any of your rights as stated above, by sending us a request to email@example.com. We will endeavor to respond to any such request as soon as possible, and in any event within the legal deadline.
How to Contact Us