Privacy

Privacy Notice

Lighthouse Advisory Ltd. · Last updated 12 September 2026

This notice explains how Lighthouse Advisory Ltd. (“Lighthouse”, “we”, “us”) uses personal information, and the rights individuals have, under Bermuda’s Personal Information Protection Act 2016 (“PIPA”).

Who we are

Lighthouse Advisory Ltd. is a Bermuda advisory firm providing strategy, regulatory, and risk advisory services to the re/insurance market. For the purposes of PIPA, Lighthouse is the organisation responsible for the personal information described in this notice.

What we collect

• Enquiries and contact details — if you contact us by email or through the form on this website, we collect the details you provide: your name, firm, email address, and the content of your message.
• Business relationship information — contact details and correspondence relating to clients, prospective clients, and professional contacts. Where this is information used to contact you in your professional or organisational capacity, PIPA’s business-contact provisions may apply.
• Engagement information — in the course of advisory engagements we may receive data from clients that includes personal information. Our default is to work with anonymised or aggregated data; where identified personal information is required, its handling is governed by the terms of the relevant engagement.

We do not seek to collect sensitive personal information (such as health information) through this website. Where engagement data may contain sensitive personal information, additional safeguards are agreed with the client before it is shared.

Why we use it

• To respond to enquiries and correspond with you (with your knowledge and consent, provided when you contact us).
• To deliver advisory engagements and manage client relationships (necessary for the performance of a contract).
• To meet legal, regulatory, and professional obligations, including record-keeping requirements.

We do not sell personal information, and we do not use your details for marketing without a lawful basis and a way for you to opt out.

Who we share it with

We use a small number of service providers to run the firm, and personal information may be processed by them on our behalf: Microsoft (email, documents, and file storage), Cloudflare (website hosting and security), Resend (delivery of contact-form messages), DocuSign (electronic signature of engagement documents), and Anthropic (AI tools used in research and drafting, under commercial terms that prohibit training on our data). We may also share information with professional advisers (legal, accounting, insurance) where required, and with authorities where the law requires it.

Overseas transfers

Some of our service providers process information outside Bermuda. Where personal information is transferred overseas, we assess the level of protection provided and rely on contractual and other safeguards, and we remain responsible for it as required by PIPA.

How long we keep it

• Engagement records — up to 7 years after the engagement ends.
• Accounting and tax records — up to 5 years.
• Enquiries and business-development records — up to 2 years.

These are maximum default periods; information is deleted or anonymised sooner where it is no longer needed, and may be kept longer only where the law requires it.

Your rights

Under PIPA you may request access to the personal information we hold about you, ask us to correct it, block or stop a particular use of it, ask us to erase it, or require us to stop using it for marketing. To exercise any of these rights, contact the Privacy Officer at [email protected]. We will respond within 45 days, or explain if more time is needed.

Security and breaches

We protect personal information with proportionate technical and organisational safeguards, including access controls, encryption in transit, and credential management. If a breach of security occurs that is likely to adversely affect an individual, we will notify the Privacy Commissioner and the affected individuals without undue delay.

Complaints

If you have a concern about how we handle personal information, please raise it with the Privacy Officer first. You also have the right to complain to the Office of the Privacy Commissioner for Bermuda (privacy.bm).

How we use AI

Lighthouse Advisory uses AI tools in research and drafting, including the research and drafting behind the analysis we publish. Everything issued under our name is reviewed and owned by its author, reflects views we hold and work we have actually done, and is checked against primary sources before it appears. This is our standing statement of that practice; individual articles and posts do not carry a separate notice. When we act for clients, AI tools are used only under commercial terms that prohibit training on client data and limit retention, and clients may opt out of AI-assisted work at any time. Our AI & Data Protection Statement explains what we do and do not do, and the protections that apply.

Changes to this notice

We may update this notice from time to time; the current version will always be available on this page, with the date of the last update shown above.