Claims.co.uk Limited B2C Privacy Policy

The Data Controller: Claims.co.uk Limited.

Registered Office Address: 2 Park Street, 1st Floor, London, United Kingdom, W1K 2HX.

Company Number: 06843986.

ICO Registration Reference: Z3503238.

Email: contactus@claims.co.uk

Telephone: 02893 359698

We may collect the following Personal Data:

To process your Personal Data, we must have an appropriate Lawful Basis. In other words, a legal basis or legal grounds to process your Personal Data is a requirement imposed by the UK GDPR. As such, we process your Personal Data based on and permitted by the following Lawful Bases:

• Consent (Article 6(1)(A) UK GDPR) – where you have given us clear and informed consent (e.g. to refer your details to a partner law firm).
• Legal Obligation (Article 6(1)(C) UK GDPR) – where we are required to process your personal data to comply with legal and regulatory requirements (e.g. FCA, ICO, Financial Ombudsman Service, call recording rules).
• Vital Interests (Article 6(1)(D) UK GDPR) – where processing is necessary to protect someone’s life, such as in an emergency.
• Legitimate Interests (Article 6(1)(F) UK GDPR) – where we or a third party have a legitimate business interest in processing your data, provided your rights and freedoms are not overridden.

We are only permitted to process Special Category Data (e.g., health, ethnicity, beliefs, sexual orientation) if we have a Lawful Basis (Article 6 UK GDPR) and a condition under Article 9 UK GDPR. As such, we may rely on:

• Explicit Consent (Article 9(2)(a)) – where you clearly agree to provide and allow us to process sensitive information (e.g. vulnerability support or referral content).
• Vital Interests (Article 9(2)(C) UK GDPR) – where it is necessary to protect your life or someone else’s life and you are physically or legally unable to provide consent (e.g. in an emergency where we must contact emergency services based on disclosures made during a call).
• Legal Claims (Article 9(2)(F) UK GDPR) – where processing is necessary for the establishment, exercise, or defence of legal claims (e.g. complaints handling, disputes, litigation support or law firm referrals).
• Substantial Public Interest (Article 9(2)(G) UK GDPR), where supported by a condition in Schedule 1 of the Data Protection Act 2018:
  • Schedule 1, Paragraph 6 – where we are required to process special category data to comply with regulatory requirements, including those imposed by the Financial Conduct Authority (FCA) or the Financial Ombudsman Service (FOS).
  • Schedule 1, Paragraph 18 – where we identify and support vulnerable individuals as part of our duty to safeguard the economic well-being of persons at economic risk.

We may process data relating to criminal offences (e.g. fraud investigation information, allegations of impersonation, or law enforcement requests). This is known as criminal offence data under Article 10 UK GDPR.

We will only process such data where:

• The processing is authorised by UK law
• One of the conditions in Schedule 1 of the Data Protection Act 2018 is met
• An appropriate policy document is in place, as required by law

We rely on the following conditions for processing criminal offence data:

• Schedule 1, Paragraph 10 – Processing is necessary for the prevention or detection of unlawful acts
• Schedule 1, Paragraph 14 – Processing is necessary for preventing fraud
• Schedule 1, Paragraph 12 – Legal claims or judicial acts (e.g. where part of dispute or litigation processes)

We maintain an appropriate policy document that outlines our procedures for safeguarding this data and our data retention and review practices.

We will lawfully process your Personal Data for a variety of Purposes, some of which may include:

We may obtain Personal Data about you from a variety of sources, depending on the purposes for Processing. Sources of Personal may include:

Where appropriate, your Personal Data may be disclosed to third parties, including Controllers, Processors and Sub-processors. As detailed within this Policy, disclosure of your Personal Data is contingent on purpose and Lawfulness of that Processing (Article 6 UK GDPR), including any further conditions that may need to be relied upon regarding Special Category Data (Article 9 UK GDPR) and/or Criminal Offence Data (Article 10 UK GDPR and Schedule 1, the UK Data Protection Act 2018).

As such, your Personal Data may be disclosed to the following third parties for the following purposes:

We may transfer Personal Data outside the UK/EEA to third countries when using Processors that may also use Sub-processors. In these circumstances, any transfers should be made where there is an adequacy decision. Where no adequacy decision applies, we and our Processors have Binding Corporate Rules (BCRs) and/or Standard Data Protection Clauses such as an International Data Transfer Addendum (an addendum to the EU’s Standard Contractual Clauses) or an International Data Transfer Agreement. Alternatively, these transfers may be made to a receiver that has signed up to an approved code of conduct or has a certification under an approved certification scheme. Alternatively, a transfer may be covered by an exception specified within the UK GDPR.

How We Protect Your Data:

We take reasonable steps to ensure the security of your Personal Data, including:

• Implementing physical, technical, and administrative safeguards
• Ensuring access to Personal Data is limited to authorised personnel
• Regular training for employees on data protection principles

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR. All employment-related decisions, including recruitment, performance evaluation, and disciplinary matters, involve meaningful human involvement.

One of the third-party services we use on our Site is Google Analytics, a web analysis service provided by Google, to better understand your use of the Site and Services. Google Analytics collects information such as how often users visit the Websites, what pages they visit and what other sites they used prior to visiting. Google uses the data collected to track and examine the use of our Site, to prepare reports on its activities and share them with other Google services. Google may use the data collected on our Site to contextualise and personalise the ads of its own advertising network.

More information and opt out: Click here for Google’s privacy policy and here for more information about the kinds of cookies placed by Google. Click here for information about how Google uses data from its partners’ sites or apps, as well as different ways to opt out of Google cookies.

Google offers an opt-out mechanism for the web available here.

Data Retention Periods:

We will retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected or as required by law. After this period, data will be securely deleted. To determine the appropriate retention period for Personal Data, We considers the amount, nature and sensitivity of the Personal Data, the potential risk, of harm from unauthorised use or disclosure of Personal Data, and the purposes for which we Process Personal Data and whether we can achieve those purposes through other means, including applicable legal requirements.

The following Data Retention Periods apply. Should you wish to find out more about retention periods, if you cannot locate information that you would expect, please use the contact information provided in this Policy.

Under the UK GDPR, individuals have several rights regarding their Personal Data. However, not all rights are absolute. Some may be restricted based on legal obligations, legitimate interests, or the rights of others. Keeping this in mind, you have the following rights regarding your Personal Data:

To exercise your rights, please get in touch using the contact details provided. We will respond within one calendar month, unless the request is complex or multiple, in which case we may extend by a further two months (you will be informed).

We do not use your personal data to carry out any automated decision-making that produces legal or similarly significant effects on you.

We also do not engage in profiling (i.e. automated processing of personal data to evaluate certain personal aspects, such as behaviour, preferences, or interests), unless this is clearly explained and consented to at the point of collection.

Should our approach change in the future, we will update this privacy notice accordingly and inform you if required by law.

If you have any concerns about how we handle your Personal Data, we encourage you to contact us first so we can resolve the issue. It is also likely that the Information Commissioner’s Office will require that you first attempt to resolve the matter with us before it can assist.

Generally speaking, you can complain to us about our handling of your Personal Data if we:

• Have not responded to your request for your personal information
• Have not kept your information secure
• Hold inaccurate information about you (unless you provided it)
• Have unlawfully disclosed information about you
• Keep information about you for longer than is necessary
• Have collected information for one reason and use it for something else
• Have not upheld any of your data protection rights

–

However, you also have the right to lodge a complaint directly with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters:

Website: www.ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to the Privacy Policy:

We may update this Privacy Policy from time to time. Any changes will be reflected within this Privacy Policy, including the nature of the changes and the date on which they were made.