Where we cannot rely on one of the above lawful bases to process your Sensitive Personal Information for a particular purpose, we will seek your explicit consent.

If you would like to know more about the lawful bases we rely upon, or how the lawful basis of legitimate interests applies to a particular purpose, you can contact us.

3. Who Personal Information is Shared With

In connection with the purposes set out above, we will sometimes share Personal Information with T&R Direct and third parties, including:

• brokers, financial advisers and business partners, who help us arrange, manage and underwrite our products and who provide insurance services;
• other insurers;
• third parties who provide you with services, relating to your product, e.g. home emergency cover;
• third parties who provide us, or a third-party insurer relevant to your product or claim, with services, e.g. loss adjusters, claims handlers, assistance providers, third-party case managers, handling your care or treatment pathway, experts and, in limited circumstances, private investigators;
• legal advisers, accountants, auditors and professional service firms who act on our or your behalf, or who represent a third-party claimant;
• data analysts and providers of data services who support us with developing our products and prices and measuring the effectiveness of marketing;
• third parties that help us maintain the accuracy of our data, e.g. by identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details;
• financial crime detection agencies, sanctions checking providers and third parties who maintain fraud detection databases or aid with investigation in cases of suspected fraud;
• regulators who regulate how we operate, including the FCA, PRA, Financial Ombudsman, HMRC and ICO;
• government agencies and regulatory bodies including the police, courts and the DWP;
• insurance industry bodies, including the Association of British Insurers;
• credit reference agencies;
• service providers, including those who help operate our IT and back office systems, underwriting and claims processes and our information security controls;
• medical professionals, if we need to access health records or assessments for the purposes of arranging and underwriting certain products or facilitating and handling claims;
• research agencies and providers of market research services, including customer feedback surveys;
• providers of marketing and advertising services, including delivering and administering marketing, ensuring you receive marketing content that’s relevant to you and in accordance with your preferences and analysing marketing campaigns. These may include media agencies, fulfilment partners, social media and other online platforms and advertising technology companies. You can find further information about this in the section on Marketing; and
• Third parties in connection with any sale, transfer or disposal of our business.

Some of the organisations we share information with may be located outside of the UK. For further information, please see the section on International Data Transfers.

4. Fraud and Other Financial Crime

We use your Personal Information to detect and prevent fraud and other financial crime including to meet our statutory and regulatory responsibilities in relation to fraud and financial crimes.

If you’re making an application or a claim, we may use profiling and other forms of automated processing to assess if your application or claim may be fraudulent. This assessment may involve the use of Sensitive Personal Information or criminal data. For example, we may use details of any convictions relating to fraud or dishonesty. For further details, see Automated Decision Making.

We also use your Personal Information to help us detect fraud committed by brokers or financial advisers.

To prevent, detect and investigate fraud, we:

• check public registers (e.g. the electoral roll or registers of county court judgments, bankruptcy orders or repossessions);
• conduct online searches from websites, social media and other information sharing platforms;
• use databases managed by credit reference agencies, insurance industry bodies, fraud detection agencies and other reputable organisations. This includes the Insurance Fraud Bureau whose Privacy Policy can be viewed here: https://insurancefraudbureau.org/privacy-policy/ and
• share Personal Information and undertake searches with other third parties, including other insurers, fraud prevention agencies, law enforcement agencies, public bodies and our regulators (which include the FCA, PRA and ICO).

This will help us verify your identity, make decisions about providing you with our products and related services such as paying claims, and trace debtors or beneficiaries.

If you give us false or inaccurate information and we suspect fraud, we’ll record this to prevent further fraud and money laundering and this may be shared between insurers.

We can supply on request further details of the agencies and databases we access or contribute to and how this information may be used. If you require further details contact us.

How your data is used and shared by Insurers and Databases in relation to household insurance

The data you provide will be used by us and shared with other insurers as well as certain statutory and other authorised bodies for:

• Insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:

1. consider whether to accept the relevant risk;
2. make decisions about the provision and administration of insurance and related services for you and members of your household;
3. validate your (or any person or property likely to be involved in the policy or claim) claims history (at any time, including upon application for insurance, in the event of an incident or a claim, or at a time of renewal).

• Management information purposes, i.e. to analyse insurance and other markets for the purposes of:

1. portfolio assessment;
2. risk assessment;
3. performance reporting;
4. management reporting.

• Anti-fraud purposes i.e. to detect and prevent fraudulent claims and/or activities by:

1. sharing information about you with other organisations and public bodies including the police;
2. tracing debtors or beneficiaries, recovering debt, managing your accounts and/or insurance policies;
3. undertaking fraud searches. Insurers pass information to the Claims Underwriting and Exchange Register administered by Motor Insurers’ Bureau (MIB). This helps insurers check information and prevent fraudulent claims. When we deal with your request for insurance we may search these registers.

• Compliance with legal obligations and responsibilities, including:

1. Claims management – In the event of a claim we may need to disclose information with any other party involved in that claim, e.g. third parties involved in the incident, their insurer, solicitor or representative and medical teams, the police or other investigators. We also may have to investigate your claims history;
2. Complaints management – If you make a complaint about the service we have provided, we may be obliged to forward details about your complaint, including your Personal Information, to the relevant ombudsman.

5. Credit Reference Agencies

When you purchase a policy from T&R Direct, we may undertake some checks with a credit reference agency. The checks that we do will depend on how you bought your policy and whether we offer a credit payment facility via Close Brothers Premium Finance. When you buy your policy, you will be informed about these assessments before we do them.

Where you purchase your policy through T&R Direct or certain of our business partners, and if it is a policy with which we will assess whether we can offer you with a credit payment facility via Close Brothers Premium Finance, the following checks will be undertaken:

We or our agents may:

• undertake checks against publicly available information (e.g. electoral roll, county court judgments, bankruptcy orders or repossession(s)). Similar checks may be made when assessing claims; and
• carry out a quotation search from a credit reference agency. We do this so that we are able to offer monthly credit payment options.

We use data from a credit reference agency to verify your identity, prevent fraud and carry out risk profiling which allows us to calculate your premium and payment options. We may need to obtain information relating to you at quotation, renewal and in certain circumstances where policy amendments are requested. The credit reference agency we use for these searches is Lexis Nexis.

As part of our regulatory obligations, before we can enter into a credit agreement, we must carry out an affordability assessment. This means that before we offer you your payment options, we will obtain an affordability report from a credit reference agency which will include an estimated disposable income figure and the underlying data used to calculate this figure. The credit reference agency calculates your estimated disposable income using information it holds about you about your existing credit commitments and modelled information relating to income and living expenses. We will use your estimated disposable income figure to help assess whether additional credit could cause you financial harm. We will do this when you request a quote and at renewal so that we know whether we can offer you a monthly credit payment option of not. The credit reference agency we use for this search is Experian.

The quotation and affordability searches will appear on your credit report and will be visible to other credit providers. It will be clear it is part of a quote and not a credit application by you.

In order to assess your application, we will supply your Personal Information to credit reference agencies and they will give us information about you, such as about your financial history. We do this to assess creditworthiness, affordability and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with credit reference agencies on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. credit reference agencies will share your information with other organisations. Your Personal Information will also be linked to the data of your spouse, any joint applicants or other financial associates.

Information about the credit reference agencies we supply your Personal Information to and the ways in which they use and share Personal Information, are explained in more detail at www.lexisnexis.co.uk/crain and www.experian.co.uk

In order to assess your application, we will supply your Personal Information to our credit reference agency and they will give us information about you, such as about your financial history. We do this to assess creditworthiness, affordability and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with credit reference agencies on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. credit reference agencies will share your information with other organisations. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates.

The identity of our credit reference agency and the ways in which they use and share Personal Information, are explained in more detail at www.lexisnexis.co.uk

6. Automated Decision Making

We may make decisions about you based on automated decision making. Our automated process helps us to make predictions, e.g., the likelihood that a claim will be made and its value, the likelihood a product will be purchased or the likelihood that a claim might be fraudulent. This helps us to determine eligibility for a policy, the terms of the policy, the price, and, where applicable, whether we can provide you with a monthly credit payment option.

We use an automated underwriting engine as part of that process, which uses the information you have provided, including Sensitive Personal Information, and information we receive from third parties as set out in Types of Personal Information collected. The automated engine may also validate information you provide against other records we hold about you in our systems and third-party databases.

For example, an automated decision in relation to the price of your home insurance policy is based on various factors including the type of property, your claims history, the risk of flooding and the likelihood of crime in your area.

Your personalised price may be presented to you in suitable marketing communications, including those sent from price comparison websites or third-party partners with whom you have a relationship.

We also make automated decisions throughout the life of your policy, e.g. before offering you a renewal or when dealing with a claim.

Where we make an automated decision, which has a legal or substantially similar effect you have the right to speak to someone from T&R Direct who may review the decision, provide a more detailed explanation, and assess if the automated decision was made correctly. For more information about this right and how to exercise it please see Data Rights.

7. Profiling and Data Analysis

We use profiling and other data analysis to build, train and audit our insurance models and algorithms (including our automated underwriting engine described in Automated Decision Making) and our machine-learning tools. The models, algorithms and tools we use help us do a number of things including:

• understanding our customers better, e.g., how they feel about T&R Direct, what kind of content or products would be of most use and interest to them, whether they might be displaying characteristics of vulnerability that mean they require further assistance from us; and
• predicting the likelihood of events arising to assess insurance risk or to predict if a claim might be fraudulent.

We use a number of data items as described in this Privacy Policy for these purposes. Before we use any such data, we carry out a number of checks including ensuring there are no legal restrictions on using the data under data protection laws, the Equality Act 2010 or under FCA rules and we consider whether use of the data might cause outcomes that are unfairly or unlawfully biased. We then use statistical modelling techniques to assess the data to ensure that the data tells us something meaningful. From time to time, we may share your Personal Information with third parties who provide us with new data which we will test to understand if such new data provides additional understanding.

We may also use profiling and data analysis for other reasons such as to ensure data quality and accuracy and to help us improve our business.

The purpose of this analysis is not to make decisions about you directly, but your Personal Information, in combination with Personal Information relating to other customers and/or data provided by third parties, will be used to conduct data analysis so that we can improve our processes, our products and services and check the way our models, algorithms and machine-learning tools work.

Where possible, we pseudonymise the Personal Information in order to perform this analysis. This means that we remove information from which you can be directly identified, e.g. your name, and replace it with a pseudonym or unique identifier. We do this to maximise the security of your information.

We also use profiling in relation to marketing. For further information please see Marketing.

8. Retention

We keep Personal Information for as long as is reasonably required for the purposes explained in this Privacy Policy. We also keep records – which may include Personal Information – to meet legal, regulatory, tax or accounting needs. For example, we are required to retain an accurate record of your dealings with us, so we can respond to any complaints or challenges you or others might raise later. We’ll also retain files if we reasonably believe there is a prospect of litigation. The specific retention period for your Personal Information will depend on your relationship with us and the reasons we hold your Personal Information.

To support us in managing how long we hold your data and our record management, we maintain a data retention policy which includes clear guidelines on data retention and deletion.

If you would like more information about our data retention policy, please contact us.

9. International Data Transfers

Sometimes we, or third parties acting on our behalf, may need to transfer Personal Information outside of the UK. We’ll always take steps to ensure that any transfer of Personal Information outside the UK is carefully managed to protect your privacy rights and ensure that adequate safeguards are in place. This might include transfers to countries that the UK considers will provide adequate levels of data protection for your Personal Information (such as countries in the European Economic Area) or putting contractual obligations in place with the party we are sending information to. Transfers within T&R Direct will be covered by an agreement entered into by members of the T&R Direct group of brands (an intra-group agreement) which contractually obliges each group company to ensure that your Personal Information receives an adequate and consistent level of protection wherever it is transferred within the group.

For more information about data transfers and the safeguards we have put in place, please contact us.

10. Marketing

We may use Personal Information to send direct marketing communications about our products and services that we feel you’ll be interested in. This may include marketing relating to products offered by other brands within T&R Direct.

Marketing communications may be sent by email, post, SMS, telephone and push notification. You may also see display advertising on websites, mobile applications, social media, television or in online search results.

You have control over our use of your Personal Information in relation to marketing communications. You can:

‘Opt out’ of receiving direct marketing. When you register with us, request an online quote, or purchase a product or service you will be given the opportunity to opt out. In addition, our email, post, SMS and telephone marketing communications include information to help you manage your marketing preferences;

Change your marketing preferences at any time by e-mailing us at [email protected] or writing to us at T&R Direct, 6 Concept Park, Innovation Close, Poole, Dorset. BH12 4QT.

Please note that opting out of one type of marketing, e.g. by email or telephone, doesn’t mean you will be opted out of all marketing. Bear this in mind when you manage your preferences. You can always contact us directly if you would like us to stop all forms of direct marketing.

We try to limit marketing and only send you offers and promotions that you might be interested in, based on Personal Information we have about you and profiling that we have carried out (further details can be found under the sub-heading ‘Marketing profiles’ below). We won’t send you unsolicited messages (spam).

Please remember that if you opt out of receiving marketing, we will still send you communications relating to your products.

Cookies and similar technologies

We rely on third-party advertising technology (such as the deployment of cookies or small text files on our website or pixels within emails) to collect information about you. This technology is used to optimise what you may see on our websites and deliver content when you are browsing elsewhere. We may also collect information about your use of other websites. We do this to provide you with advertising that we believe may be relevant for you, as well as to improve our own products and services.

For further information about cookies and other technologies we use on our website and how to manage cookies, please see our Cookie Policy.

Social media and online platforms

We share Personal Information with media agencies and social media and other online platforms to help us target our online marketing. Social media and other online platforms may also use Personal Information they hold and combine it with Personal Information received from us to create target audiences. These are audiences that we think would be interested in our online advertising. This may involve social media and other online platforms building a ‘lookalike’ profile of the type of person we are trying to target and providing specific adverts to those people when they browse the internet or use social media.

If we use or share Personal Information with third parties in order to send you direct marketing, we will respect the marketing preferences you have set. We recommend you routinely review the privacy notices and preference settings that are available to you via our website or upon request.

Marketing profiles

We use automated processes to help us provide more personalised marketing of our products. To do this, our automated process creates a marketing profile for you using information such as:

• identification data;
• behavioural data (e.g. data relating to your use of our website);
• your gender and age;
• contact data;
• status data (e.g. number of children in household);
• product related data (e.g. policy identifiers);
• device and vehicle-related data.

Our process analyses this data to determine the most relevant products, services, offers or benefits to offer you and to decide the appropriate time and channel for offering them to you.

Information obtained in relation to one product may be used in relation to marketing other products from T&R Direct.

11. Data Rights

You have legal rights under data protection laws in relation to your Personal Information. Read below to learn more about each right you may have.

We may ask you for proof of identity when you make a request to exercise any of these rights. We do this to ensure we only disclose information to the right individual.

We aim to respond to all valid requests within one month. It may take us longer if the request is particularly complicated or you have made several requests. We’ll always let you know if we think a response will take longer than one month. We may also ask you to provide more detail about what you want to receive or are concerned about.

We may not always be able to do what you have asked. This is because your rights will not always apply, e.g. if it would impact the duty of confidentiality we owe to others, or if the law allow us to deal with the request in a different way. We will always explain to you how we are dealing with your request. In some circumstances (such as the right to erasure or withdrawal of consent), exercising a right might mean that we can no longer provide our product to you.

For further information about or to exercise any of your rights, please contact us. If you wish to make a subject access request, please contact the office.

Your rights are as follows:

Access to your Personal Information

You may ask us for a copy of your Personal Information together with specified details about how we use your information. This is commonly known as a ‘subject access request’.

If you wish to make a subject access request, please contact the office.

If your request is made electronically, we will, where possible, respond to you electronically. Otherwise, we will normally respond in writing unless you request otherwise.

Rectification of your Personal Information

We do our best to ensure that your Personal Information is accurate and kept up to date. If you believe your information is inaccurate or incomplete, then please contact us to request that we amend or update it.

Erasing your Personal Information

You may ask us to erase your Personal Information, but this right only applies in certain circumstances, e.g. where:

• it is no longer necessary for us to use your Personal Information for the original purpose;
• our lawful basis for using your Personal Information is consent and you withdraw your consent; or
• our lawful basis is legitimate interests and there is no overriding legitimate interest to continue using your Personal Information if you object.

This isn’t an absolute right and we have to balance your request against other factors such as legal or regulatory requirements, which may mean we cannot erase your Personal Information.

Restricting processing of your Personal Information

You may ask us to stop using your Personal Information in certain circumstances such as:

• where you have contacted us about the accuracy of your Personal Information and we are checking the accuracy;
• if you have objected to your Personal Information being used based on legitimate interests.

This isn’t an absolute right and we may not be able to comply with your request.

Data portability

In some cases, you can ask us to transfer Personal Information that you have provided to us to another third party of your choice. This right only applies where:

• we have justified our use of your Personal Information based on your consent or the performance of a contract with you; and
• our use of your Personal Information is by electronic means.

Right to object

You can object if you no longer wish to receive direct marketing from us. Please see Marketing for further information.

You may also object where you have grounds relating to your particular situation and the lawful basis we rely on for using your Personal Information is our (or a third party’s) legitimate interests. However, we may continue to use your Personal Information where there are compelling legitimate grounds to do so.

Automated decision making and profiling

You have the right not to be subject to a decision which is based solely on automated processing (without human involvement) where that decision produces a legal effect or otherwise significantly affects you. This right does not apply if the decision is:

• necessary for the purposes of a contract between us and you;
• authorised by law (e.g. to prevent fraud); or
• based on your explicit consent.

You do however have a right to request human intervention, express your view and challenge the decision.

Withdrawing consent

In some circumstances we ask for your consent to use your Personal Information. You are free to withdraw your consent at any time.

If it is the case that we need your consent to provide you with a particular product and you wish to withdraw your consent, we may no longer be able to provide our product to you. Where that is the case, we will inform you before taking any action.

12. Contacting T&R Direct

If you have any questions about this Privacy Policy or how to exercise your rights, please contact our Data Protection Officer:

Write to: The Data Protection Team, T&R Direct, 6 Concept Park, Innovation Close, Poole, Dorset. BH12 4QT

Email us: [email protected]

Call the office: 01202 710008

If you’d like to submit a subject access request, please fill out this form or write to us at the above address.

If you’re not happy with the way we’re handling your Personal Information, you have a right to make a complaint with your local data protection supervisory authority at any time. In the UK this is the Information Commissioner’s Office (ICO). We ask that you please attempt to resolve any issues with us before contacting the ICO.

13. Updates

This Privacy Policy is updated from time to time to take account of changes in our business activities, legal requirements and to make sure it’s as transparent as possible, so please check back here for the current version. You can see when this Privacy Policy was last updated by checking at the top of this page.